rootandClaude Opus 5.5
34e8751b45
- DATA_DIR (/data: agent-sessions, backups, exports, tmp); entrypoint chowns it to PUID/PGID then drops privileges via gosu; /app binary stays root read-only - compile with --allow-read --allow-write so mounted library roots are writable - preflight: DATA_DIR/session dir must be writable (fatal); enabled library roots and downloader path mappings checked read/write (warn + audit) - --role export-mappings (mapping manifest JSON, --compare row counts) and --role read-only-on (automation.readOnlyReconcile=true + audit) - scripts/backup.sh (pg_dump custom + mappings + agent sessions, SHA256SUMS, BACKUP_KEEP rotation) and scripts/restore.sh (checksum, refuses with live connections, psql single-transaction replay compatible with PG16, read-only reconcile on, row-count verification) - compose: app + postgres only, data volume, env example with key generation - docs: runbook deploy.md, backup-restore.md with verification record Co-Authored-By: Claude Opus 5.5 <[email protected]>
23 lines
829 B
Bash
23 lines
829 B
Bash
# docker compose 用的环境变量(复制为部署目录下的 .env)。
|
|
#
|
|
# SECRET_MASTER_KEY:凭证加密主密钥,生成一次后永不更换(换了之前存的站点/下载器/模型密钥全部无法解密)。
|
|
# 生成:openssl rand -hex 32
|
|
# 必须与数据库备份分开保管(密码管理器 / 离线介质);备份里不含它,丢了它备份里的密钥也无法恢复。
|
|
SECRET_MASTER_KEY=
|
|
# 数据库密码:openssl rand -hex 16
|
|
POSTGRES_PASSWORD=
|
|
|
|
# 对外端口与绑定地址(放在反代后面时可改成 127.0.0.1)
|
|
UMT_PORT=4380
|
|
UMT_BIND=0.0.0.0
|
|
|
|
# 容器运行用户:与宿主媒体目录属主一致,例如 id -u / id -g 的输出
|
|
PUID=10001
|
|
PGID=10001
|
|
|
|
# 备份保留份数(0 = 不轮转)
|
|
BACKUP_KEEP=14
|
|
LOG_LEVEL=info
|
|
# APP_VERSION=v0.1.0
|
|
# 国内网络构建换源(可选):APT_MIRROR=mirrors.ustc.edu.cn
|