wger: DJANGO_DEBUG=False + a wger-files nginx serving /static and /media (R-762); a definition step proven on the bench and on 9202, written by --write-ladder --to-definition
gates / gates (push) Successful in 8s
gates / gates (push) Successful in 8s
wger stays hidden. Bench 9401 proven (anon 50.3 %, files server 15.9 %); 9202 proven (done 59.4 s, photo 404 -> 200, CSS 404 -> 200). Evidence: felhom.eu/documentation/audits/design-build-2026-10-06/F/. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
@@ -1,3 +1,9 @@
|
||||
## 2026-10-06 (evening) — wger serves its styles and photos (R-762): a small file server, proven on the bench and on 9202
|
||||
|
||||
**What runs on a box changed:** wger's definition (wger stays `lifecycle: hidden`; no box runs it): `DJANGO_DEBUG=False` (the image's entrypoint then runs `collectstatic` at every start, as upstream's production `prod.env`), a named `wger_static` volume, and a new service `wger-files` (`nginx:1.30.5-alpine`, 32M) that serves `/static/` and `/media/` read-only from the shared volumes. Traefik sends only those two paths to it (a longer rule, so a higher priority); every box gate wraps every router of the stack, so it is gated like wger. No nginx config file: the stock config serves `/usr/share/nginx/html`, where the volumes are mounted. `mem_limit` 384M → 416M. The step is a DEFINITION step, written by `upgrade-test.py --write-ladder --to-definition` from both verdicts; the superseded definition is kept at `steps/9edf34a3d53837df.yml`.
|
||||
|
||||
Proven: bench LXC 9401 (harness v5, 600 s watch: wger anon peak 50.3 %, wger-files 15.9 %, 0 kills, 0 restarts; the login page's own hashed CSS 200 from wger-files, the same file straight at wger 404); scratch 9202 (the guarded Update done in 59.4 s, the seed read back; a progress photo posted BEFORE the step answered 404 and 200 / 178 B / image/png after; the CSS links 404 before, 200 after; wger-files 7.6 MiB). Known cost: the collected static files are 283 MB in a named volume, so they ride along in every backup of wger. Not changed: wger still runs Django's `runserver` (R-755's fact, now carried by R-762). Onboarding record rows 1.7 and 2.8 done.
|
||||
|
||||
## 2026-10-06 (evening) — the bench can test a step that adds a service (R-762 tooling)
|
||||
|
||||
**What runs on a box changed:** nothing. Test tools only.
|
||||
|
||||
+2
-2
@@ -28,7 +28,7 @@ Measured on 9202 2026-10-01 from the drill catalog (e9f50b5, wger template ident
|
||||
1.4 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt ; felhom.eu/documentation/audits/more-night-apps-2026-09-30/box/wger/step.txt — `DJANGO_PERFORM_MIGRATIONS=True`; the 2.6 -> 2.7 step migrated and read back on the box
|
||||
1.5 | open | the container runs `manage.py runserver` — `WGER_USE_GUNICORN` is not set (R-755; C2)
|
||||
1.6 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — of 15 key-like env reads: SECRET_KEY generated, JWT pair made at start (phone route 200), DB password unused by SQLite; the rest belong to features off here (S3, mail, reCAPTCHA, OIDC, PowerSync)
|
||||
1.7 | open | two entrypoint switches are still undecided: `WGER_USE_GUNICORN` (R-755) and `DJANGO_DEBUG` — unset, so `collectstatic` never runs (R-762; C2, C8)
|
||||
1.7 | done | `DJANGO_DEBUG=False` (R-762, 2026-10-06): `collectstatic` runs at start; the static files are served by `wger-files` (nginx) — the login page's own CSS links 200 on the bench and on 9202 (`felhom.eu/documentation/audits/design-build-2026-10-06/F/`). `WGER_USE_GUNICORN` stays unset (R-755, closed)
|
||||
1.8 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — DEBUG False; an unknown page is a plain 404, no debug page
|
||||
1.9 | n/a | SECRET_KEY signs sessions and reset links only; the JWT pair lives on the data volume and is backed up with it
|
||||
