Luca
9431b9f094
* feat(setup): configure the public address and SMTP in the wizard, not .env
A fresh install could not configure its own public address. `general_site_url`
and the `email_configs` row already existed as admin settings, but nothing
could reach them:
- docker-compose.yml injected FRONTEND_URL=${FRONTEND_URL:-http://localhost:3000}
and Dockerfile.aio baked in ENV FRONTEND_URL=http://localhost:3000, so
getFrontendBaseUrl() returned on its first branch every time and the setting
was never read. .env.example shipped the same value as an uncommented
placeholder for FRONTEND_URL / ADMIN_URL / API_URL.
- the wizard never asked for the address at all, and skipped its whole config
step unless a CRM-ish feature was selected — so a gallery-only install was
also never offered SMTP, despite gallery links, guest invites and expiry
warnings all going out through email_configs.
- eleven call sites read process.env.FRONTEND_URL directly rather than the
resolver, three of them defaulting to placeholder hosts that reached real
recipients: https://app.example.com in payment-reminder emails, localhost:3005
in admin invitation emails, https://app.example.com in dev template previews.
Stop injecting a default anywhere, and resolve the origin instead:
FRONTEND_URL -> general_site_url -> the origin the request arrived on ->
whichever exists -> ''. A loopback candidate is treated as unconfigured so the
installs that already have http://localhost:3000 baked into their environment
self-heal; the same guard previously lived inline in routes/gallery.js for the
slideshow QR (#848) and is now shared. The empty return is preserved because
shareLinkService and the SSO redirects in routes/auth rely on it to emit
relative urls — callers needing an absolute url use getAbsoluteFrontendUrl(),
which still ends at http://localhost:3000.
The wizard now persists window.location.origin right after the admin account is
created, so an install that skips the rest still has a usable origin for
background jobs that have no request to derive one from, and offers it as an
editable "Public address" field. Settings -> General shows the field read-only
when FRONTEND_URL pins it, instead of silently ignoring edits.
Also drop the `|| 'mailhog'` fallback when seeding email_configs: that host only
exists in the dev compose profile (which does not even start by default), so a
fresh install came up with a live config pointing nowhere while the wizard
showed empty SMTP fields. With no row, blank fields are the truth and
emailProcessor logs "No email configuration found". Developers set
SMTP_HOST=mailhog explicitly.
backend/src/services/emailService.js is deleted: nothing in backend/ references
it, and it was the only consumer of the SMTP_* variables, which misrepresented
how mail is configured.
Refs #705
* fix(setup): keep FRONTEND_URL ahead of ADMIN_URL/APP_URL when resolving links
The previous commit routed two call sites through the resolver but put the
site-specific variable FIRST, silently reversing precedence:
userManagementService was: FRONTEND_URL || ADMIN_URL || localhost:3005
became: ADMIN_URL || resolver
adminEvents/crud was: FRONTEND_URL || APP_URL || ''
became: APP_URL || resolver
An install with both variables set would have flipped which one won. Call the
resolver first instead — it starts with FRONTEND_URL, so the original relative
order is preserved and only the final fallback changes: localhost:3005 (not
even the frontend's port) and '' (a relative link inside an email) both become
the resolved origin.
Refs #705
* fix(setup): unpin loopback FRONTEND_URL, keep ADMIN_URL/APP_URL reachable
Review feedback on #1104.
isEnvPinned() reported ANY FRONTEND_URL as authoritative, including the
loopback values getFrontendBaseUrl() deliberately demotes. An install
upgrading with the old compose default FRONTEND_URL=http://localhost:3000
therefore resolved its origin from general_site_url correctly, but got the
Site URL field rendered read-only in Settings and skipped by the wizard's
seeding - locking the exact operators this change exists to unblock out of
configuring a public address anywhere. The predicate now mirrors the
resolver, and the derived general_site_url_effective the General tab reads
comes from the same helper instead of re-normalising process.env inline.
APP_URL and ADMIN_URL had become dead code: getFrontendBaseUrl() only
returns falsy when NOTHING is configured, so `|| process.env.ADMIN_URL`
after it never ran once a site URL existed - which after this PR is the
normal case. A split-origin install pointing ADMIN_URL at a separate admin
host got invite links on the public gallery origin instead. They are now
passed as an explicit `override` that resolves directly below FRONTEND_URL,
preserving the historic FRONTEND_URL-before-ADMIN_URL order while beating
the database- and request-derived fallbacks.
general_site_url now feeds the CORS allowlist and the
Access-Control-Allow-Origin header, not just email links, so a schemeless
value is an allowlist entry no browser origin can match. Validate it
server-side in PUT /general (isURL with require_protocol, require_tld off
so LAN/NAS installs on http://nas:3000 still work) and client-side in both
surfaces that write it - type="url" never fires in either, since neither
input sits inside a form.
