jacobh2
6e5981d62a
The Kvitt Pi runs Kvitt from /home/jacobhagstedt/kvitt: compose.yaml, .env, secrets/ and relative bind mounts ./data, ./backups, ./import. Both containers run as the owner's uid/gid (KVITT_UID, KVITT_GID). No install script, no /opt, no Docker daemon or system changes; operations are plain docker compose commands (README "Pi: what the owner does", RESTORE.md). Removed install.sh, deploy.sh, bootstrap.sh, backup-now.sh, install-apk.sh, lib.sh. .env holds only the keys compose.yaml reads; RCLONE_REMOTE is fixed to gdrive: in compose.yaml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
101 lines
4.0 KiB
YAML
101 lines
4.0 KiB
YAML
# Kvitt on the Kvitt Pi (SPEC §10.2, D-125): a self-contained compose project in /home/jacobhagstedt/kvitt.
|
|
# That folder holds this file, .env (from .env.example), secrets/ and the bind-mounted folders data/, backups/
|
|
# and import/; nothing outside it is used. Run every command there (infra/README.md "Pi: what the owner does").
|
|
# Both containers run as the owner's uid/gid (KVITT_UID, KVITT_GID in .env), so every file they write in data/ and
|
|
# backups/ belongs to the owner. Create data/ (and data/apk), backups/ and import/ as the owner before the first
|
|
# start: a folder Docker creates itself belongs to root and the containers cannot write to it.
|
|
# TLS terminates in Nginx Proxy Manager on the Home Assistant Pi (SPEC §10.5, D-120), which forwards plain HTTP
|
|
# over the LAN to the server's published port 8080, the only published port.
|
|
|
|
name: kvitt
|
|
|
|
x-logging: &logging
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
services:
|
|
server:
|
|
image: ${KVITT_REGISTRY:?set KVITT_REGISTRY in .env}/kvitt-server:${KVITT_TAG:?set KVITT_TAG in .env}
|
|
command: ["serve"]
|
|
restart: unless-stopped
|
|
user: "${KVITT_UID:?set KVITT_UID in .env}:${KVITT_GID:?set KVITT_GID in .env}"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=16m
|
|
cap_drop: [ALL]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 160m
|
|
ports:
|
|
- "8080:8080"
|
|
environment:
|
|
TZ: Europe/Stockholm
|
|
KVITT_DATA_DIR: /data
|
|
KVITT_PUBLIC_URL: https://${KVITT_PUBLIC_HOST:?set KVITT_PUBLIC_HOST in .env}
|
|
# NPM's LAN address: only a request whose TCP peer is this address may set X-Forwarded-For, whose last entry
|
|
# is then the client IP of the rate limits (SPEC §8.5, §8.6, D-120). An IPv4 address, not a host name.
|
|
KVITT_TRUSTED_PROXY: ${HA_HOST:?set HA_HOST in .env}
|
|
# The other server settings keep their SPEC §10.4 defaults (KVITT_FCM_CREDENTIALS
|
|
# /secrets/fcm-service-account.json, KVITT_FCM_PROJECT_ID kvitt-1337, ...).
|
|
volumes:
|
|
# SQLite database, pictures and APKs (data/apk/).
|
|
- ./data:/data
|
|
# Only the FCM key, not rclone.conf (D-117). create_host_path false: a missing file stops the start with
|
|
# "bind source path does not exist" instead of Docker creating a root-owned directory in its place.
|
|
- type: bind
|
|
source: ./secrets/fcm-service-account.json
|
|
target: /secrets/fcm-service-account.json
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
# Empty except during the one-off Splitwise import (SPEC §10.8, D-025).
|
|
- ./import:/import:ro
|
|
healthcheck:
|
|
test: ["CMD", "kvitt-server", "healthcheck"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 20s
|
|
logging: *logging
|
|
|
|
backup:
|
|
image: ${KVITT_REGISTRY}/kvitt-backup:${KVITT_TAG}
|
|
restart: unless-stopped
|
|
# The server's uid, so sqlite3 .backup can open the WAL database files the server owns (D-105).
|
|
user: "${KVITT_UID}:${KVITT_GID}"
|
|
read_only: true
|
|
# backup.sh's private copy of rclone.conf and the start marker of the healthcheck live here.
|
|
tmpfs:
|
|
- /tmp:size=16m
|
|
cap_drop: [ALL]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 96m
|
|
environment:
|
|
TZ: Europe/Stockholm
|
|
# The owner's uid has no account in the image; rclone keeps its cache under HOME.
|
|
HOME: /tmp
|
|
# The [gdrive] remote in secrets/rclone.conf.
|
|
RCLONE_REMOTE: "gdrive:"
|
|
RCLONE_FOLDER_ID: ${RCLONE_FOLDER_ID:?set RCLONE_FOLDER_ID in .env}
|
|
volumes:
|
|
- ./data:/data
|
|
- ./backups:/backups
|
|
# Only rclone.conf (Drive token), read-only; backup.sh copies it to /tmp because rclone writes refreshed
|
|
# tokens back (D-105).
|
|
- type: bind
|
|
source: ./secrets/rclone.conf
|
|
target: /config/rclone/rclone.conf
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
healthcheck:
|
|
test: ["CMD", "/healthcheck.sh"]
|
|
interval: 5m
|
|
timeout: 10s
|
|
retries: 1
|
|
start_period: 30s
|
|
logging: *logging
|