jacobh2
2476667510
The owner copies infra/pi/ to the Kvitt Pi and runs it there (D-100); nothing
on the Mac connects to the Pis. compose stack of SPEC §10.2 with images
${KVITT_REGISTRY}/kvitt-{server,cert-sync,backup}, Caddyfile §10.5.2 verbatim,
.env.example with the OQ-3 values as CHANGE_ME placeholders, install.sh,
deploy.sh (backup before every deploy), bootstrap.sh, backup-now.sh,
install-apk.sh. cert-sync image and sync.sh (§10.5.1, tar stream for both
authorized_keys variants); backup.sh uploads with rclone copy --immutable and
deletes local files once both are confirmed on Drive (D-002); both sidecars
schedule with supercronic because busybox crond runs no jobs as non-root;
backup runs as uid 10001. .gitea/workflows/build-images.yaml from the owner's
example (not yet run); infra/build-images.sh and infra/publish-apk.sh (R8
mapping kept, version per §10.6) on the Mac; README checklist and RESTORE.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
27 lines
1.3 KiB
Docker
27 lines
1.3 KiB
Docker
# Kvitt cert-sync image (SPEC §10.3, §10.5.1): alpine with openssh-client, curl and sync.sh on a daily schedule.
|
|
# Versions resolved 2026-10-18: alpine 3.24.2 (Docker Hub official image, multi-arch index digest below); packages
|
|
# from Alpine v3.24 main/community: openssh-client-default 10.3_p1, curl 8.22.0, openssl 3.5.9 (PEM checks),
|
|
# supercronic 0.2.49, tzdata 2026e.
|
|
# The scheduler is supercronic, not busybox crond: the container runs as uid 1000 (SPEC §10.2, D-023) and busybox
|
|
# crond cannot run jobs as a non-root user (checked 2026-10-18 in alpine 3.24.2: no job ever ran). See D-104.
|
|
FROM docker.io/library/alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
|
|
|
|
RUN apk add --no-cache \
|
|
"openssh-client-default~10.3" \
|
|
"curl~8.22" \
|
|
"openssl~3.5" \
|
|
"supercronic~0.2" \
|
|
tzdata \
|
|
&& adduser -D -u 1000 -g "Kvitt cert-sync" kvitt \
|
|
&& mkdir -p /certs \
|
|
&& chown 1000:1000 /certs
|
|
|
|
COPY sync.sh entrypoint.sh /usr/local/bin/
|
|
RUN chmod 0755 /usr/local/bin/sync.sh /usr/local/bin/entrypoint.sh \
|
|
&& echo '0 4 * * * /usr/local/bin/sync.sh' > /etc/kvitt-cert-sync.crontab
|
|
|
|
ENV TZ=Europe/Stockholm
|
|
USER 1000:1000
|
|
# sync.sh once at start, then daily at 04:00 Europe/Stockholm.
|
|
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|