bvandeusenandClaude Opus 5.5
787685ac63
CI & Build / Python lint (push) Successful in 3s
CI & Build / Plugin hooks (push) Successful in 16s
CI & Build / TypeScript typecheck (push) Successful in 55s
CI & Build / integration (push) Successful in 1m9s
CI & Build / Python tests (push) Successful in 2m7s
CI & Build / Build & push image (push) Successful in 30s
With no SECRET_KEY set, Grimoire fell back to a fixed placeholder. The quickstart compose substituted change-me-in-production, so the README's own update step (pull, up -d) recreated the container on that placeholder, and every credential sealed under the key the user started with stopped opening. - config: with neither SECRET_KEY nor SECRET_KEY_FILE, the first start writes a random key to DATA_DIR/secret_key (mode 0600, published with a hard link so concurrent starts agree), and later starts read it back. An explicit key wins and leaves the file alone. A missing SECRET_KEY_FILE or an empty key file stops the start instead of switching keys. With no data directory (a run outside the container) the process gets a temporary key and says so. - app: warns on a public placeholder key, on a temporary key, and when /data is not a mounted volume. - Dockerfile creates /data. - docker-compose.yml is now the deploy compose (published image, both volumes, nothing to set). The build-from-source compose is docker-compose.dev.yml, and docker-compose.quickstart.yml is gone. The Swarm stack file gains the /data volume and keeps its explicit key, because a Swarm can move the app away from a node-local volume. - README: a Deploy section with the compose inline, SECRET_KEY optional, "keep both volumes", and updates that keep the key. A test holds the README's copy equal to the file. - Installs that ran on the change-me-in-production placeholder get a key of their own on the new compose; Settings then asks once for saved forge tokens and the backup secret. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
# Fabled Grimoire: the app and its database.
|
|
# docker compose up -d
|
|
# Then open http://localhost:5000. The first account registered becomes admin.
|
|
#
|
|
# Keep both volumes. app_data holds the instance's own SECRET_KEY, which seals
|
|
# saved credentials; pgdata holds everything else.
|
|
|
|
services:
|
|
app:
|
|
image: git.fabledsword.com/bvandeusen/fabledgrimoire:latest
|
|
ports:
|
|
- "5000:5000"
|
|
environment:
|
|
DATABASE_URL: "postgresql+asyncpg://${POSTGRES_USER:-grimoire}:${POSTGRES_PASSWORD:-grimoire}@db:5432/${POSTGRES_DB:-grimoire}"
|
|
LOG_LEVEL: "${LOG_LEVEL:-INFO}"
|
|
# Behind an HTTPS reverse proxy:
|
|
# BASE_URL: "https://grimoire.example.com"
|
|
# SECURE_COOKIES: "true"
|
|
# TRUST_PROXY_HEADERS: "true"
|
|
volumes:
|
|
- app_data:/data
|
|
depends_on:
|
|
- db
|
|
restart: unless-stopped
|
|
|
|
db:
|
|
# Postgres 17 with the vector extension Grimoire needs.
|
|
image: pgvector/pgvector:pg17
|
|
stop_grace_period: 120s
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-grimoire}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-grimoire}
|
|
POSTGRES_DB: ${POSTGRES_DB:-grimoire}
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
app_data:
|
|
pgdata:
|