Jaroslav Beneš
ddad585e4b
The button cannot do the work, and that is the whole design. The service runs as an unprivileged account, cannot restart itself, and should not be able to: a web application that can restart its own service is one whose worst day is much worse. So /admin/updates writes a file, and an opt-in systemd .path unit runs deploy/update.sh as root. Three properties hold it up, and each is a thing that could have been got wrong. The request file carries nothing that reaches a command line -- no branch, no ref, no arguments -- because the branch is baked into the unit at install time, so pressing the button is always "deploy the branch this host was configured with" and can never be "deploy something else". It is off unless somebody passes INSTALL_UPDATE_HELPER=1, and re-running the installer without it removes both units and the marker. And without the helper the page says so and prints the manual command rather than writing a file nothing is watching, which would be a button that reports success and does nothing. The card that says all of this is rendered whether or not there is anything to apply. It was inside the "there is an update" branch first, so an administrator could not discover the helper was missing until the day they needed it, which is the worst possible moment. Opening the page makes no network request; Check is the one thing that fetches. And it shows the log between, not a count: "3 behind" is a number somebody has to go and look up, while the subjects are what decides whether this is worth restarting for right now. Docker is one stage, because there is nothing to build -- no Node, no compiled assets. It bakes no secret key (one in an image is one every copy shares, and rotating it makes stored API keys unreadable), no data, and no .git, so /admin/updates inside a container correctly reports that it was not installed from a checkout. Compose publishes on loopback and refuses to start without a key. TLS in front is a constraint rather than a recommendation: the service worker and the microphone both require HTTPS or localhost. The image was built and run before this was committed, which is how the missing COPY of LICENSE was found -- pyproject declares it and the build backend reads it, so the failure reads like a packaging problem and is one line. deploy/lxc-install.sh creates an unprivileged Debian container and runs the existing installer inside it. A wrapper, not a second install path: a parallel installer is two things to keep correct and one of them rots. /healthz opens the database rather than only proving the socket is listening -- a process that is up with a database it cannot open answers every page with a 500 -- and says nothing about what is here, being reachable without signing in. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
70 lines
3.0 KiB
Docker
70 lines
3.0 KiB
Docker
# LLeMbas in a container.
|
|
#
|
|
# One stage, on purpose. There is nothing to build: no Node, no compiled assets,
|
|
# no wheel worth producing separately — the vendored browser libraries are
|
|
# committed and the templates are read at runtime. A multi-stage build here
|
|
# would be ceremony that saves nothing and hides where the files came from.
|
|
#
|
|
# **This image is not a deployment on its own.** It serves plain HTTP and expects
|
|
# a TLS reverse proxy in front, and that is a constraint rather than a
|
|
# preference: a service worker and a microphone both require HTTPS or localhost,
|
|
# so over plain http on a LAN address the app installs as nothing and cannot
|
|
# dictate. See deploy/README.md.
|
|
|
|
FROM python:3.12-slim
|
|
|
|
# `bash` and `git` earn their place: `git` is what /admin/updates reads to say
|
|
# what is running, and its absence there is reported rather than crashed on.
|
|
# `curl` is the healthcheck below. Everything else stays out.
|
|
RUN apt-get update \
|
|
&& apt-get install --no-install-recommends -y git curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# A real account rather than root, and made before the install so the layers it
|
|
# owns are its own. 10001 rather than the first free id: a bind-mounted volume
|
|
# on the host is easier to reason about when the id is stated.
|
|
RUN useradd --create-home --uid 10001 --shell /usr/sbin/nologin lembas
|
|
|
|
WORKDIR /app
|
|
|
|
# The dependency install is its own layer, keyed on the files that decide it, so
|
|
# editing a template does not re-resolve the whole tree.
|
|
#
|
|
# LICENSE is in the list because `pyproject.toml` declares `license = { file =
|
|
# "LICENSE" }` and the build backend reads it -- without it the install fails
|
|
# with "License file does not exist", which reads like a packaging problem and
|
|
# is a missing COPY. README.md is there for the same reason (`readme = `).
|
|
COPY pyproject.toml README.md LICENSE ./
|
|
COPY src/lembas/__init__.py src/lembas/__init__.py
|
|
RUN pip install --no-cache-dir -e ".[search,ssh]"
|
|
|
|
COPY . .
|
|
# Again, because the first install ran against a source tree with one file in
|
|
# it. Cheap: everything is already resolved and cached above.
|
|
RUN pip install --no-cache-dir --no-deps -e "." \
|
|
&& chown -R lembas:lembas /app
|
|
|
|
# The database, the uploads and the encryption at rest all live here. Declared
|
|
# so that running without `-v` still works and says where the data went, rather
|
|
# than losing it silently at the first `docker rm`.
|
|
ENV LEMBAS_DATA_DIR=/data \
|
|
LEMBAS_HOST=0.0.0.0 \
|
|
LEMBAS_PORT=8080 \
|
|
PYTHONUNBUFFERED=1
|
|
RUN install -d -o lembas -g lembas /data
|
|
VOLUME ["/data"]
|
|
|
|
# **No secret key is baked in.** One in an image is one every copy of the image
|
|
# shares, and rotating it signs everybody out *and* makes stored upstream API
|
|
# keys unreadable. Without LEMBAS_SECRET_KEY the app generates a temporary one
|
|
# and warns loudly at startup, which is the right failure: it works for a look
|
|
# and cannot be mistaken for a deployment.
|
|
|
|
USER lembas
|
|
EXPOSE 8080
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD curl -fsS http://127.0.0.1:8080/healthz || exit 1
|
|
|
|
CMD ["lembas", "serve"]
|