mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 20:07:04 +01:00
Krzysztof kuhy Rudnicki
558883f281
Stands up Endurain behind the existing Caddy edge and imports RunnerUp activities into it. Endurain is a VIEWER: screen-locker's workout gate still reads the phone over adb and is untouched here, because a WebDAV drop folder is spoofable by anything that can write to ~/cloud and must not become a screen-unlock authority. Primary path is phone -> WebDAV (existing dufs) -> ~/cloud/RunnerUp/ -> importer -> Endurain, with an adb pull as fallback when a run has not been uploaded yet. A systemd user timer runs the importer every 15 min. Findings that shaped the implementation, each verified against the running system rather than assumed: - Endurain moved to Codeberg; the GitHub repo is a read-only mirror stale at v0.17.7 against v0.19.0. The image is pulled from Codeberg. - postgres:18 moved PGDATA to /var/lib/postgresql/18/docker. Upstream's compose example still mounts the pre-18 path, which fails as an unexplained "container is unhealthy"; the real cause is only visible in docker logs. - Endurain seeds a hardcoded admin/admin via an Alembic migration with no env override, and endurain.kuhy.duckdns.org already resolved publicly. Publishing is therefore a separate script that refuses to install the Caddy site while those credentials still work. - Endurain performs NO duplicate detection, so the importer owns dedupe on two axes: a content hash, and an activity key that collapses the .gpx/.tcx pair RunnerUp writes for a single run (different bytes, same run). - Ambiguous uploads (5xx/timeout) are never re-queued, since the activity may already have been committed; only definite 4xx rejections are staged for retry. The importer exits non-zero so the timer surfaces the problem. - RunnerUp has no background sync at all, so every upload is a manual tap. - Its WebDAV synchronizer needs HTTPS with a real cert (Android blocks cleartext at targetSdk 36; self-signed is broken upstream) and a URL with no trailing slash, and cannot MKCOL against dufs - so the inbox must pre-exist. The phone gets a dufs credential scoped to /RunnerUp, verified unable to read Keepass or gdrive_backups. Verified: 52 tests at 100% branch coverage; the timer imports 4 real runs and re-runs create zero duplicates; https://endurain.kuhy.duckdns.org serves 200 with a valid cert and the other edge sites are unaffected; screen-locker's suite still passes 1090 tests at 100% coverage. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GbYEnfGnf1988cdFdGebot
70 lines
2.8 KiB
YAML
70 lines
2.8 KiB
YAML
# Endurain self-hosted fitness tracker.
|
|
#
|
|
# Based on the upstream docker-compose.yml.example from Codeberg (the GitHub
|
|
# repo is a read-only mirror and is stale). Deviations from upstream, all
|
|
# deliberate:
|
|
#
|
|
# 1. The app port is bound to 127.0.0.1 explicitly. Upstream's "8080:8080"
|
|
# binds every interface; this host runs Docker alongside a Caddy edge on
|
|
# the host network, so an unqualified mapping would expose Endurain
|
|
# unfronted to the LAN. Public access is via gitea-caddy ONLY
|
|
# (sites/endurain.caddy -> endurain.kuhy.duckdns.org).
|
|
# 2. The redis container is named endurain-redis, not upstream's bare
|
|
# "redis", which would collide with any other redis on this host.
|
|
# 3. user: "1000:1000" is set explicitly. v0.19.0 removed the UID/GID env
|
|
# vars, so the host bind mounts must be chown'd to match.
|
|
services:
|
|
endurain:
|
|
container_name: endurain-app
|
|
image: codeberg.org/endurain-project/endurain:latest
|
|
user: "1000:1000"
|
|
env_file:
|
|
- .env
|
|
volumes:
|
|
- ${LOCAL_PATH:-/var/opt/endurain}/backend/data:/app/backend/data:Z
|
|
- ${LOCAL_PATH:-/var/opt/endurain}/backend/logs:/app/backend/logs:Z
|
|
ports:
|
|
# Loopback only — see note 1 above. Do NOT change to "8085:8080".
|
|
- "127.0.0.1:8085:8080"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
|
|
postgres:
|
|
image: docker.io/postgres:18@sha256:8ff36f3c66371cba71d20ceedccfc3de9669a68737607888c4ef0af93abe8e39
|
|
container_name: endurain-postgres
|
|
env_file:
|
|
- .env
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U endurain"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
volumes:
|
|
# postgres:18 moved its default PGDATA to /var/lib/postgresql/18/docker
|
|
# and ships /var/lib/postgresql as mode-1777 owned by uid 999. Upstream's
|
|
# example still mounts at the pre-18 /var/lib/postgresql/data and sets
|
|
# PGDATA=.../data/pgdata; mounting over that path leaves it root-owned, so
|
|
# the entrypoint dies with "mkdir: cannot create directory
|
|
# '/var/lib/postgresql/data': Permission denied" and the only symptom
|
|
# compose reports is "container endurain-postgres is unhealthy".
|
|
# Mount at the image's own path and let PGDATA keep its default.
|
|
- ${LOCAL_PATH:-/var/opt/endurain}/postgres:/var/lib/postgresql/18/docker:Z
|
|
restart: unless-stopped
|
|
|
|
redis:
|
|
image: redis:8-alpine@sha256:09160599abd229764c0fb44cb6be640294e1d360a54b19985ab4843dcf2d90f1
|
|
container_name: endurain-redis
|
|
command: ["redis-server", "--appendonly", "yes"]
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
volumes:
|
|
- ${LOCAL_PATH:-/var/opt/endurain}/redis:/data:Z
|
|
restart: unless-stopped
|