2.1 | open | re-sweep 2026-10-02 with the fixed gate (felhom.eu/documentation/audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md): UNDETERMINED — /home/wger/media stays empty after the seed (no upload in the seed); nothing written outside a preserved folder (R-807). The August CLEAN came from start-time writes alone
|
||||
@@ -38,7 +38,7 @@ Measured on 9202 2026-10-01 from the drill catalog (e9f50b5, wger template ident
|
||||
2.5 | open | no backup -> remove -> restore -> read back of wger: the box has no per-app backup press outside an Update (R-648) and wger has no newer step yet (R-759)
|
||||
2.6 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C7-remove.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C8b-remove-with-data.txt — both choices delete both volumes; for a no-drive app "keep data" keeps only the backups (the page says the app stored no drive data)
|
||||
2.7 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C4-seed-photo-size.txt — 4.2 MB + 16 KB after the seed
|
||||
2.8 | open | an uploaded photo is saved (201, file on the volume) but answers 404 through the front door — nothing serves /media/ (R-762; C4, C8)
|
||||
2.8 | done | a progress photo posted to the gallery reads back through the front door: 200, 178 B, image/png (404 before the step) — 9202, 2026-10-06 (R-762; `felhom.eu/documentation/audits/design-build-2026-10-06/F/box/step.txt`)
|
||||
3.1 | done | felhom.eu/documentation/audits/login-gate-2026-09-29/D/D2-live.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — class 3, measured
|
||||
3.2 | done | felhom.eu/documentation/audits/login-gate-2026-09-29/D/D2-live.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — default refused, generated signs in, wrong refused
|
||||
3.3 | n/a | class 3: a known default login, not an open first-run screen
|
||||
|
||||
@@ -10,7 +10,7 @@ subdomain: "fitness"
|
||||
slug: "wger"
|
||||
# catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
|
||||
# changes an image: line must set this to the same day (see CLAUDE.md).
|
||||
catalog_since: "2026-09-30"
|
||||
catalog_since: "2026-10-06"
|
||||
|
||||
# Operator ruling 2026-10-01: HIDDEN until R-762 (no CSS/JS and no uploaded photo is served) and R-763 (a stranger can
|
||||
# sign up after the setup; anonymous visits create guest accounts) are fixed — the fix session un-hides it. Hidden =
|
||||
@@ -20,7 +20,7 @@ lifecycle: hidden
|
||||
# --- Resource hints (displayed on deploy screen) ---
|
||||
resources:
|
||||
mem_request: "100M"
|
||||
mem_limit: "384M"
|
||||
mem_limit: "416M" # wger 384 + wger-files 32 (R-762)
|
||||
pi_compatible: true
|
||||
needs_hdd: false
|
||||
|
||||
@@ -145,3 +145,4 @@ i18n:
|
||||
# gated by scripts/check-test-record.py. An image: move without a proven entry here is refused.
|
||||
update_ladder:
|
||||
- {"from": {"wger": "wger/server:2.6"}, "to": {"wger": "wger/server:2.7"}, "digest": {"wger": "sha256:1c5789b93bfe5eed0b7287255782d9177027b255de2b22b59f511a693a48db04"}, "verdict": "proven", "tested_at": "2026-09-30T16:25:03Z", "harness_version": 4, "evidence": "felhom.eu/documentation/audits/more-night-apps-2026-09-30/bench/apps/wger/bench/evidence/MV-wger/verdict.json", "box_evidence": "felhom.eu/documentation/audits/more-night-apps-2026-09-30/box/wger/step.txt", "memory_peak_pct": 49.8, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 78.6}
|
||||
- {"from": {"wger": "wger/server:2.7"}, "to": {"wger": "wger/server:2.7", "wger-files": "nginx:1.30.5-alpine"}, "digest": {"wger": "sha256:1c5789b93bfe5eed0b7287255782d9177027b255de2b22b59f511a693a48db04", "wger-files": "sha256:0985e772fb9f729e6fa0980da05fca5d9c468e870eed43071545afa9d2e27d94"}, "verdict": "proven", "tested_at": "2026-10-06T13:03:58Z", "harness_version": 5, "evidence": "felhom.eu/documentation/audits/design-build-2026-10-06/F/bench", "box_evidence": "felhom.eu/documentation/audits/design-build-2026-10-06/F/box", "memory_peak_pct": 50.3, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 100.0}
|
||||
|
||||
@@ -78,9 +78,15 @@ services:
