jacobh2
2476667510
The owner copies infra/pi/ to the Kvitt Pi and runs it there (D-100); nothing
on the Mac connects to the Pis. compose stack of SPEC §10.2 with images
${KVITT_REGISTRY}/kvitt-{server,cert-sync,backup}, Caddyfile §10.5.2 verbatim,
.env.example with the OQ-3 values as CHANGE_ME placeholders, install.sh,
deploy.sh (backup before every deploy), bootstrap.sh, backup-now.sh,
install-apk.sh. cert-sync image and sync.sh (§10.5.1, tar stream for both
authorized_keys variants); backup.sh uploads with rclone copy --immutable and
deletes local files once both are confirmed on Drive (D-002); both sidecars
schedule with supercronic because busybox crond runs no jobs as non-root;
backup runs as uid 10001. .gitea/workflows/build-images.yaml from the owner's
example (not yet run); infra/build-images.sh and infra/publish-apk.sh (R8
mapping kept, version per §10.6) on the Mac; README checklist and RESTORE.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
38 lines
2.2 KiB
Bash
38 lines
2.2 KiB
Bash
# Kvitt Pi settings (SPEC §10.2). Copy to .env in this folder, replace every CHANGE_ME, then run ./install.sh,
|
|
# which copies it to /opt/kvitt/.env (mode 0600). install.sh refuses a .env that still contains CHANGE_ME.
|
|
# No secret files here: those go to /opt/kvitt/secrets/ (infra/README.md "Pi: what the owner does").
|
|
|
|
# --- Read by compose.yaml -----------------------------------------------------------------------------------------
|
|
|
|
# Registry and owner path of the Kvitt images; images are ${KVITT_REGISTRY}/kvitt-server|kvitt-cert-sync|kvitt-backup.
|
|
KVITT_REGISTRY=gitea.lan/jacobh2
|
|
# Image tag to run. deploy.sh sets it; first install: the newest version tag the Gitea workflow pushed (vMAJOR.MINOR.PATCH),
|
|
# or the short git SHA that infra/build-images.sh printed.
|
|
KVITT_TAG=CHANGE_ME_TAG
|
|
# LAN address (or host name) of the Home Assistant Pi that holds the Let's Encrypt certificate (OQ-3).
|
|
HA_HOST=CHANGE_ME_HA_HOST
|
|
# SSH port of the Home Assistant SSH add-on (OQ-3; the "Advanced SSH & Web Terminal" and "Terminal & SSH" add-ons default to 22).
|
|
HA_PORT=22
|
|
# SSH user on the Home Assistant Pi (OQ-3; the Home Assistant SSH add-ons log in as root, or the user set in the add-on).
|
|
HA_USER=CHANGE_ME_HA_USER
|
|
# Directory holding fullchain.pem and privkey.pem on the Home Assistant Pi (OQ-3; /ssl on Home Assistant OS).
|
|
HA_CERT_DIR=CHANGE_ME_HA_CERT_DIR
|
|
# rclone remote of the Drive backups, as named in rclone.conf.
|
|
RCLONE_REMOTE=gdrive:
|
|
# Google Drive folder id the backups go to (OQ-4, answered).
|
|
RCLONE_FOLDER_ID=1jDp1dGE5R3H2DBcXCqIPN1iWzQnPkdlV
|
|
|
|
# --- Read by install.sh only (never by the containers) ------------------------------------------------------------
|
|
|
|
# Gitea user that may pull the images; leave empty when the Gitea packages are public (anonymous pull).
|
|
KVITT_REGISTRY_USER=
|
|
# Gitea access token of that user with read:package scope; leave empty for anonymous pull. Never commit a filled .env.
|
|
KVITT_REGISTRY_TOKEN=
|
|
|
|
# --- Informational: used in the owner's commands on the Mac (scp), read by nothing on the Pi --------------------
|
|
|
|
# LAN address of the Kvitt Pi itself (OQ-3).
|
|
KVITT_PI_HOST=CHANGE_ME_KVITT_PI_HOST
|
|
# SSH user on the Kvitt Pi (OQ-3).
|
|
KVITT_PI_SSH_USER=CHANGE_ME_KVITT_PI_SSH_USER
|