tajniak81andClaude Opus 4.8
01d82ebda9
Audited every Dockerfile, compose file and .env.example against the code
they deploy. Four things had drifted:
Persistence. The API Server writes plugins.json and rewrites .env (the
panel's retarget-PocketBase flow) relative to its working directory,
which was a root-owned /app while the process runs as the app user - so
both writes failed, and no volume was declared to keep them anyway. The
binary moves to /usr/local/bin and the working directory becomes a /data
volume owned by app. The AIO image gets the same via directory=/data on
its supervisord program.
OCPP. Charger control was undeployable: OCPP_REQUIRE_TLS defaults to true
and appeared in no Docker file, so a charger dialling the plain-HTTP
/ocpp/{serial} was rejected with nothing explaining why. Both OCPP vars
are now threaded through the compose files and env examples, with the
reasoning (the per-charger control token rides in a Basic-auth header).
CORS. API Server/docker-compose.yml defaulted to localhost:5173, the Vite
dev port, where every other file uses 8090.
Env names. .env.example has called PB_URL/PB_ADMIN_*/PORT legacy for a
while, but the Docker layer still used them. Container-side names are now
POCKETBASE_*/API_ADDR; the .env keys operators set stay PB_ADMIN_* so
existing .env files keep working.
Left alone deliberately: alpine:latest stays unpinned (cannot verify
current tags or test the build from here), and the golang/node bases
already match go.mod and Vite 8's floor.
Validated as YAML only - there is no Docker CLI on this machine, so no
image was built and the /data ownership fix follows standard volume
semantics rather than an observed run.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
55 lines
2.6 KiB
Bash
55 lines
2.6 KiB
Bash
# API Server configuration
|
|
# Copy to .env and adjust. The server also reads plain environment variables.
|
|
# Never commit the real .env file.
|
|
|
|
# Address the API Server listens on. A bare port (8080) is accepted too.
|
|
API_ADDR=:8080
|
|
|
|
# PocketBase base URL (no trailing slash). The API Server is the only thing that
|
|
# talks to PocketBase; it proxies /api/auth/* to this address, which is never
|
|
# exposed to clients. Editable at runtime from the panel (PocketBase section),
|
|
# which writes the change back into this file.
|
|
POCKETBASE_URL=http://10.2.1.10:8027
|
|
|
|
# PocketBase superuser service account. Every privileged flow runs through it:
|
|
# user/organization management and all car-domain database access. Leave unset
|
|
# and the server still starts — a superadmin can log in to the panel and
|
|
# configure it there; management endpoints return 503 until then.
|
|
POCKETBASE_ADMIN_EMAIL=
|
|
POCKETBASE_ADMIN_PASSWORD=
|
|
|
|
# CORS allowed origins for browser clients (comma separated, or * for any).
|
|
# Native mobile apps are not subject to CORS. Editable at runtime from the panel
|
|
# (Web App section), which writes the change back into this file.
|
|
CORS_ALLOW_ORIGINS=http://localhost:8090
|
|
|
|
# Web App address, probed by GET /api/status and shown on the panel. Editable at
|
|
# runtime from the panel (Web App section).
|
|
WEBAPP_URL=http://localhost:8090
|
|
|
|
# PocketBase auth collection holding app users (default: users).
|
|
AUTH_USERS_COLLECTION=users
|
|
|
|
# Local JSON store for plugin enable-state + config (default: plugins.json).
|
|
# Relative paths resolve against the working directory, so in Docker this points
|
|
# at the mounted volume (see the Dockerfile) rather than the image layer.
|
|
PLUGINS_FILE=plugins.json
|
|
|
|
# --- EV charging control (Anker Solix, OCPP) ---------------------------------
|
|
# Only relevant when a charger is set to own/proxy control mode. The charger
|
|
# dials in to /ocpp/{serial} on this server, authenticating with OCPP Basic auth
|
|
# (serial + per-charger control token). A plaintext ws:// would carry that token
|
|
# in the clear, so connections that did not arrive over TLS are rejected —
|
|
# disable only for local dev on a trusted network.
|
|
OCPP_REQUIRE_TLS=true
|
|
|
|
# The canonical ws(s):// base an operator points the charger at. Set this when
|
|
# the server sits behind a reverse proxy, where deriving the URL from request
|
|
# headers is unreliable. Empty = derive it.
|
|
OCPP_PUBLIC_URL=
|
|
|
|
# --- Legacy names -----------------------------------------------------------
|
|
# PB_URL, PB_ADMIN_EMAIL, PB_ADMIN_PASSWORD, PORT and CORS_ORIGINS are still
|
|
# honoured for older deployments; the POCKETBASE_*/API_ADDR names above win when
|
|
# both are set. AUTH_SECRET is gone — the server no longer mints its own JWTs.
|