Claude
24d59c3f91
Foundation for the user-accounts platform. Self-hosted PocketBase v0.39.6, version-pinned from the official release binary, schema-as-code so the collections auto-apply on boot and never drift from hand-clicking. Collections: users (auth, admin-only nsfwEnabled), profiles, watch_state, watchlist, prefs. Per-owner access rules traverse profile.user; nsfwEnabled is never client-writable (superuser-only). Relations cascadeDelete; unique indexes keep one resume/watchlist row per (profile,itemId) and one prefs per profile. Verified locally against v0.39.6: migration applies clean, and scripts/verify.py proves two users can't read/write each other's data and can't set their own nsfwEnabled (19/19 checks). Coolify deploy (domain/TLS, superuser, SMTP, backups) documented in README as the manual half. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
36 lines
1.3 KiB
Docker
36 lines
1.3 KiB
Docker
# myanime-backend — PocketBase, version-pinned from the official release.
|
|
#
|
|
# We download the official static binary from GitHub releases (rather than a
|
|
# third-party image) so the deploy is reproducible and easy to audit.
|
|
FROM alpine:3.20 AS fetch
|
|
|
|
# Bump this to upgrade PocketBase. Keep it in sync with the README.
|
|
ARG PB_VERSION=0.39.6
|
|
ARG TARGETARCH=amd64
|
|
|
|
RUN apk add --no-cache ca-certificates unzip wget \
|
|
&& wget -q "https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/pocketbase_${PB_VERSION}_linux_${TARGETARCH}.zip" -O /tmp/pb.zip \
|
|
&& unzip /tmp/pb.zip -d /pb \
|
|
&& rm /tmp/pb.zip
|
|
|
|
FROM alpine:3.20
|
|
|
|
RUN apk add --no-cache ca-certificates \
|
|
&& adduser -D -H -u 10001 pb
|
|
|
|
COPY --from=fetch /pb/pocketbase /usr/local/bin/pocketbase
|
|
|
|
# Schema-as-code: migrations are baked in and auto-applied on serve.
|
|
COPY pb_migrations /pb_migrations
|
|
|
|
# Persist DB, uploaded files, and any admin-created migrations here. Create it
|
|
# owned by the runtime user so a fresh named volume inherits writable perms.
|
|
RUN mkdir -p /pb_data && chown pb /pb_data
|
|
VOLUME ["/pb_data"]
|
|
|
|
EXPOSE 8090
|
|
USER pb
|
|
|
|
# Coolify terminates TLS at Traefik; PocketBase listens plain on 8090 behind it.
|
|
ENTRYPOINT ["pocketbase"]
|
|
CMD ["serve", "--http=0.0.0.0:8090", "--dir=/pb_data", "--migrationsDir=/pb_migrations"]
|