tajniak81andClaude Opus 5
9bd5c523c4
The integration cascade stored its top layer differently from the two below it: org (L2) and user (L3) plugin config lived in PocketBase, in a pluginSettings field, while the global (L1) layer sat in a plugins.json next to the binary. That split was accretion rather than design - the file was the whole store in the v1 MVP, and the per-tenant layers were later built on PocketBase and layered on top of it instead of replacing it. It also cost something real. plugins.json was a second state store with different durability from pb_data: its own volume, its own ownership, its own backup. Losing pb_data is unmissable; losing api_data was silent, which is how "every plugin comes back disabled after a redeploy" happened. L1 now lives in the app_settings collection - one record keyed "global", holding its settings in a pluginSettings field, the same mechanism and the same field name the layers below use. The documents still differ in shape, because only L1 carries enable state and the registration of external plugins, but the storage is no longer a special case. The Manager grows a Store seam (PocketBase in production, file for the import, memory for tests) and, more importantly, a loaded gate. Settings in a database mean the store can be unreachable at boot - a cold stack, or a service account still to be set from the panel. That must not read as "no plugins configured", or the first save would write emptiness over real settings. So until a read succeeds the Manager stays unloaded, every mutation is refused, /api/admin/plugins* answers 503, and a background retry backs off to two minutes. The same gate covers a document that will not parse: it is never replaced by one built from an empty map, which is a stronger guarantee than the .corrupt backup it replaces. Writing to a store also revealed a hole in the previous fix. Classifying a save failure as errPersist was left to each Store, and a store that returned a plain error would fall through to the "saved, but the plugin failed to start" branch and be reported as a 200 - the same silent-success bug through a different door. The Manager now classifies, whatever the Store returns; a test pins it. Upgrades are automatic: on the first boot that finds no settings in the database, an existing plugins.json is imported and renamed to plugins.json.migrated. The import is refused if the store is merely unreachable, or if the file does not parse, so a stale or broken file can never overwrite live settings. /data is still needed - the panel rewrites .env there when it retargets PocketBase - but plugin settings no longer depend on it. 21 tests in internal/plugins cover both stores, including the production path against a fake PocketBase: create-then-update of the singleton, round-trip across a restart, an outage that leaves settings intact, a missing collection reading as not-ready rather than empty, and the import running exactly once. go build, go vet and go test ./... pass. Schema changes are mirrored into scripts/setup-pocketbase.mjs as that file requires. Not verified: no Docker CLI here, so no image was built and the bootstrap of app_settings against a real PocketBase is untested outside the fake. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
102 lines
4.1 KiB
Markdown
102 lines
4.1 KiB
Markdown
# DriverVault — Docker AIO (all-in-one image)
|
|
|
|
**PocketBase + API Server + Web App in a single container**, supervised by
|
|
`supervisord` with nginx serving the SPA and proxying `/api/` to the API Server
|
|
on localhost. One image, one volume set, no compose network — the simplest way
|
|
to stand DriverVault up on a single host.
|
|
|
|
Prefer the three-container stack in [`../Docker`](../Docker) when you want to
|
|
scale, upgrade or restart the pieces independently.
|
|
|
|
```
|
|
:80 nginx ─► SPA, and /api/ ─► API Server on 127.0.0.1:8080 ─► PocketBase on :8070
|
|
```
|
|
|
|
| File | Use |
|
|
|---|---|
|
|
| `Dockerfile` | the all-in-one image (build context must be the **repo root**) |
|
|
| `docker-compose.yml` | **builds from source** — for development and local testing |
|
|
| `docker-compose.prod.yml` | **pulls the prebuilt image** from the registry |
|
|
| `.env.example` / `.env.prod.example` | copy to `.env` for the matching compose file |
|
|
|
|
## Run it
|
|
|
|
```bash
|
|
cd "Docker-AIO"
|
|
cp .env.example .env # then edit — PB_ADMIN_* have no safe defaults
|
|
docker compose up -d --build
|
|
```
|
|
|
|
Production, from the registry:
|
|
|
|
```bash
|
|
cp .env.prod.example .env # then edit
|
|
docker compose -f docker-compose.prod.yml pull
|
|
docker compose -f docker-compose.prod.yml up -d
|
|
```
|
|
|
|
Then: web app on `http://host:8090/`, the API Server's superadmin panel on
|
|
`http://host:8080/`, PocketBase admin on `http://host:8070/_/`.
