tajniak81andClaude Opus 5
c9a95131a5
Dockerfile.seaweedfs bakes `weed server -s3` into the all-in-one as a fourth supervisord program, sharing every build stage and the nginx config with Dockerfile.seaweedfs.split. The gateway's single identity is mapped from the PB_S3_* pair PocketBase already authenticates with, and an empty pair refuses to start rather than serving allow-anyone. The seaweedfs-init container becomes a step in PocketBase's program — wait for the gateway, create the bucket, then serve — so the bucket exists before the API Server's bootstrap checks it, in the order compose kept with depends_on. The volume server moves to 8081 because 8080 is the API Server; weed server has one bind flag for all four roles, so it stays open and the comment says never to publish it. docker-compose.prod.seaweedfs.yml goes from three services to one, with build: and image: both set under a registry name of its own. The env example and README follow. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
103 lines
5.3 KiB
Bash
103 lines
5.3 KiB
Bash
# DriverVault all-in-one — production config, SeaweedFS built into the same
|
|
# image (Dockerfile.seaweedfs). Copy to .env and fill in, then:
|
|
# docker compose -f docker-compose.prod.seaweedfs.yml build
|
|
# docker compose -f docker-compose.prod.seaweedfs.yml up -d
|
|
# The build needs the repo checkout; to deploy elsewhere, `push` after building
|
|
# and `pull` on the deploy host.
|
|
|
|
# --- Image -------------------------------------------------------------------
|
|
# The tag the build produces and `push`/`pull` use. Its own name, not
|
|
# drivervault-aio: this image carries SeaweedFS and expects two volumes.
|
|
AIO_IMAGE=10.2.1.10:5500/admin/drivervault-aio-seaweedfs:latest
|
|
# Build args, both pinned in the Dockerfile. Set to override at build time.
|
|
# PB_VERSION=0.39.11
|
|
# SEAWEED_VERSION=4.45
|
|
|
|
# --- PocketBase superuser (required) -----------------------------------------
|
|
# Created/updated on first boot. The API Server uses these to manage the database.
|
|
PB_ADMIN_EMAIL=admin@example.com
|
|
PB_ADMIN_PASSWORD=change-me-long-password
|
|
|
|
# --- DriverVault super-admin (app login) -------------------------------------
|
|
# The first application user, created by the API Server on boot with role
|
|
# "superadmin" if no user with this email exists yet. Leave blank to skip.
|
|
DRIVERVAULT_SUPERADMIN_EMAIL=owner@example.com
|
|
DRIVERVAULT_SUPERADMIN_PASSWORD=change-me-long-password
|
|
DRIVERVAULT_SUPERADMIN_NAME=Administrator
|
|
|
|
# Schema creation/reconcile on boot. Leave this true: a release can add
|
|
# collections or fields the server needs, and a stack that skips the bootstrap
|
|
# never gets them. (The API Server creates app_settings, which holds the plugin
|
|
# settings, on demand — but only that one.) Set false only for a database you
|
|
# know already matches the release.
|
|
PB_BOOTSTRAP=true
|
|
|
|
# Allowed CORS origin(s) — match your public web URL / WEB_PORT.
|
|
CORS_ALLOW_ORIGINS=http://localhost:8090
|
|
|
|
# --- EV charging control (Anker Solix, OCPP) ---------------------------------
|
|
# Only relevant when a charger is set to own/proxy control mode. The charger
|
|
# dials in to /ocpp/{serial} on the API Server port, carrying its control token
|
|
# in an OCPP Basic-auth header — which a plaintext ws:// would expose, so
|
|
# non-TLS connections are rejected by default. This image serves plain HTTP, so
|
|
# terminate TLS in a reverse proxy in front of it and set OCPP_PUBLIC_URL to the
|
|
# public wss:// base the charger should be pointed at. Turning the check off is
|
|
# for trusted networks only.
|
|
OCPP_REQUIRE_TLS=true
|
|
OCPP_PUBLIC_URL=
|
|
|
|
# --- Host port mappings (optional; defaults shown) --------------------------
|
|
WEB_PORT=8090
|
|
PB_PORT=8070
|
|
API_PORT=8080
|
|
|
|
# --- Settings the API Server panel can also change ---------------------------
|
|
# The panel's Settings screens apply these immediately, but only for the life of
|
|
# the container — the value below is re-applied on every restart and wins. Set it
|
|
# here to make a change permanent. (POCKETBASE_URL is fixed to this container's
|
|
# own PocketBase and is not meant to be repointed.)
|
|
# WEBAPP_URL the Web App address the panel status page probes; nginx
|
|
# serves it on port 80 inside this container.
|
|
# CORS_ALLOW_ORIGINS browser origins allowed to call the API Server directly.
|
|
# WEBAPP_URL=http://127.0.0.1:80
|
|
|
|
# --- Storage -----------------------------------------------------------------
|
|
# One Docker-managed named volume by default. Set it to an absolute host path
|
|
# for a bind mount, e.g. PB_DATA=/srv/drivervault/pb_data.
|
|
# PB_DATA — the PocketBase database and its backups. The API Server keeps no
|
|
# state on disk, so everything it owns (plugin settings included) is backed up
|
|
# by backing up this one path — together with SEAWEED_DATA below.
|
|
PB_DATA=pb_data
|
|
|
|
# --- File storage: SeaweedFS -------------------------------------------------
|
|
# PocketBase keeps its record files — document scans, service and refill
|
|
# receipts, workshop invoices, part photos — in the bucket below instead of on
|
|
# PB_DATA. The database and PocketBase's own backups stay where they are.
|
|
#
|
|
# The credentials do double duty: they configure the SeaweedFS gateway's single
|
|
# identity *and* are what PocketBase authenticates with. There are no safe
|
|
# defaults, and the container refuses to start without them.
|
|
PB_S3_ACCESS_KEY=
|
|
PB_S3_SECRET=
|
|
# The bucket. Created on first boot by PocketBase's program, before it serves.
|
|
PB_S3_BUCKET=drivervault
|
|
# The endpoint, region and path style are fixed by the image — the gateway is
|
|
# inside the container at a loopback address that cannot change.
|
|
|
|
# SEAWEED_DATA — where SeaweedFS keeps the files. A Docker-managed named volume
|
|
# by default; set an absolute host path for a bind mount, the same way PB_DATA
|
|
# works above. Back it up alongside PB_DATA: from here on the attachments live
|
|
# here, not in the database volume.
|
|
# It is mounted at /seaweed/data, the layout `weed server -dir` writes — the
|
|
# same one the .split. files use, so the two are interchangeable on it.
|
|
SEAWEED_DATA=seaweed_data
|
|
# The S3 port is published on loopback only — PocketBase reaches the gateway
|
|
# inside the container, and this is for tools like aws-cli. Set
|
|
# SEAWEED_S3_BIND=0.0.0.0 to expose it to other hosts, and mean it.
|
|
# SEAWEED_S3_BIND=127.0.0.1
|
|
# SEAWEED_S3_PORT=8333
|
|
|
|
# Existing uploads are NOT migrated when this is switched on: PocketBase copies
|
|
# nothing, so attachments made before the switch stop resolving. Read the file
|
|
# storage section of README.md first.
|