Two more wizard fixes: the General tab no longer reposts general_site_url
while it is env-pinned, because the field then holds the effective env
value rather than the stored one and the round-trip read as a change to a
protected key, 403ing a settings.edit-without-settings.domains admin on an
unrelated save. And SetupConfigStep validates the From address before
posting - /admin/email/config rejects a blank one, which used to surface as
a generic warning while the wizard advanced from its finally block anyway,
discarding every SMTP value the user had typed, password included. A failed
save now keeps them on the step.
* fix(setup): surface a rejected public address instead of swallowing it
Review round 2 follow-up on #1104, pushed onto the branch.
saveSiteUrl() caught and discarded every error. That was defensible before
round 2 added a server-side URL check, but PUT /general can now answer 400 —
and the two validators disagreed:
http://my_nas.local client: accepted server: rejected
http://foo_bar:3000 client: accepted server: rejected
validate() let those through, the 400 was swallowed, `failed` stayed false and
onDone() ran. The operator finished the wizard believing the public address was
stored when nothing had been. That is the silent misconfiguration this whole
change exists to remove, landing on the LAN and NAS installs it targets.
Three parts:
- saveSiteUrl() throws. finish() resolves it before anything else is posted and
puts the message on the address field rather than the generic "some settings
could not be saved" warning. Skip for now still always leaves, by contract,
but warns instead of dropping the value in silence.
- allow_underscores on the server check, for the same reason require_tld is
off: browsers resolve http://my_nas.local and the client accepts it, so
rejecting it server-side only produced the mismatch above. Both validators
now agree across the LAN/NAS, IDN, bare-IP and scheme-less cases.
- LOOPBACK_BASE_RE anchors its host token. Bare prefix matching also demoted
https://localhost-nas.example.com, and now that this predicate gates the
whole resolver rather than just the slideshow QR, being demoted means a
configured address is silently ignored. 127. stays a bare prefix on purpose:
all of 127.0.0.0/8 is loopback.
Resolver suite 31 passing, up from 26. Mutation-checked: restoring the
unanchored regex fails the three new host-boundary cases.
* fix(settings): don't lock the General tab on a site URL nobody typed
Review follow-up on #1104, pushed onto the branch.
general_site_url was free-text until this PR added a server-side check, so an
upgraded install can hold something schemeless that predates it. The tab
flagged that on load, and `disabled={!!siteUrlError}` then killed Save for
EVERY General setting.
An admin holding settings.edit but not settings.domains could not clear it
either: correcting the address is a change to a protected key and 403s. The
tab has no permission gating, so that role was simply locked out of the tab
with no self-service way back.
That is the same role adminSettings.js:85-95 documents the no-op round-trip
allowance for. The allowance only helps if the request is made, and this
blocked it in the browser first.
Validation now waits until the field is actually edited, and an unchanged
value is dropped from the payload rather than reposted — matching what the
env-pinned case already does one line above, and for the same reason.
stored value invalid, untouched Save works, key not sent
edited to something unusable Save blocked
edited to a usable absolute url saved
Four tests, first coverage for this feature. Mutation-checked: removing the
dirty gate fails the untouched-value case.
---------
Co-authored-by: Paul Nothaft <53005142+the-luap@users.noreply.github.com>
179 lines
8.5 KiB
Docker
179 lines
8.5 KiB
Docker
# All-in-one image (#1042): one container, one Node process.
|
|
#
|
|
# The backend serves the built frontend itself via server.js's SERVE_FRONTEND
|
|
# block (SPA fallback, OG crawler intercept, brand-title render, immutable
|
|
# asset caching) — no nginx, no supervisor, no bundled Postgres/Redis. SQLite
|
|
# is the explicit default engine; pointing DB_HOST/DB_USER/DB_PASSWORD (+
|
|
# DATABASE_CLIENT=pg) at an external Postgres works exactly like the backend
|
|
# image. Build context is the REPO ROOT (both backend/ and frontend/ are
|
|
# needed): docker build -f Dockerfile.aio .
|
|
#
|
|
# KEEP IN SYNC: the runtime stage below mirrors backend/Dockerfile's
|
|
# production stage (base image, apk set, npm removal, nodejs user, fontconfig
|
|
# registration, directory layout, healthcheck, entrypoint). When
|
|
# backend/Dockerfile changes, change this file too — the aio smoke job in
|
|
# docker-build.yml catches boot-level drift, not package-level drift.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Frontend build — mirrors frontend/Dockerfile's builder stage
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-alpine AS frontend-builder
|
|
|
|
ARG CACHEBUST=1
|
|
|
|
WORKDIR /app
|
|
|
|
COPY frontend/package*.json ./
|
|
RUN npm ci --legacy-peer-deps
|
|
|
|
COPY frontend/ .
