- Reverted the engine-resolution reordering. Resolving before the PostgreSQL
wait broke a real upgrade path: probePgData deliberately reports "occupied"
when Postgres is unreachable, and the target database may not exist until the
wait loop creates it — so an install that declares no DATABASE_CLIENT but has
a populated legacy SQLite file would resolve to ambiguous-both-populated and
refuse to boot. The resolver is back in its original position and the wait is
now skipped only when sqlite3 is EXPLICITLY declared, which is what this image
does. Installs that declare nothing keep today's ordering byte for byte.
- Backup subdirectories are created at startup. Creating /data/backup alone was
not enough: on a bind mount the subdirectories baked into the image are
hidden, and the backup services do not create them, so /backup/picpeak and
/backup/database failed with ENOENT.
- BACKUP_DIR points at the real path, not the /backup symlink. `chown -R` on a
symlink argument acts on the link, so the target under a bind-mounted /data
was never adopted and the writability preflight failed as UID 1001.
- Branding is rendered at startup, not baked at build. A build-time sed fixed
the literal-token bug but silently made BRAND_TITLE/BRAND_DESCRIPTION inert
for this image. docker-entrypoint.aio.sh keeps index.html as a template and
renders it with envsubst before exec'ing wait-for-db.sh — same contract, same
defaults and same two-variable allowlist as the frontend image.
- /fonts/ added to the SPA fallback exclusions. Both font secureStatic mounts
call next() on a miss, so a missing font was answering 200 text/html.
Not changed: the workflow_dispatch push opt-out. That push-decision block is
byte-identical in build-backend, build-aio and build-frontend, so it is
pre-existing behaviour rather than something this job introduces; the reviewer
agreed on being shown the evidence that fixing it only here would make AIO the
odd one out.
Verified on a rebuilt image, named volume and bind mount: both healthy, default
title "PicPeak" and BRAND_TITLE="Studio Nord Galerie" rendering in <title> and
og:title, /backup/{picpeak,database} present and writable on the host side.
Paul Nothaft
b507932d69