lukasandClaude Opus 5
5553b5febe
Everything needed to run the app on an Intel NAS that is also doing other jobs: one published port, no host networking, memory/CPU caps and log rotation on every container, and all state in bind mounts under DATA_ROOT so mail survives image updates, project deletion in the NAS UI, and full reinstalls — and so Hyper Backup/HBS3 can actually see it. - docker/Dockerfile.backend: multi-stage, non-root (uid 10001), tini for the <10s graceful lease release. Installs the four plugins as entry-point distributions. One image, several roles via docker/entrypoint.sh (api | worker-sync | worker-jobs | migrate | reindex | plugins). - docker/Dockerfile.frontend + nginx.conf: SPA + /api reverse proxy with the WebSocket upgrade for /api/ws, and X-Forwarded-Proto preserved so the API still emits __Host-/Secure cookies when TLS is terminated by the NAS reverse proxy (identity/cookies.py keys off request scheme). - docker/docker-compose.prod.yml: project name webmail-prod, NOT webmail — docker-compose.yml (dev services) owns that name, and two compose files sharing one project name fight over each other's containers. Meilisearch is an opt-in profile; SEARCH_BACKEND=pg is the default so a small NAS pays nothing for search. - migrate runs as a one-shot (core Alembic head + every plugin branch) that everything else waits on, so a bad migration can never leave new code running against an old schema. - docker/backup.sh: nightly pg_dump verified with `pg_restore --list` before it counts as a backup, with retention and a baseline on first start. - deploy/webmail.sh: init/doctor/up/down/status/logs/update/rollback/ backup/restore/reindex/psql/shell. `update` is backup -> images -> migrate -> roll workers, api, web -> health-gate, with automatic rollback to the previous version if the gate fails. `doctor` refuses to be quiet when DATA_ROOT is on NFS/SMB (silent Postgres corruption). - deploy/build-push.sh: build images off-NAS (the frontend build wants ~2GB RAM) and push to Gitea, or --save a tar to carry over. - scripts/reindex_search.py: rebuild the search index from Postgres alone. Every SearchDoc field is already stored, so the index is derived data that never needs backing up — this closes the only real objection to running Meilisearch on a box whose volumes may be wiped. - pyproject: package-data for accounts/presets.yaml and the shared plugin Alembic env. Without it a non-editable install (i.e. any image) silently ships a package that fails at runtime. - GET /api/version, used by the deploy health gate. Verified end to end on a real stack: fresh install, all services healthy, core + 4 plugin migration branches applied, login/SPA/plugin bundles through nginx, WS upgrade returning 101, __Host- cookies under a simulated TLS proxy, backup -> restore round-trip preserving user and plugin schema, failed-update auto-rollback (both a bad migration and a boot-crashing API), and Meilisearch profile serving a live query. ruff + mypy --strict clean, 363/363 backend tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nux3LCu4zP9nih4BRhPyHw
43 lines
1.9 KiB
Makefile
43 lines
1.9 KiB
Makefile
up: ## start services
|
|
docker compose -f docker/docker-compose.yml up -d postgres redis meilisearch
|
|
down: ## stop services (data kept)
|
|
docker compose -f docker/docker-compose.yml down
|
|
reset-db: ## DESTRUCTIVE: wipe db + search + blobs, re-migrate
|
|
docker compose -f docker/docker-compose.yml down -v
|
|
rm -rf var/blobs && mkdir -p var/blobs
|
|
docker compose -f docker/docker-compose.yml up -d --wait postgres redis meilisearch
|
|
cd backend && alembic upgrade head
|
|
api:
|
|
uvicorn app.main:create_app --factory --reload --port 8000 --app-dir backend
|
|
worker: ## run both sync + jobs in one process (dev)
|
|
cd backend && WORKER_ROLE=all python -m workers.run
|
|
worker-sync: ## run only the account-sync supervisor
|
|
cd backend && WORKER_ROLE=sync python -m workers.run
|
|
worker-jobs: ## run only the arq job consumers (interactive + bulk)
|
|
cd backend && WORKER_ROLE=jobs python -m workers.run
|
|
web:
|
|
cd frontend && npm run dev
|
|
test:
|
|
cd backend && pytest -q && cd ../frontend && npx vitest run
|
|
mail-test: ## start throwaway IMAP/SMTP server
|
|
docker compose -f docker/docker-compose.yml up -d greenmail
|
|
|
|
# --- production (NAS / single-host Docker deploy; see docs/nas-install.md) ---
|
|
prod-init: ## generate docker/.env.prod + data dirs
|
|
./deploy/webmail.sh init
|
|
prod-up: ## start the production stack
|
|
./deploy/webmail.sh up
|
|
prod-down: ## stop the production stack (data kept)
|
|
./deploy/webmail.sh down
|
|
prod-status: ## what is running, versions, disk, backups
|
|
./deploy/webmail.sh status
|
|
prod-update: ## backup -> migrate -> roll -> health-gate (auto-rollback on failure)
|
|
./deploy/webmail.sh update
|
|
prod-backup: ## take a verified database dump now
|
|
./deploy/webmail.sh backup
|
|
prod-doctor: ## pre-flight checks on a deployment
|
|
./deploy/webmail.sh doctor
|
|
prod-images: ## build production images locally (no push)
|
|
docker build -f docker/Dockerfile.backend -t webmail/backend:local .
|
|
docker build -f docker/Dockerfile.frontend -t webmail/web:local .
|