warp/Docker-AIO/README.md

# Docker-AIO: everything in one image

The homeserver, the admin panel and the web client in one image, one image
per database. [`entrypoint.sh`](entrypoint.sh) starts them in one
container; if one exits, the rest are stopped and the container's restart
policy brings the set back.

| Dockerfile | Image | Database |
| --- | --- | --- |
| [`Dockerfile`](Dockerfile) | `warp-aio` | SQLite, `/data/warp.db` |
| [`Dockerfile.PocketBase`](Dockerfile.PocketBase) | `warp-aio-pocketbase` | PocketBase (embedded driver), `/data/pb_data` |
| [`Dockerfile.PostgreSQL`](Dockerfile.PostgreSQL) | `warp-aio-postgresql` | PostgreSQL 17 in the container, `/data/postgres` |
| [`Dockerfile.PocketBase.SeaweedFS`](Dockerfile.PocketBase.SeaweedFS) | `warp-aio-pocketbase-seaweedfs` | PocketBase, media in SeaweedFS (`weed server -s3`) in the container |
| [`Dockerfile.PocketBase.SeaweedFS.split`](Dockerfile.PocketBase.SeaweedFS.split) | `warp-aio-pocketbase-seaweedfs-split` | PocketBase, media in SeaweedFS split into its roles, with its admin UI |

| Compose file | Image |
| --- | --- |
| `docker-compose.sqlite.yml` | `warp-aio`, built here |
| `docker-compose.pocketbase.yml` | `warp-aio-pocketbase`, built here |
| `docker-compose.postgresql.yml` | `warp-aio-postgresql`, built here |
| `docker-compose.pocketbase.seaweedfs.yml` | `warp-aio-pocketbase-seaweedfs`, built here |
| `docker-compose.pocketbase.seaweedfs.split.yml` | `warp-aio-pocketbase-seaweedfs-split`, built here |
| `docker-compose.*.prod.yml` | the same images, pulled, never built |

Everything lives in the `warp-data` volume, mounted on `/data`; the
SeaweedFS images add `seaweed-data` on `/seaweed/data` (and the split one
`seaweed-admin` on `/seaweed/admin`).

```sh
cd Docker-AIO
cp .env.example .env      # then edit it
docker compose -f docker-compose.sqlite.yml up -d --build
docker compose -f docker-compose.sqlite.yml exec warp warp create-account --username admin --admin
```

Homeserver on `:8008`, admin panel on `:8009`, web client on `:8080`.

The PostgreSQL in `warp-aio-postgresql` listens only on a Unix socket
inside the container, so it needs no password and is not reachable from
outside. To point that image at a PostgreSQL elsewhere instead, set
`WARP_AIO_EMBEDDED_POSTGRES=false` and `WARP_DB_CONNECTION_STRING`.

The Dockerfiles share their build stages line for line; only the header,
the SeaweedFS stage and the final stage differ. Keep the build stages in
step when changing one.

## SeaweedFS

The two SeaweedFS images keep the PocketBase database in `/data/pb_data`
and put media in an S3 bucket (`WARP_PB_S3_BUCKET`, default `warp`) on a
SeaweedFS inside the same container. The compose files point the
homeserver at it; `.env` only has to give it credentials:

```sh
cp .env.example .env      # set WARP_PB_S3_ACCESS_KEY, WARP_PB_S3_SECRET
                          # (and SEAWEED_ADMIN_PASSWORD for split)
docker compose -f docker-compose.pocketbase.seaweedfs.yml up -d --build
```

- **`Dockerfile.PocketBase.SeaweedFS`** runs `weed server -s3`: master,
  volume, filer and S3 gateway in one process. The gateway has exactly
  one identity, the homeserver's key pair.
- **`Dockerfile.PocketBase.SeaweedFS.split`** runs each role as its own
  process, plus SeaweedFS's admin UI on port 23646, where further S3
  identities are created and revoked under *Object Store → Users*. The
  homeserver's identity is written into the filer's IAM store on every
  boot (the store the admin UI writes too), so a key added there never
  displaces it, and a rotated `WARP_PB_S3_SECRET` lands on the next start.

Both refuse to start without the key pair, and the split one without
`SEAWEED_ADMIN_PASSWORD`: either would otherwise serve an open gateway or
an open panel that can mint credentials. The S3 gateway and the admin UI
are published on 127.0.0.1 only; the volume server, which serves content
by id with no authentication, is never published. Inside, it is on 8081,
since 8080 is the web client.

Both write `/seaweed/data` in the layout `weed server -dir` uses, and their
compose files share a project and volumes, so switching between them
needs no migration.

Media already stored on the filesystem is not moved into the bucket when
S3 is turned on, so start these on a fresh `warp-data` or copy the files
across first. The SeaweedFS release is pinned in the Dockerfiles
(`SEAWEED_VERSION`, 4.45); upgrading it means a rebuild.

## Settings

Every setting is in `.env`, copied from [`.env.example`](.env.example),
which lists them all with their defaults; an empty value means the
default. `.env` is not committed. On top of the settings of
[Docker/](../Docker/README.md), it has:

| Variable | Default | |
| --- | --- | --- |
| `WARP_AIO_ADMIN` | `true` | `false` runs no admin panel |
| `WARP_AIO_WEB` | `true` | `false` runs no web client |

The database driver and connection string come from the image.

## Prod files

The `.prod.yml` files pull `$WARP_REGISTRY/<image>:$WARP_VERSION`
(defaults `ghcr.io/dariuszjaniak` and `latest`). Push the images first,
from the repository root:

```sh
docker build -t $WARP_REGISTRY/warp-aio:$WARP_VERSION -f Docker-AIO/Dockerfile .
docker build -t $WARP_REGISTRY/warp-aio-pocketbase:$WARP_VERSION -f Docker-AIO/Dockerfile.PocketBase .
docker build -t $WARP_REGISTRY/warp-aio-postgresql:$WARP_VERSION -f Docker-AIO/Dockerfile.PostgreSQL .
docker build -t $WARP_REGISTRY/warp-aio-pocketbase-seaweedfs:$WARP_VERSION -f Docker-AIO/Dockerfile.PocketBase.SeaweedFS .
docker build -t $WARP_REGISTRY/warp-aio-pocketbase-seaweedfs-split:$WARP_VERSION -f Docker-AIO/Dockerfile.PocketBase.SeaweedFS.split .
for i in warp-aio warp-aio-pocketbase warp-aio-postgresql \
         warp-aio-pocketbase-seaweedfs warp-aio-pocketbase-seaweedfs-split; do
  docker push $WARP_REGISTRY/$i:$WARP_VERSION
done
```