|
|
|
|
Note the port mapping: inside the container the web app is on **80**, published
|
|
as `WEB_PORT` (8090 by default) to line up with the other deployment.
|
|
|
|
## Building by hand
|
|
|
|
The build context **must be the repo root** so the Dockerfile can reach both
|
|
`API Server/` and `Web App/`:
|
|
|
|
```bash
|
|
docker build -f "Docker-AIO/Dockerfile" -t drivervault-aio .
|
|
```
|
|
|
|
Build args: `VITE_API_BASE` (leave empty so the bundle uses same-origin `/api`)
|
|
and `PB_VERSION`, which the Dockerfile already pins. Override it to build a
|
|
different PocketBase; set it to an empty string to resolve the latest release at
|
|
build time instead.
|
|
|
|
## First boot
|
|
|
|
Identical to the multi-container stack, and idempotent:
|
|
|
|
1. PocketBase upserts its superuser from `PB_ADMIN_EMAIL` / `PB_ADMIN_PASSWORD`.
|
|
2. The API Server waits for PocketBase to report healthy, then creates any
|
|
missing collections, reconciles existing ones, and creates the first app
|
|
`superadmin` from `DRIVERVAULT_SUPERADMIN_EMAIL` / `_PASSWORD`. Set
|
|
`PB_BOOTSTRAP=false` to skip once the database is established.
|
|
|
|
## Volumes
|
|
|
|
| Volume | Holds |
|
|
|---|---|
|
|
| `/pb/pb_data` | the PocketBase SQLite database and uploaded files |
|
|
| `/data` | the `.env` the API Server panel rewrites when a superadmin retargets the PocketBase connection (plugin settings live in `/pb/pb_data`, with everything else) |
|
|
|
|
Both default to Docker-managed named volumes; set `PB_DATA` / `API_DATA` to
|
|
absolute host paths in the prod file for bind mounts.
|
|
|
|
## Charger control (OCPP)
|
|
|
|
Chargers in own/proxy mode dial in to `/ocpp/{serial}` on the **API Server port
|
|
(8080)** — not through nginx — authenticating with a per-charger control token
|
|
in an OCPP Basic-auth header. Because a plaintext `ws://` would expose that
|
|
token, `OCPP_REQUIRE_TLS` defaults to `true`.
|
|
|
|
This image serves plain HTTP, so charger control needs TLS terminated in front
|
|
of it, with `OCPP_PUBLIC_URL` set to the public `wss://` base. Only drop
|
|
`OCPP_REQUIRE_TLS` on a trusted network.
|
|
|
|
## Caveats
|
|
|
|
- PocketBase and the API Server run as the unprivileged `app` user; only nginx
|
|
stays root, because it binds port 80. A crash of `supervisord` still takes all
|
|
three services down together — that is the trade for the simplicity.
|
|
- Logs from all three processes are interleaved on the container's stdout/stderr
|
|
(`docker logs drivervault-aio`).
|
|
- `PB_VERSION` is pinned in the Dockerfile so two builds of the same source
|
|
agree. Setting it to an empty string restores the old behaviour of resolving
|
|
the latest release **at build time**, which also costs an unauthenticated
|
|
GitHub API call and is subject to that 60/hour per-IP rate limit.
|
|
- The container reports health once all three processes answer their probes, so
|
|
a wedged component shows up in `docker ps` rather than looking up.
|