|
||||
- DJANGO_DB_HOST=localhost
|
||||
- DJANGO_DB_PORT=5432
|
||||
- SITE_URL=https://${SUBDOMAIN}.${DOMAIN}
|
||||
# R-762 (2026-10-06): production mode, as upstream's own prod.env (wger-project/docker config/prod.env). With
|
||||
# DJANGO_DEBUG=False the image's entrypoint runs `collectstatic` at every start (entrypoint.sh:27) into
|
||||
# /home/wger/static, and Django stops serving /static and /media itself (it never did in production — upstream
|
||||
# puts nginx in front). wger-files below serves both from the shared volumes.
|
||||
- DJANGO_DEBUG=False
|
||||
volumes:
|
||||
- wger_data:/home/wger/db
|
||||
- wger_media:/home/wger/media
|
||||
- wger_static:/home/wger/static
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
@@ -101,9 +107,45 @@ services:
|
||||
- "traefik.http.routers.wger.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.wger.loadbalancer.server.port=8000"
|
||||
|
||||
# R-762 (2026-10-06): the file server upstream's production compose puts in front of wger (its `nginx` service and
|
||||
# config/nginx.conf: `location /static/ { alias /wger/static/; }`, `location /media/ { alias /wger/media/; }`).
|
||||
# Here traefik is already the front door, so traefik sends ONLY /static/ and /media/ to this nginx and everything
|
||||
# else to wger as before — no config file is needed: nginx's stock config serves /usr/share/nginx/html, and the two
|
||||
# volumes are mounted there read-only. Every gate the box puts in front of the app wraps EVERY router of the stack
|
||||
# (stacks/setup_gate.go, family_gate.go), so this router is gated exactly like wger's own.
|
||||
wger-files:
|
||||
image: nginx:1.30.5-alpine
|
||||
container_name: wger-files
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- wger
|
||||
volumes:
|
||||
- wger_static:/usr/share/nginx/html/static:ro
|
||||
- wger_media:/usr/share/nginx/html/media:ro
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 32M
|
||||
healthcheck:
|
||||
test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1/"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 10s
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.wger-files.rule=Host(`${SUBDOMAIN}.${DOMAIN}`) && (PathPrefix(`/static/`) || PathPrefix(`/media/`))"
|
||||
- "traefik.http.routers.wger-files.entrypoints=websecure"
|
||||
- "traefik.http.routers.wger-files.tls=true"
|
||||
- "traefik.http.routers.wger-files.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.wger-files.loadbalancer.server.port=80"
|
||||
|
||||
volumes:
|
||||
wger_data:
|
||||
wger_media:
|
||||
wger_static:
|
||||
|
||||
networks:
|
||||
traefik-public:
|
||||
|
||||
@@ -0,0 +1,141 @@
|
||||
# =============================================================================
|
||||
# .felhom.yml - App metadata for felhom-controller
|
||||
# =============================================================================
|
||||
|
||||
# --- Display info (shown on dashboard) ---
|
||||
display_name: "wger"
|
||||
description: "Edzésnapló és fitnesz tervező"
|
||||
category: "home"
|
||||
subdomain: "fitness"
|
||||
slug: "wger"
|
||||
# catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
|
||||
# changes an image: line must set this to the same day (see CLAUDE.md).
|
||||
catalog_since: "2026-09-30"
|
||||
|
||||
# Operator ruling 2026-10-01: HIDDEN until R-762 (no CSS/JS and no uploaded photo is served) and R-763 (a stranger can
|
||||
# sign up after the setup; anonymous visits create guest accounts) are fixed — the fix session un-hides it. Hidden =
|
||||
# not offered for new installs; an installed wger keeps working in full (none reported to the hub on 2026-09-30).
|
||||
lifecycle: hidden
|
||||
|
||||
# --- Resource hints (displayed on deploy screen) ---
|
||||
resources:
|
||||
mem_request: "100M"
|
||||
mem_limit: "416M" # wger 384 + wger-files 32 (R-762)
|
||||
pi_compatible: true
|
||||
needs_hdd: false
|
||||
|
||||
# --- Deploy fields (first deployment only) ---
|
||||
deploy_fields:
|
||||
- env_var: DOMAIN
|
||||
label: "Domain"
|
||||
type: domain
|
||||
description: "A szerver domain neve"
|
||||
locked_after_deploy: true
|
||||
|
||||
- env_var: SUBDOMAIN
|
||||
label: "Aldomain"
|
||||
type: subdomain
|
||||
default: "fitness"
|
||||
required: true
|
||||
locked_after_deploy: true
|
||||
description: "Az alkalmazás aldomainje"
|
||||
|
||||
- env_var: SECRET_KEY
|
||||
label: "Titkosítási kulcs"
|
||||
type: secret
|
||||
generate: "hex:32"
