lukasandClaude Opus 5
5553b5febe
Everything needed to run the app on an Intel NAS that is also doing other jobs: one published port, no host networking, memory/CPU caps and log rotation on every container, and all state in bind mounts under DATA_ROOT so mail survives image updates, project deletion in the NAS UI, and full reinstalls — and so Hyper Backup/HBS3 can actually see it. - docker/Dockerfile.backend: multi-stage, non-root (uid 10001), tini for the <10s graceful lease release. Installs the four plugins as entry-point distributions. One image, several roles via docker/entrypoint.sh (api | worker-sync | worker-jobs | migrate | reindex | plugins). - docker/Dockerfile.frontend + nginx.conf: SPA + /api reverse proxy with the WebSocket upgrade for /api/ws, and X-Forwarded-Proto preserved so the API still emits __Host-/Secure cookies when TLS is terminated by the NAS reverse proxy (identity/cookies.py keys off request scheme). - docker/docker-compose.prod.yml: project name webmail-prod, NOT webmail — docker-compose.yml (dev services) owns that name, and two compose files sharing one project name fight over each other's containers. Meilisearch is an opt-in profile; SEARCH_BACKEND=pg is the default so a small NAS pays nothing for search. - migrate runs as a one-shot (core Alembic head + every plugin branch) that everything else waits on, so a bad migration can never leave new code running against an old schema. - docker/backup.sh: nightly pg_dump verified with `pg_restore --list` before it counts as a backup, with retention and a baseline on first start. - deploy/webmail.sh: init/doctor/up/down/status/logs/update/rollback/ backup/restore/reindex/psql/shell. `update` is backup -> images -> migrate -> roll workers, api, web -> health-gate, with automatic rollback to the previous version if the gate fails. `doctor` refuses to be quiet when DATA_ROOT is on NFS/SMB (silent Postgres corruption). - deploy/build-push.sh: build images off-NAS (the frontend build wants ~2GB RAM) and push to Gitea, or --save a tar to carry over. - scripts/reindex_search.py: rebuild the search index from Postgres alone. Every SearchDoc field is already stored, so the index is derived data that never needs backing up — this closes the only real objection to running Meilisearch on a box whose volumes may be wiped. - pyproject: package-data for accounts/presets.yaml and the shared plugin Alembic env. Without it a non-editable install (i.e. any image) silently ships a package that fails at runtime. - GET /api/version, used by the deploy health gate. Verified end to end on a real stack: fresh install, all services healthy, core + 4 plugin migration branches applied, login/SPA/plugin bundles through nginx, WS upgrade returning 101, __Host- cookies under a simulated TLS proxy, backup -> restore round-trip preserving user and plugin schema, failed-update auto-rollback (both a bad migration and a boot-crashing API), and Meilisearch profile serving a live query. ruff + mypy --strict clean, 363/363 backend tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nux3LCu4zP9nih4BRhPyHw
80 lines
2.9 KiB
Docker
80 lines
2.9 KiB
Docker
# Production backend image: API, both worker roles, and the migration/admin CLI.
|
|
#
|
|
# One image, several commands (see docker/entrypoint.sh) — matches SPEC §6.3's
|
|
# WORKER_ROLE split. Build context is the REPO ROOT, because the image needs
|
|
# backend/ *and* plugins/ (the five plugins are separate distributions that the
|
|
# loader discovers through the `webmail.plugins` entry-point group, SPEC §11).
|
|
#
|
|
# docker build -f docker/Dockerfile.backend -t webmail/backend .
|
|
|
|
# ---------- builder: resolve wheels into a self-contained venv ----------------
|
|
FROM python:3.11-slim AS builder
|
|
|
|
ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PYTHONDONTWRITEBYTECODE=1
|
|
|
|
# Only needed if a pinned dep has no manylinux wheel for this platform; the
|
|
# whole stage is discarded, so it costs nothing in the runtime image.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends build-essential \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN python -m venv /opt/venv
|
|
ENV PATH="/opt/venv/bin:$PATH"
|
|
|
|
# Backend first: its dependency set is the slowest layer and changes least often.
|
|
COPY backend/pyproject.toml /src/backend/pyproject.toml
|
|
COPY backend/app /src/backend/app
|
|
COPY backend/workers /src/backend/workers
|
|
RUN pip install /src/backend
|
|
|
|
# Plugins are ordinary distributions installed on top (each owns its own deps).
|
|
COPY plugins /src/plugins
|
|
RUN pip install \
|
|
/src/plugins/webmail_plugin_calendar \
|
|
/src/plugins/webmail_plugin_contacts \
|
|
/src/plugins/webmail_plugin_labels \
|
|
/src/plugins/webmail_plugin_filters
|
|
|
|
# ---------- runtime -----------------------------------------------------------
|
|
FROM python:3.11-slim
|
|
|
|
ARG APP_VERSION=dev
|
|
ARG GIT_SHA=unknown
|
|
LABEL org.opencontainers.image.title="webmail-backend" \
|
|
org.opencontainers.image.version="${APP_VERSION}" \
|
|
org.opencontainers.image.revision="${GIT_SHA}"
|
|
|
|
ENV PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
PATH="/opt/venv/bin:$PATH" \
|
|
APP_VERSION="${APP_VERSION}" \
|
|
GIT_SHA="${GIT_SHA}"
|
|
|
|
# tini reaps zombies and forwards SIGTERM, which the workers need for the <10 s
|
|
# graceful lease release in workers/run.py.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends tini \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& useradd --system --uid 10001 --create-home --home-dir /home/webmail webmail
|
|
|
|
COPY --from=builder /opt/venv /opt/venv
|
|
|
|
WORKDIR /app
|
|
# Alembic's core tree lives outside the installed package, so it is copied in.
|
|
COPY backend/alembic.ini ./alembic.ini
|
|
COPY backend/migrations ./migrations
|
|
COPY backend/scripts ./scripts
|
|
COPY docker/entrypoint.sh /usr/local/bin/entrypoint
|
|
RUN chmod +x /usr/local/bin/entrypoint
|
|
|
|
# Blob store mount point (BLOB_ROOT). Ownership is set by the compose `init`
|
|
# service, which runs before anything else touches the bind mount.
|
|
RUN mkdir -p /data/blobs && chown webmail:webmail /data/blobs
|
|
VOLUME ["/data/blobs"]
|
|
|
|
USER webmail
|
|
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/entrypoint"]
|
|
CMD ["api"]
|