mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
AshimandGitHub
4c9dc6e38e
Phase 1 — Docker Artifact Optimization: - Replace broad `COPY . .` with targeted frontend source copies (API/Python changes no longer bust the frontend build cache) - Replace build-essential with gcc/g++ (leaner runtime) - Fix LOG_LEVEL=debug → info for production - Harden .dockerignore (exclude worktrees, IDE, CI, test artifacts) Phase 2 — State & Persistence: - Add PUID/PGID support in entrypoint.sh for bind mount compatibility - Guard against PUID=0/PGID=0 to prevent accidental root execution - Evict conflicting system users (e.g. node:1000) before UID remap Phase 3 — Security: - Always register @fastify/rate-limit so login brute-force protection works even when global rate limit is disabled (RATE_LIMIT_PER_MIN=0) - Add trustProxy support (TRUST_PROXY env var, default true) so rate limiting and audit logs use real client IPs behind reverse proxies - Strip stack traces from 500 error responses in production - Fix FSTDEP022 deprecation: maxParamLength → routerOptions - Add multi-file guard on single-file tool endpoint with clear error message pointing to the /batch endpoint Phase 4 — Graceful Degradation: - Add consolidated hardware detection startup banner (GPU, rate limit, upload limit, proxy status) - Add ConnectionMonitor component with health polling and reconnecting overlay that auto-dismisses when the server comes back Phase 5 — Deployment Docs: - Rewrite deployment.md with copy-paste CPU and GPU compose templates - Add hardware requirements table (minimum, recommended, heavy workloads) - Add PUID/PGID bind mount documentation - Add complete env var reference table - Add reverse proxy guides for Nginx, Nginx Proxy Manager, Traefik, and Cloudflare Tunnels
76 lines
2.8 KiB
Bash
Executable File
76 lines
2.8 KiB
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
|
|
# Apply auth defaults at runtime so they are never baked into image layers.
|
|
# Users can override any of these via -e flags at docker run time.
|
|
export AUTH_ENABLED="${AUTH_ENABLED:-true}"
|
|
export DEFAULT_USERNAME="${DEFAULT_USERNAME:-admin}"
|
|
export DEFAULT_PASSWORD="${DEFAULT_PASSWORD:-admin}"
|
|
|
|
# Clean up any interrupted bootstrap from a previous start
|
|
AI_VENV="/data/ai/venv"
|
|
AI_VENV_TMP="/data/ai/venv.bootstrapping"
|
|
|
|
if [ -d "$AI_VENV_TMP" ]; then
|
|
echo "Cleaning up interrupted venv bootstrap..."
|
|
rm -rf "$AI_VENV_TMP"
|
|
fi
|
|
|
|
# Bootstrap AI venv from base image on first run
|
|
if [ ! -d "$AI_VENV" ] && [ -d "/opt/venv" ]; then
|
|
echo "Bootstrapping AI venv from base image..."
|
|
mkdir -p /data/ai/models /data/ai/pip-cache
|
|
cp -r /opt/venv "$AI_VENV_TMP"
|
|
mv "$AI_VENV_TMP" "$AI_VENV"
|
|
echo "AI venv ready at $AI_VENV"
|
|
fi
|
|
|
|
# Fix ownership of mounted volumes so the non-root ashim user can write.
|
|
# This runs as root, fixes permissions, then drops to ashim via gosu.
|
|
if [ "$(id -u)" = "0" ]; then
|
|
# PUID/PGID support: remap the ashim user/group to match host UID/GID.
|
|
# This prevents permission conflicts when using bind mounts.
|
|
PUID="${PUID:-$(id -u ashim)}"
|
|
PGID="${PGID:-$(id -g ashim)}"
|
|
|
|
if [ "$PUID" = "0" ] || [ "$PGID" = "0" ]; then
|
|
echo "WARNING: PUID=0 or PGID=0 would run the app as root. Ignoring — using default ashim UID/GID." >&2
|
|
PUID=$(id -u ashim)
|
|
PGID=$(id -g ashim)
|
|
fi
|
|
|
|
CUR_UID=$(id -u ashim)
|
|
CUR_GID=$(id -g ashim)
|
|
|
|
if [ "$CUR_UID" != "$PUID" ] || [ "$CUR_GID" != "$PGID" ]; then
|
|
# Evict any conflicting user/group that holds the target UID/GID.
|
|
# Delete user first (may cascade-delete its primary group).
|
|
if [ "$CUR_UID" != "$PUID" ]; then
|
|
EXISTING_USER=$(getent passwd "$PUID" 2>/dev/null | cut -d: -f1 || true)
|
|
if [ -n "$EXISTING_USER" ] && [ "$EXISTING_USER" != "ashim" ]; then
|
|
deluser "$EXISTING_USER" 2>/dev/null || userdel "$EXISTING_USER" 2>/dev/null || true
|
|
fi
|
|
fi
|
|
if [ "$CUR_GID" != "$PGID" ]; then
|
|
EXISTING_GROUP=$(getent group "$PGID" 2>/dev/null | cut -d: -f1 || true)
|
|
if [ -n "$EXISTING_GROUP" ] && [ "$EXISTING_GROUP" != "ashim" ]; then
|
|
delgroup "$EXISTING_GROUP" 2>/dev/null || groupdel "$EXISTING_GROUP" 2>/dev/null || true
|
|
fi
|
|
groupmod -g "$PGID" ashim 2>/dev/null || true
|
|
fi
|
|
if [ "$CUR_UID" != "$PUID" ]; then
|
|
usermod -u "$PUID" ashim 2>/dev/null || true
|
|
fi
|
|
fi
|
|
|
|
# Chown writable directories (/data is the persistent volume, /tmp/workspace is ephemeral).
|
|
# /app and /opt/venv are read-only at runtime — no chown needed.
|
|
chown -R ashim:ashim /data /tmp/workspace 2>&1 || \
|
|
echo "WARNING: Could not fix volume permissions. Use named volumes (not Windows bind mounts) to avoid this. See docs for details." >&2
|
|
|
|
exec gosu ashim "$@"
|
|
fi
|
|
|
|
# Already running as ashim (e.g. Kubernetes runAsUser)
|
|
exec "$@"
|