|
||||
locked_after_deploy: true
|
||||
|
||||
# `09` §3 decision 45: wger starts with admin / adminadmin. The box replaces that password with this generated
|
||||
# one right after the install (after_install below); the app page shows it as the first password.
|
||||
- env_var: ADMIN_PASSWORD
|
||||
label: "Admin jelszó (admin)"
|
||||
type: password
|
||||
generate: "password:24"
|
||||
description: "Az első bejelentkezéshez: admin és ez a jelszó. Utána a beállításokban módosítható."
|
||||
locked_after_deploy: true
|
||||
|
||||
# --- App info (info page content) ---
|
||||
app_info:
|
||||
tagline: "Edzésnapló - edzéstervek, haladás követés és testsúly napló"
|
||||
default_creds: "admin / adminadmin"
|
||||
docs_url: "https://wger.readthedocs.io/"
|
||||
|
||||
use_cases:
|
||||
- 'Edzéstervek létrehozása és követése'
|
||||
- 'Testsúly és testméretek nyilvántartása grafikonokkal'
|
||||
- 'Gyakorlatok adatbázisa képekkel és leírásokkal'
|
||||
- 'Kalória és tápanyag követés'
|
||||
- 'API támogatás fitnesz alkalmazás integrációkhoz'
|
||||
|
||||
first_steps:
|
||||
- 'Nyisd meg a fitness.DOMAIN címet a böngészőben'
|
||||
- 'Jelentkezz be: admin és a Beállítások oldalon látható első jelszó'
|
||||
- 'Add meg az email címedet a beállításokban'
|
||||
- 'Hozd létre az edzéstervedet'
|
||||
- 'Kezdd el naplózni az edzéseidet'
|
||||
|
||||
|
||||
# --- After a fresh install (controller >= 0.279.0, decision 45) ---
|
||||
# Django's own set_password on the seeded admin. Measured on 9202 2026-09-29: afterwards adminadmin no longer signs in
|
||||
# at /en/user/login, the new one does.
|
||||
after_install:
|
||||
service: wger
|
||||
env: [ADMIN_PASSWORD]
|
||||
# The password is the LAST ARGUMENT (sys.argv[1]), never pasted into the code: a quote in it cannot break or change
|
||||
# the program (security review 2026-09-29). Django is set up the way manage.py does it (settings.main).
|
||||
command: ["python3", "-c", "import os, sys; sys.path.insert(0, '/home/wger/src'); os.chdir('/home/wger/src'); os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'settings.main'); import django; django.setup(); from django.contrib.auth.models import User; u = User.objects.get(username='admin'); u.set_password(sys.argv[1]); u.save(); print('FELHOM_AFTER_INSTALL_OK')", "${ADMIN_PASSWORD}"]
|
||||
success: "FELHOM_AFTER_INSTALL_OK"
|
||||
|
||||
# --- App-email (password reset) through the box's mail relay; plaintext :2526 (see the compose comment, R-764) ---
|
||||
smtp_mapping:
|
||||
tls_mode: plaintext
|
||||
host_var: EMAIL_HOST
|
||||
port_var: EMAIL_PORT
|
||||
from_var: FROM_EMAIL
|
||||
from_local: wger
|
||||
extra:
|
||||
# The gate: wger reads the EMAIL_* group only when this is true (compose default False = mail off).
|
||||
ENABLE_EMAIL: "True"
|
||||
|
||||
# --- Controller-side health probe ---
|
||||
healthcheck:
|
||||
checks:
