admin
d4150d7377
A killed seed still started the app (upstream's `exec pnpm start` is on its own line), so sign-ups failed while the box read healthy. Healthy now needs the role rows and a group or user. Measured on the bench. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
74 lines
4.0 KiB
YAML
74 lines
4.0 KiB
YAML
# Wishlist - Családi kívánságlista megosztás
|
|
# Domain: ${SUBDOMAIN}.${DOMAIN}
|
|
# Database: None (file-based)
|
|
# RAM: ~115M running, 312M peak during the first-boot seed (mem_limit: 512M) | Pi-compatible: Yes
|
|
#
|
|
# Environment variables:
|
|
# DOMAIN - Your domain (e.g., demo-felhom.eu)
|
|
|
|
services:
|
|
wishlist:
|
|
image: ghcr.io/cmintey/wishlist:v0.67.1
|
|
container_name: wishlist
|
|
restart: unless-stopped
|
|
environment:
|
|
- TZ=Europe/Budapest
|
|
volumes:
|
|
# Storage layout. The image declares `VOLUME /usr/src/app/data` and
|
|
# `VOLUME /usr/src/app/uploads` (docker image inspect → Config.Volumes), and upstream's own
|
|
# compose mounts exactly those two. `/data` — what this template used to mount — is a path
|
|
# the application never writes.
|
|
#
|
|
# The consequence, measured 2026-08-02: `prod.db` landed in the ANONYMOUS volume docker
|
|
# created for the image's VOLUME directive. An anonymous volume survives a restart, which is
|
|
# what makes it deceptive — but it is absent from ResolveDockerVolumeNames
|
|
# (felhom-controller internal/appbackup/appdata.go, which only returns <project>_<name> for
|
|
# volumes DECLARED here), so DumpAppVolumes never backs it up, and `compose down` + `up`
|
|
# orphans it and creates a fresh empty one. Meanwhile `wishlist_data` was tarred every night
|
|
# as an empty directory.
|
|
- wishlist_data:/usr/src/app/data
|
|
- wishlist_uploads:/usr/src/app/uploads
|
|
networks:
|
|
- traefik-public
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
# 512M, MEASURED 2026-09-23 (R-612): the first boot runs `prisma db seed`, which peaked at
|
|
# 312-345M; at 128M it was OOM-killed on every run (kernel oom_kill 3), sometimes before the
|
|
# Role/Group rows existed — then EVERY sign-up fails and the page says "already exists".
|
|
# Running, the app sits at ~115M, which is 90% of the old 128M on its own.
|
|
memory: 512M
|
|
healthcheck:
|
|
# A wishlist képfájlban nincs wget és nincs curl — csak node. A korábbi
|
|
# wget próba ezért soha nem futott le, a konténer véglegesen unhealthy
|
|
# maradt, és a Traefik nem irányított rá forgalmat (404).
|
|
#
|
|
# R-612 (2026-10-06): the check also reads the first-boot SEED. Upstream's entrypoint runs
|
|
# `migrate deploy && db seed && db:patch` and then `exec pnpm start` on its own line, so a killed
|
|
# seed still starts the app — and without the `role` and `group` rows EVERY sign-up fails with the
|
|
# lie "already exists", while an HTTP-only check read healthy. Healthy now needs the three role rows
|
|
# and a group (or a user — an admin may delete the default group later). node:sqlite is built into
|
|
# the image's Node 24; read-only. Measured on the bench: the old check passed a seedless database
|
|
# (rc 0), this one refuses it (rc 1) and passes a seeded one
|
|
# (felhom.eu/documentation/audits/night-burndown-2026-10-06/cat/R-612-red.txt).
|
|
test: ["CMD", "node", "-e", "let ok=false;try{const {DatabaseSync}=require('node:sqlite');const d=new DatabaseSync('/usr/src/app/data/prod.db',{readOnly:true});const n=q=>d.prepare(q).get().n;ok=n('SELECT count(*) AS n FROM role')>=3&&(n('SELECT count(*) AS n FROM \"group\"')>0||n('SELECT count(*) AS n FROM user')>0);d.close()}catch(e){}if(!ok){console.error('wishlist: first-boot seed incomplete (role/group rows missing)');process.exit(1)}require('http').get('http://127.0.0.1:3000',r=>process.exit(r.statusCode<500?0:1)).on('error',()=>process.exit(1))"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.wishlist.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
|
|
- "traefik.http.routers.wishlist.entrypoints=websecure"
|
|
- "traefik.http.routers.wishlist.tls=true"
|
|
- "traefik.http.routers.wishlist.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.wishlist.loadbalancer.server.port=3000"
|
|
|
|
volumes:
|
|
wishlist_data:
|
|
wishlist_uploads:
|
|
|
|
networks:
|
|
traefik-public:
|
|
external: true
|