admin
f5f6a152b5
gates / gates (push) Successful in 1s
Restores templates/{vikunja,uptime-kuma,wishlist,glance}/docker-compose.yml to exactly
their content at ff9717d379 — verified byte-identical for every image line.
catalog_since is 2026-09-21 on all four rather than the older pre-drill dates: the
catalog-since gate requires an image move to carry the day's date in EITHER direction,
and a revert is a move. The bump and its revert net to zero.
This clears the vikunja alpine:3.20 negative-control edge, which a background security
review correctly flagged as a supply-chain change. It was deliberate, it is the
documented C3-class control, no customer or demo box runs vikunja, and a deployed app
is frozen at its own pin since v0.235.0 — but the window is now closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
61 lines
2.4 KiB
YAML
61 lines
2.4 KiB
YAML
# Wishlist - Családi kívánságlista megosztás
|
|
# Domain: ${SUBDOMAIN}.${DOMAIN}
|
|
# Database: None (file-based)
|
|
# RAM: ~30M (mem_limit: 128M) | Pi-compatible: Yes
|
|
#
|
|
# Environment variables:
|
|
# DOMAIN - Your domain (e.g., demo-felhom.eu)
|
|
|
|
services:
|
|
wishlist:
|
|
image: ghcr.io/cmintey/wishlist:v0.66.0
|
|
container_name: wishlist
|
|
restart: unless-stopped
|
|
environment:
|
|
- TZ=Europe/Budapest
|
|
volumes:
|
|
# Storage layout. The image declares `VOLUME /usr/src/app/data` and
|
|
# `VOLUME /usr/src/app/uploads` (docker image inspect → Config.Volumes), and upstream's own
|
|
# compose mounts exactly those two. `/data` — what this template used to mount — is a path
|
|
# the application never writes.
|
|
#
|
|
# The consequence, measured 2026-08-02: `prod.db` landed in the ANONYMOUS volume docker
|
|
# created for the image's VOLUME directive. An anonymous volume survives a restart, which is
|
|
# what makes it deceptive — but it is absent from ResolveDockerVolumeNames
|
|
# (felhom-controller internal/appbackup/appdata.go, which only returns <project>_<name> for
|
|
# volumes DECLARED here), so DumpAppVolumes never backs it up, and `compose down` + `up`
|
|
# orphans it and creates a fresh empty one. Meanwhile `wishlist_data` was tarred every night
|
|
# as an empty directory.
|
|
- wishlist_data:/usr/src/app/data
|
|
- wishlist_uploads:/usr/src/app/uploads
|
|
networks:
|
|
- traefik-public
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 128M
|
|
healthcheck:
|
|
# A wishlist képfájlban nincs wget és nincs curl — csak node. A korábbi
|
|
# wget próba ezért soha nem futott le, a konténer véglegesen unhealthy
|
|
# maradt, és a Traefik nem irányított rá forgalmat (404).
|
|
test: ["CMD", "node", "-e", "const http=require('http');http.get('http://127.0.0.1:3000',r=>process.exit(r.statusCode<500?0:1)).on('error',()=>process.exit(1))"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.wishlist.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
|
|
- "traefik.http.routers.wishlist.entrypoints=websecure"
|
|
- "traefik.http.routers.wishlist.tls=true"
|
|
- "traefik.http.routers.wishlist.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.wishlist.loadbalancer.server.port=3000"
|
|
|
|
volumes:
|
|
wishlist_data:
|
|
wishlist_uploads:
|
|
|
|
networks:
|
|
traefik-public:
|
|
external: true
|