|
|
RUN npm run build
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Backend deps — mirrors backend/Dockerfile's builder stage
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-alpine AS backend-builder
|
|
|
|
ARG CACHEBUST=1
|
|
|
|
WORKDIR /app
|
|
|
|
COPY backend/package*.json ./
|
|
RUN npm ci --omit=dev
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Runtime — mirrors backend/Dockerfile's production stage + the frontend dist
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-alpine
|
|
|
|
ARG CACHEBUST=1
|
|
ARG BUILD_DATE
|
|
ARG VCS_REF
|
|
ARG VERSION
|
|
|
|
LABEL org.opencontainers.image.source="https://github.com/PicPeak/picpeak"
|
|
LABEL org.opencontainers.image.description="PicPeak all-in-one (backend + frontend, single container)"
|
|
LABEL org.opencontainers.image.licenses="MIT"
|
|
|
|
WORKDIR /app
|
|
|
|
# Explicit engine selection (#1038/#1042): SQLite is this image's DEFAULT
|
|
# engine — set explicitly, never inferred, and wait-for-db.sh skips its
|
|
# Postgres readiness wait for it. Point the container at an external Postgres
|
|
# by overriding DATABASE_CLIENT=pg and setting DB_HOST/DB_USER/DB_PASSWORD,
|
|
# exactly like the backend image. The boot resolver still logs the engine and
|
|
# refuses the populated-both conflict.
|
|
# STORAGE_PATH: getStoragePath() falls back to path.join(__dirname,
|
|
# '../../../storage') — which resolves to the container-root `/storage` here,
|
|
# writable by root but EACCES for the nodejs user after the su-exec drop.
|
|
# Compose masks this by setting STORAGE_PATH=/app/storage; this image must
|
|
# pin the same path (it is the directory the Dockerfile creates and chowns).
|
|
ENV NODE_ENV=production \
|
|
DATABASE_CLIENT=sqlite3
|
|
|
|
# See backend/Dockerfile for the rationale of each of the following blocks.
|
|
RUN echo "cachebust=${CACHEBUST}" && apk upgrade --no-cache
|
|
|
|
RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
|
|
|
|
# sqlite — DatabaseBackupService.createSQLiteBackup() SPAWNS the `sqlite3`
|
|
# CLI for `.backup` and PRAGMA integrity_check; the npm module does not
|
|
# ship that binary. backend/Dockerfile omits it because compose always runs
|
|
# Postgres — this image defaults to SQLite, so without it every database
|
|
# backup fails with ENOENT.
|
|
RUN apk add --no-cache dumb-init postgresql-client sqlite ffmpeg su-exec \
|
|
fontconfig ttf-dejavu ttf-liberation poppler-utils exiftool && \
|
|
fc-cache -f
|
|
|
|
RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
|
|
|
|
COPY --from=backend-builder --chown=nodejs:nodejs /app/node_modules ./node_modules
|
|
COPY --chown=nodejs:nodejs backend/ .
|
|
|
|
RUN chmod -R a+r /app && chmod +x wait-for-db.sh
|
|
|
|
RUN printf '<?xml version="1.0"?>\n<!DOCTYPE fontconfig SYSTEM "fonts.dtd">\n<fontconfig>\n <dir>/app/assets/fonts</dir>\n</fontconfig>\n' > /etc/fonts/conf.d/99-picpeak-fonts.conf && \
|
|
fc-cache -f /app/assets/fonts
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# One volume, one layout (#1042 scope: "single data layout on one volume")