|
||||
- type: http
|
||||
# 8000, not 80: gunicorn listens on 8000 inside the container; 80 is only
|
||||
# what traefik publishes. wger's own compose healthcheck dials 127.0.0.1:8000 (R-618).
|
||||
port: 8000
|
||||
|
||||
# --- English copy (localisation slice 5, R-560) --------------------------------------------
|
||||
# The Hungarian above is UNCHANGED. A box on English reads this block field by field; a missing
|
||||
# field shows the Hungarian one; a controller older than 0.257.0 ignores the block entirely.
|
||||
i18n:
|
||||
en:
|
||||
description: 'A workout log and fitness planner'
|
||||
app_info:
|
||||
tagline: 'A workout log - training plans, progress and a weight diary'
|
||||
default_creds: 'admin / adminadmin'
|
||||
use_cases:
|
||||
- 'Build training plans and follow them'
|
||||
- 'Track your weight and measurements on a graph'
|
||||
- 'An exercise database with pictures and descriptions'
|
||||
- 'Track calories and nutrition'
|
||||
- 'An API, for fitness app integrations'
|
||||
first_steps:
|
||||
- 'Open fitness.DOMAIN in your browser'
|
||||
- 'Sign in: admin and the first password shown on the settings page'
|
||||
- 'Add your e-mail address in the settings'
|
||||
- 'Build your training plan'
|
||||
- 'Start logging your workouts'
|
||||
deploy_fields:
|
||||
- env_var: DOMAIN
|
||||
label: 'Domain'
|
||||
description: 'The server domain name'
|
||||
- env_var: SUBDOMAIN
|
||||
label: 'Subdomain'
|
||||
description: 'The subdomain this app answers on'
|
||||
- env_var: SECRET_KEY
|
||||
label: 'Encryption key'
|
||||
- env_var: ADMIN_PASSWORD
|
||||
label: 'Admin password (admin)'
|
||||
description: 'For the first sign-in: admin and this password. Change it in the settings afterwards.'
|
||||
@@ -0,0 +1,110 @@
|
||||
# wger - Edzésnapló és fitnesz tervező
|
||||
# Domain: ${SUBDOMAIN}.${DOMAIN}
|
||||
# Database: None (file-based)
|
||||
# RAM: ~100M (mem_limit: 384M) | Pi-compatible: Yes
|
||||
#
|
||||
# Environment variables:
|
||||
# DOMAIN - Your domain (e.g., demo-felhom.eu)
|
||||
# SECRET_KEY - Titkosítási kulcs (auto-generated)
|
||||
|
||||
services:
|
||||
wger:
|
||||
image: wger/server:2.7
|
||||
container_name: wger
|
||||
# R-737 (2026-09-30): wger's app login API (the mobile app's) signs JWTs with JWT_PRIVATE_KEY / JWT_PUBLIC_KEY — an
|
||||
# RSA pair the deploy's generators cannot make, and without it a CORRECT password answered 500. So the pair is made
|
||||
# ONCE by wger's own `manage.py generate-jwt-keys`, kept 0600 on wger's own data volume (a restore brings the same
|
||||
# key back), and loaded before the image's own entrypoint. Never printed.
|
||||
entrypoint:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
K=/home/wger/db/.felhom-jwt.env
|
||||
if [ ! -s "$$K" ]; then
|
||||
(cd /home/wger/src && python3 manage.py generate-jwt-keys 2>/dev/null) | grep -E '^JWT_(PRIVATE|PUBLIC)_KEY=' > "$$K.tmp"
|
||||
if [ "$$(grep -c . "$$K.tmp")" = 2 ]; then mv "$$K.tmp" "$$K" && chmod 600 "$$K"; else rm -f "$$K.tmp"; echo "felhom: JWT keys could not be made" >&2; fi
