Pi: minimal self-contained compose project (D-125)

The Kvitt Pi runs Kvitt from /home/jacobhagstedt/kvitt: compose.yaml, .env,
secrets/ and relative bind mounts ./data, ./backups, ./import. Both containers
run as the owner's uid/gid (KVITT_UID, KVITT_GID). No install script, no /opt,
no Docker daemon or system changes; operations are plain docker compose
commands (README "Pi: what the owner does", RESTORE.md).

Removed install.sh, deploy.sh, bootstrap.sh, backup-now.sh, install-apk.sh,
lib.sh. .env holds only the keys compose.yaml reads; RCLONE_REMOTE is fixed
to gdrive: in compose.yaml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/pi/compose.yaml

@@ -1,9 +1,11 @@
-# Kvitt production stack on the Kvitt Pi (SPEC §10.2). Deployed by install.sh to /opt/kvitt/compose.yaml together
-# with /opt/kvitt/.env (from .env.example). Run every command from /opt/kvitt.
-# TLS terminates in Nginx Proxy Manager on the Home Assistant Pi (SPEC §10.5, D-120), which forwards plain HTTP over
-# the LAN to the server's published port 8080. Only the server publishes a port; backup is reachable only on the
-# internal network `kvitt` (SPEC §8.9). The router forwards the internet only to NPM, never to this Pi.
-# Image names: ${KVITT_REGISTRY}/kvitt-<name>, the names the Gitea Actions workflow pushes (D-104).
+# Kvitt on the Kvitt Pi (SPEC §10.2, D-125): a self-contained compose project in /home/jacobhagstedt/kvitt.
+# That folder holds this file, .env (from .env.example), secrets/ and the bind-mounted folders data/, backups/
+# and import/; nothing outside it is used. Run every command there (infra/README.md "Pi: what the owner does").
+# Both containers run as the owner's uid/gid (KVITT_UID, KVITT_GID in .env), so every file they write in data/ and
+# backups/ belongs to the owner. Create data/ (and data/apk), backups/ and import/ as the owner before the first
+# start: a folder Docker creates itself belongs to root and the containers cannot write to it.
+# TLS terminates in Nginx Proxy Manager on the Home Assistant Pi (SPEC §10.5, D-120), which forwards plain HTTP
+# over the LAN to the server's published port 8080, the only published port.
 
 name: kvitt
 
@@ -18,13 +20,14 @@ services:
     image: ${KVITT_REGISTRY:?set KVITT_REGISTRY in .env}/kvitt-server:${KVITT_TAG:?set KVITT_TAG in .env}
     command: ["serve"]
     restart: unless-stopped
-    user: "10001:10001"
+    user: "${KVITT_UID:?set KVITT_UID in .env}:${KVITT_GID:?set KVITT_GID in .env}"
     read_only: true
+    tmpfs:
+      - /tmp:size=16m
     cap_drop: [ALL]
     security_opt:
       - no-new-privileges:true
     mem_limit: 160m
-    # On all interfaces of the Pi: NPM on the Home Assistant Pi connects to this Pi's LAN address, port 8080.
     ports:
       - "8080:8080"
     environment:
@@ -32,14 +35,23 @@ services:
       KVITT_DATA_DIR: /data
       KVITT_PUBLIC_URL: https://${KVITT_PUBLIC_HOST:?set KVITT_PUBLIC_HOST in .env}
       # NPM's LAN address: only a request whose TCP peer is this address may set X-Forwarded-For, whose last entry
-      # is then the client IP of the rate limits (SPEC §8.5, §8.6, D-120). An IP literal (install.sh checks it).
+      # is then the client IP of the rate limits (SPEC §8.5, §8.6, D-120). An IPv4 address, not a host name.
       KVITT_TRUSTED_PROXY: ${HA_HOST:?set HA_HOST in .env}
-      # The remaining server settings keep their SPEC §10.4 defaults (KVITT_FCM_PROJECT_ID kvitt-1337, ...).
+      # The other server settings keep their SPEC §10.4 defaults (KVITT_FCM_CREDENTIALS
+      # /secrets/fcm-service-account.json, KVITT_FCM_PROJECT_ID kvitt-1337, ...).
     volumes:
-      - data:/data
-      - /opt/kvitt/secrets/fcm-service-account.json:/secrets/fcm-service-account.json:ro
+      # SQLite database, pictures and APKs (data/apk/).
+      - ./data:/data
+      # Only the FCM key, not rclone.conf (D-117). create_host_path false: a missing file stops the start with
+      # "bind source path does not exist" instead of Docker creating a root-owned directory in its place.
+      - type: bind
+        source: ./secrets/fcm-service-account.json
+        target: /secrets/fcm-service-account.json
+        read_only: true
+        bind:
+          create_host_path: false
       # Empty except during the one-off Splitwise import (SPEC §10.8, D-025).
-      - /opt/kvitt/import:/import:ro
+      - ./import:/import:ro
     healthcheck:
       test: ["CMD", "kvitt-server", "healthcheck"]
       interval: 30s
@@ -47,26 +59,38 @@ services:
       retries: 3
       start_period: 20s
     logging: *logging
-    networks: [kvitt]
 
   backup:
     image: ${KVITT_REGISTRY}/kvitt-backup:${KVITT_TAG}
     restart: unless-stopped
-    # uid 10001 like the server, so it can open the WAL database files the server owns; rclone.conf on the Pi is
-    # therefore owned by 10001 (infra/README.md "Backup uid", D-105).
-    user: "10001:10001"
+    # The server's uid, so sqlite3 .backup can open the WAL database files the server owns (D-105).
+    user: "${KVITT_UID}:${KVITT_GID}"
+    read_only: true
+    # backup.sh's private copy of rclone.conf and the start marker of the healthcheck live here.
+    tmpfs:
+      - /tmp:size=16m
     cap_drop: [ALL]
     security_opt:
       - no-new-privileges:true
     mem_limit: 96m
     environment:
       TZ: Europe/Stockholm
-      RCLONE_REMOTE: ${RCLONE_REMOTE:-gdrive:}
+      # The owner's uid has no account in the image; rclone keeps its cache under HOME.
+      HOME: /tmp
+      # The [gdrive] remote in secrets/rclone.conf.
+      RCLONE_REMOTE: "gdrive:"
       RCLONE_FOLDER_ID: ${RCLONE_FOLDER_ID:?set RCLONE_FOLDER_ID in .env}
     volumes:
-      - data:/data
-      - backups:/backups
-      - /opt/kvitt/secrets/rclone.conf:/config/rclone/rclone.conf:ro
+      - ./data:/data
+      - ./backups:/backups
+      # Only rclone.conf (Drive token), read-only; backup.sh copies it to /tmp because rclone writes refreshed
+      # tokens back (D-105).
+      - type: bind
+        source: ./secrets/rclone.conf
+        target: /config/rclone/rclone.conf
+        read_only: true
+        bind:
+          create_host_path: false
     healthcheck:
       test: ["CMD", "/healthcheck.sh"]
       interval: 5m
@@ -74,12 +98,3 @@ services:
       retries: 1
       start_period: 30s
     logging: *logging
-    networks: [kvitt]
-
-volumes:
-  data:
-  backups:
-
-networks:
-  kvitt:
-    driver: bridge