enihcam
90f2f6afee
Tested rootless-podman deployment shape:
* read_only: true on every service
* userns_mode: keep-id (host UID 1000 -> container UID 1000)
* tmpfs mounts for /tmp, /run, /var/run, /var/log, /root, /home
* bind mounts on ./data (no named volumes: podman auto-creates
them with the userns-mapped root UID 100000, which 755's
incorrectly against the host)
* loopback-only port bindings (drop the 127.0.0.1: prefix to
expose on all interfaces)
* PocketBase sidecar uses the corrected /pb_data, /pb_public,
/pb_hooks mount paths from the docker-compose fix.
The entrypoint chowns /app/data and gosu-drops to the unprivileged
deeptutor user (UID 1000) before starting supervisord, so under
userns_mode: keep-id the running process is your host user.
.env.example carries only the host-side loopback bindings and TZ. URL
knowledge lives in data/user/settings/system.json (read by the
entrypoint on every start -> DEEPTUTOR_API_BASE_URL -> proxy.ts). No
compose env var for the API base.
26 lines
1.1 KiB
Bash
26 lines
1.1 KiB
Bash
# ============================================
|
|
# DeepTutor (podman compose) — host-side configuration
|
|
# ============================================
|
|
# Copy to .env and edit. `.env` is gitignored.
|
|
#
|
|
# All values are loopback bindings on the HOST side. The container-side
|
|
# ports come from data/user/settings/system.json (backend_port, frontend_port).
|
|
# Edit those + `podman compose restart deeptutor` to change the in-container
|
|
# ports. This file is for shifting the host-side mapping only.
|
|
#
|
|
# The API base URL the browser uses is NOT a compose env var. The
|
|
# entrypoint reads `DEEPTUTOR_API_BASE_URL` from
|
|
# data/user/settings/system.json on every start (preferring the
|
|
# in-network `next_public_api_base`, then the external override
|
|
# `next_public_api_base_external`, then `http://localhost:${BACKEND_PORT}`),
|
|
# and web/proxy.ts rewrites /api/* and /ws/* to it at request time.
|
|
# ============================================
|
|
|
|
# Host-side loopback bindings (override if 8001/3782/8090 are taken)
|
|
HOST_PORT_BACKEND=8001
|
|
HOST_PORT_FRONTEND=3782
|
|
HOST_PORT_POCKETBASE=8090
|
|
|
|
# Time zone passed into both backend and frontend.
|
|
TZ=UTC
|