mirror of
https://github.com/ajisaacs/OpenNest.git
synced 2026-10-03 19:22:10 -04:00
aj
d428357c8b
- Run as the .NET image's non-root app user (UID 1654) with root-owned application files and an app-owned /app/data that fresh named volumes inherit. - Add a curl HEALTHCHECK on /healthz (30s/5s/10s/3, 2s start interval), keep the explicit 8090 URL and clear the base image's 8080 port default. - Parameterize VERSION/SOURCE_REVISION and base images; add OCI labels with development defaults. - Add an image-only Compose example (required image and bind address, named volume, cap_drop ALL, no-new-privileges) and an env template. - Document deployment, the upload limit, scoped ownership preparation, and checked backup/restore/upgrade functions that refuse existing destinations and verify the metadata list and every archive hash before switching volumes. - Extend the container smoke: image user/healthcheck/label contract, PID 1 UID, capabilities and writable paths, Docker-reported health, near-limit and oversized uploads, stopped-service backup restored into a second volume, and startup failure on read-only and root-owned data mounts.
14 lines
661 B
Bash
14 lines
661 B
Bash
# Copy to a local, untracked env file next to compose.server.yaml and edit it.
|
|
# Never put credentials in this file or the Compose file.
|
|
|
|
# A tested image version or digest, for example ghcr.io/ajisaacs/opennest-server@sha256:<digest>.
|
|
OPENNEST_SERVER_IMAGE=ghcr.io/ajisaacs/opennest-server:REPLACE-WITH-TESTED-VERSION
|
|
|
|
# Loopback for a local test. For shop PCs, use this host's trusted LAN address and
|
|
# confirm the firewall admits only trusted clients; the service has no authentication.
|
|
OPENNEST_BIND_ADDRESS=127.0.0.1
|
|
OPENNEST_HOST_PORT=8090
|
|
|
|
# Docker volume holding nests.db; change only to switch to a verified restore.
|
|
OPENNEST_DATA_VOLUME=opennest-data
|