|
||||
fi
|
||||
if [ -s "$$K" ]; then set -a; . "$$K"; set +a; fi
|
||||
exec /home/wger/entrypoint.sh
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- TZ=Europe/Budapest
|
||||
- SECRET_KEY=${SECRET_KEY}
|
||||
# A wger 2.4+ a TELJES DJANGO_DB_* halmazt beolvassa, akkor is, ha az
|
||||
# engine sqlite -- enélkül indulás nélkül kilép ("Set the DJANGO_DB_USER
|
||||
# environment variable"). Az USER/PASSWORD/HOST/PORT értékeket az sqlite
|
||||
# backend figyelmen kívül hagyja, de jelen kell lenniük.
|
||||
# A DATABASE a wger_data kötetre mutat (/home/wger/db), oda, ahol a wger
|
||||
# saját alapértelmezett sqlite fájlja is volt -- így meglévő telepítés
|
||||
# adatai nem "tűnnek el" egy másik útvonalra.
|
||||
# R-712 (measured 2026-09-29 on 9202): behind traefik wger saw the request as http and refused a browser's
|
||||
# https Origin with "CSRF verification failed" — nobody could sign in from a browser.
|
||||
- CSRF_TRUSTED_ORIGINS=https://${SUBDOMAIN}.${DOMAIN}
|
||||
- X_FORWARDED_PROTO_HEADER_SET=True
|
||||
# R-738: the image runs `manage.py migrate` at start ONLY with this switch (entrypoint.sh). Without it an update
|
||||
# that brings migrations leaves wger serving its front page over an unmigrated database (login 500).
|
||||
- DJANGO_PERFORM_MIGRATIONS=True
|
||||
# R-752 (decided by CC unattended 2026-10-01, `09` §3 decision 58 — operator may reverse): django-axes locked by
|
||||
# ip_address, and behind the tunnel every visitor has the tunnel's address (R-753) — a stranger's 10 wrong tries
|
||||
# locked out EVERY household member for 30 min. Now only the targeted name, for 5 min (each try during a lock
|
||||
# restarts it — wger 2.7 hard-codes that — so short is kinder), counted in the database (the default cache
|
||||
# handler warns axes.W001). Measured on 9202: the other member unaffected; the targeted one in again at 7.5 min.
|
||||
- AXES_LOCKOUT_PARAMETERS=username
|
||||
- AXES_COOLOFF_TIME=5
|
||||
- AXES_HANDLER=axes.handlers.database.AxesDatabaseHandler
|
||||
# R-763 (2026-10-05): the image defaults both to True. After the install the admin exists (after_install sets its
|
||||
# password), so nobody needs wger's own sign-up: a stranger could make an account through the front door, and every
|
||||
# anonymous visit to the dashboard made a guest user row (wger's middleware create_temporary_user). Both read by
|
||||
# settings/main.py as env.bool (wger 2.7 L179-180); the sign-up view then redirects to the features page.
|
||||
- ALLOW_REGISTRATION=False
|
||||
- ALLOW_GUEST_USERS=False
|
||||
# R-764 (2026-10-05): mail through the box's relay (smtp_mapping in .felhom.yml, tls_mode plaintext -> :2526).
|
||||
# wger 2.7 settings/main.py:162 reads the EMAIL_* group ONLY when ENABLE_EMAIL is true, and then env.str() with
|
||||
# no default on EMAIL_HOST_USER / EMAIL_HOST_PASSWORD — so both stay defined-EMPTY here (the relay takes no
|
||||
# login; an absent one would stop wger at start). ENABLE_EMAIL is the gate: False unless the mail toggle injects
|
||||
# "True". EMAIL_USE_TLS False: Django's STARTTLS verifies the certificate and the relay's is self-signed.
|
||||
- ENABLE_EMAIL=${ENABLE_EMAIL:-False}
|
||||
- EMAIL_HOST=${EMAIL_HOST:-}
|
||||
- EMAIL_PORT=${EMAIL_PORT:-2526}
|
||||
- EMAIL_HOST_USER=
|
||||
- EMAIL_HOST_PASSWORD=
|
||||
- EMAIL_USE_TLS=False
|
||||
- EMAIL_USE_SSL=False
|
||||
- FROM_EMAIL=${FROM_EMAIL:-wger Workout Manager <wger@example.com>}
|
||||
- DJANGO_DB_ENGINE=django.db.backends.sqlite3
|
||||
- DJANGO_DB_DATABASE=/home/wger/db/database.sqlite
|
||||
- DJANGO_DB_USER=wger
|
||||
- DJANGO_DB_PASSWORD=wger
|
||||
- DJANGO_DB_HOST=localhost
|
||||
- DJANGO_DB_PORT=5432
|
||||
- SITE_URL=https://${SUBDOMAIN}.${DOMAIN}
|
||||
volumes:
|
||||
- wger_data:/home/wger/db
|
||||
- wger_media:/home/wger/media
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 384M
|
||||
healthcheck:
|
||||
test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8000"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 30s
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.wger.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
|
||||
- "traefik.http.routers.wger.entrypoints=websecure"
|
||||
- "traefik.http.routers.wger.tls=true"
|
||||
- "traefik.http.routers.wger.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.services.wger.loadbalancer.server.port=8000"
|
||||
|
||||
volumes:
|
||||
wger_data:
|
||||
wger_media:
|
||||
|
||||
networks:
|
||||
traefik-public:
|
||||
external: true
|
||||
Reference in New Issue
Block a user