Claude
0b65fd7f49
Distribution site served by PocketBase itself (pb_public/, same origin): - Landing (/): create-account CTA, TV sign-in steps, login-gated PC downloads via the existing update manifest + file tokens - Wizard (/onboarding.html): invite code -> account -> named default profile -> family template fetched and encrypted IN THE BROWSER under the new user's password (PBKDF2-210k + AES-GCM, byte-compatible with the app's AddonConfigCrypto - a wizard blob decrypts in Dart, verified) -> pushed as their addon_config ciphertext. Adult fields never included. - /get/tv: public direct download of the latest clean Android APK (Downloader-friendly; adult builds stay account-gated) Backend: - onboarding_template collection (admin-only, maintained via admin UI) - AMBER_INVITE_CODE env gates BOTH users creation (X-Amber-Invite header or ?invite=) and the template route (per-IP rate limit 10/5min); fail-closed when unset. Note: this closes the previously-open in-app registration too. - Dockerfile ships pb_public + --publicDir; compose passes the env var Contract + Coolify steps (second domain amber.petruzalekr.cz) in docs/onboarding-contract.md. Verified locally end-to-end against pocketbase 0.39.6 (real-browser wizard run + Dart decrypt interop). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
43 lines
1.6 KiB
Docker
43 lines
1.6 KiB
Docker
# myanime-backend — PocketBase, version-pinned from the official release.
|
|
#
|
|
# We download the official static binary from GitHub releases (rather than a
|
|
# third-party image) so the deploy is reproducible and easy to audit.
|
|
FROM alpine:3.20 AS fetch
|
|
|
|
# Bump this to upgrade PocketBase. Keep it in sync with the README.
|
|
ARG PB_VERSION=0.39.6
|
|
ARG TARGETARCH=amd64
|
|
|
|
RUN apk add --no-cache ca-certificates unzip wget \
|
|
&& wget -q "https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/pocketbase_${PB_VERSION}_linux_${TARGETARCH}.zip" -O /tmp/pb.zip \
|
|
&& unzip /tmp/pb.zip -d /pb \
|
|
&& rm /tmp/pb.zip
|
|
|
|
FROM alpine:3.20
|
|
|
|
RUN apk add --no-cache ca-certificates
|
|
|
|
COPY --from=fetch /pb/pocketbase /usr/local/bin/pocketbase
|
|
|
|
# Schema-as-code: migrations are baked in and auto-applied on serve.
|
|
COPY pb_migrations /pb_migrations
|
|
|
|
# JS hooks (custom routes + the device sign-in approve page, issue #12). Loaded
|
|
# from --hooksDir on serve.
|
|
COPY pb_hooks /pb_hooks
|
|
|
|
# Static distribution/onboarding site (landing + account wizard) served at /.
|
|
COPY pb_public /pb_public
|
|
|
|
# Persist DB, uploaded files, and any admin-created migrations here. Runs as root
|
|
# so it can always write the volume Coolify attaches — Coolify's persistent mount
|
|
# is root-owned, and a non-root user hitting it fails with SQLite "unable to open
|
|
# database file (14)".
|
|
RUN mkdir -p /pb_data
|
|
VOLUME ["/pb_data"]
|
|
|
|
EXPOSE 8090
|
|
|
|
# Coolify terminates TLS at Traefik; PocketBase listens plain on 8090 behind it.
|
|
ENTRYPOINT ["pocketbase"]
|
|
CMD ["serve", "--http=0.0.0.0:8090", "--dir=/pb_data", "--migrationsDir=/pb_migrations", "--hooksDir=/pb_hooks", "--publicDir=/pb_public"]
|