rootandClaude Opus 5.5
34e8751b45
- DATA_DIR (/data: agent-sessions, backups, exports, tmp); entrypoint chowns it to PUID/PGID then drops privileges via gosu; /app binary stays root read-only - compile with --allow-read --allow-write so mounted library roots are writable - preflight: DATA_DIR/session dir must be writable (fatal); enabled library roots and downloader path mappings checked read/write (warn + audit) - --role export-mappings (mapping manifest JSON, --compare row counts) and --role read-only-on (automation.readOnlyReconcile=true + audit) - scripts/backup.sh (pg_dump custom + mappings + agent sessions, SHA256SUMS, BACKUP_KEEP rotation) and scripts/restore.sh (checksum, refuses with live connections, psql single-transaction replay compatible with PG16, read-only reconcile on, row-count verification) - compose: app + postgres only, data volume, env example with key generation - docs: runbook deploy.md, backup-restore.md with verification record Co-Authored-By: Claude Opus 5.5 <[email protected]>
18 lines
259 B
Plaintext
18 lines
259 B
Plaintext
# 构建上下文只需要源码与锁文件;依赖在镜像内由 deno install --frozen 按 deno.lock 重装
|
|
.git
|
|
**/node_modules
|
|
**/dist
|
|
**/build
|
|
**/.react-router
|
|
**/coverage
|
|
**/*.log
|
|
types
|
|
spikes
|
|
docs
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
*.md
|
|
!apps/**/README.md
|
|
data
|