|
|
# ---------------------------------------------------------------------------
|
|
# /data/db picpeak.db (+ -wal/-shm) and SETUP_TOKEN
|
|
# /data/storage originals, thumbnails, archives
|
|
# /data/logs application logs
|
|
# /data/backup built-in backup output; /backup symlinks here
|
|
#
|
|
# `-v picpeak:/data` and nothing else to remember — back up /data and you have
|
|
# backed up the install. /backup is where migrations 029 + 030 seed the backup
|
|
# destinations, so it is symlinked in rather than left dangling.
|
|
ENV DATA_ROOT=/data \
|
|
DATA_DIR=/data/db \
|
|
DATABASE_PATH=/data/db/picpeak.db \
|
|
STORAGE_PATH=/data/storage \
|
|
LOG_DIR=/data/logs \
|
|
BACKUP_DIR=/data/backup
|
|
|
|
# FRONTEND_URL is deliberately NOT set here (#705). It used to default to
|
|
# http://localhost:3000 so share links would not come out relative, but a
|
|
# baked-in value OVERRIDES the general_site_url setting the setup wizard
|
|
# writes — so a single-container install could never configure its own public
|
|
# address, and the Settings field would show as env-pinned for everyone.
|
|
# getFrontendBaseUrl() now resolves the setting, then the origin the request
|
|
# arrived on, and getAbsoluteFrontendUrl() still ends at http://localhost:3000,
|
|
# so links stay absolute without pinning anything. Override with
|
|
# -e FRONTEND_URL=https://photos.example.com for config-as-code deployments.
|
|
|
|
# /app/storage is a second entrance to the same volume. The business-document
|
|
# writers (quoteService, invoice sending/reminders, contract signatures) build
|
|
# their paths from `path.join(process.cwd(), 'storage', ...)` and never consult
|
|
# STORAGE_PATH. Compose hides that because it sets STORAGE_PATH=/app/storage
|
|
# with WORKDIR /app, so the two happen to be the same directory; here they are
|
|
# not, and /app is root-owned, so a quote or invoice PDF would fail to write as
|
|
# UID 1001 — and be lost with the container even if it succeeded. Teaching
|
|
# those services STORAGE_PATH is the real fix and belongs in its own change;
|
|
# the symlink restores the coincidence compose already relies on.
|
|
RUN mkdir -p /data/db /data/storage/events/active /data/storage/events/archived \
|
|
/data/storage/thumbnails /data/logs \
|
|
/data/backup/picpeak /data/backup/database && \
|
|
ln -s /data/backup /backup && \
|
|
ln -s /data/storage /app/storage && \
|
|
chown -R nodejs:nodejs /data
|
|
|
|
VOLUME ["/data"]
|
|
|
|
# The frontend bundle, served by server.js's SERVE_FRONTEND block. Explicit
|
|
# opt-in rather than the dist-exists autodetect, so the behavior is pinned
|
|
# even if the autodetect heuristic ever changes.
|
|
COPY --from=frontend-builder --chown=nodejs:nodejs /app/dist /app/frontend/dist
|
|
ENV SERVE_FRONTEND=true \
|
|
FRONTEND_DIR=/app/frontend/dist
|
|
|
|
# Marks this as the single-container build. The backend refuses to enable face
|
|
# recognition (#1074) when it sees this, on performance grounds: that feature
|
|
# needs a separate ML container this image does not contain, and it would add
|
|
# a second image-processing pipeline competing with Sharp for the CPU and
|
|
# memory of a container sized for one photographer plus guests browsing. The
|
|
# failure would not be loud — just a slow install that looks broken.
|
|
#
|
|
# An explicit marker rather than inferring it from SERVE_FRONTEND or the
|
|
# SQLite path: legitimate multi-container deployments do both of those, and
|
|
# none of them should lose the feature by accident.
|
|
ENV PICPEAK_SINGLE_CONTAINER=true
|
|
|
|
# No USER directive — same as backend/Dockerfile: the container starts as root
|
|
# so wait-for-db.sh can chown bind-mounted volumes to UID 1001, then drops
|
|
# privileges via su-exec (#484).
|
|
|
|
EXPOSE 3000
|
|
|
|
# Shell form so it resolves $PORT: a hard-coded 3000 marks an otherwise healthy
|
|
# container unhealthy forever the moment anyone overrides the port.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider "http://localhost:${PORT:-3000}/health" || exit 1
|
|
|
|
ENTRYPOINT ["dumb-init", "--"]
|
|
# --max-http-header-size matches nginx's `large_client_header_buffers 4 32k`.
|
|
# Requests reach Node directly here, and its 16 KiB default would reject a guest
|
|
# carrying several per-gallery JWT cookies before Express ever saw them.
|
|
CMD ["./wait-for-db.sh", "node", "--max-http-header-size=32768", "server.js"]
|