tonym
1c66dbd481
Add an admin 'Pull & rebuild' button (Settings → Updates). It POSTs an admin-gated route that signals a privileged 'updater' sidecar (adnanh/webhook + docker socket) over the internal network with a shared secret; the sidecar runs 'git fetch && reset --hard origin/master && docker compose up -d --build app' detached. The UI polls /api/version until the rebuilt app returns on the new version, then reloads. Secret matching uses webhook -template + getenv so UPDATER_SECRET stays out of the repo (host .env only). No request data reaches the shell — the command is fixed in updater/update.sh. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
70 lines
2.0 KiB
YAML
70 lines
2.0 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: moonbase
|
|
POSTGRES_USER: moonbase
|
|
POSTGRES_PASSWORD: moonbase
|
|
volumes:
|
|
- /mnt/user/appdata/moonbase/postgres:/var/lib/postgresql/data
|
|
networks:
|
|
- internal
|
|
|
|
app:
|
|
build: .
|
|
image: moonbase:latest
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- postgres
|
|
ports:
|
|
- "8053:3000"
|
|
environment:
|
|
DATABASE_URL: postgresql://moonbase:moonbase@postgres:5432/moonbase
|
|
# Secrets are interpolated from a gitignored .env next to this file on the
|
|
# host (never committed — see CLAUDE.md). docker compose auto-loads ./.env.
|
|
NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
|
|
NEXTAUTH_URL: http://192.168.0.5:8053
|
|
# Suggestions module — files feedback as Gitea issues on bonna61/Moonbase.
|
|
GITEA_URL: http://192.168.0.5:3022
|
|
GITEA_TOKEN: ${GITEA_TOKEN}
|
|
GITEA_REPO: bonna61/Moonbase
|
|
# Self-update — admin "Pull & rebuild" signals the updater sidecar.
|
|
UPDATER_URL: http://updater:9000/hooks/moonbase-update
|
|
UPDATER_SECRET: ${UPDATER_SECRET}
|
|
volumes:
|
|
# Persist suggestion screenshot uploads across rebuilds.
|
|
- /mnt/user/appdata/moonbase/uploads:/app/public/uploads
|
|
networks:
|
|
- internal
|
|
|
|
# Privileged self-update sidecar: holds the docker socket and rebuilds `app`
|
|
# on an authenticated webhook trigger. Only runs the fixed updater/update.sh.
|
|
updater:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile.updater
|
|
image: moonbase-updater:latest
|
|
restart: unless-stopped
|
|
command:
|
|
- -hooks
|
|
- /appdata/updater/hooks.json
|
|
- -template
|
|
- -hotreload
|
|
- -ip
|
|
- 0.0.0.0
|
|
- -port
|
|
- "9000"
|
|
- -verbose
|
|
environment:
|
|
UPDATER_SECRET: ${UPDATER_SECRET}
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- /mnt/user/appdata/moonbase:/appdata
|
|
networks:
|
|
- internal
|
|
|
|
networks:
|
|
internal:
|
|
driver: bridge
|