novox/mesh-catalog
3
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

Six modules name no /var/lib: the root is a place, the maps reference it

Browse Source 
The state directories say place "." — the assignment's own root — and
every bind, secret, own-secret, receives and grants path references it
as ${dir:state}/…; grants directories that are their own resources are
placed by id. gitea's two coincidence strings from the first pass
(${dir:data}base.json — resolving correctly by pure concatenation) are
spelled honestly now. What still says /var/lib is inside containers —
the software's contract — or under /var/lib/mesh, the mesh's own
plumbing, which the requirements unification absorbs next. Every
resolved path is byte-identical to what runs; landing this is a no-op
on the node, and the converter checks its own boundaries this time.
This commit is contained in:
jschoubben
2026-09-26 18:20:47 +02:00
parent dde8b15483
commit afdd149ab7
5 changed files with 72 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/gitea/module.json
+12 -12
View File
@@ -24,14 +24,14 @@
} }
}, },
"binds": { "binds": {
"postgres-database": "${dir:data}base.json", "postgres-database": "${dir:state}/database.json",
"route": "/var/lib/gitea/route.json" "route": "${dir:state}/route.json"
}, },
"secrets": { "secrets": {
"postgres-database": "${dir:data}base.secret", "postgres-database": "${dir:state}/database.secret",
"secret": { "secret": {
"internal-token": "/var/lib/gitea/internal-token.secret", "internal-token": "${dir:state}/internal-token.secret",
"admin": "/var/lib/gitea/admin.secret" "admin": "${dir:state}/admin.secret"
} }
}, },
"capabilities": [ "capabilities": [
@@ -102,8 +102,8 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/gitea", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "grants", "id": "grants",
@@ -113,7 +113,7 @@
{ {
"id": "server-env", "id": "server-env",
"type": "file", "type": "file",
"path": "/var/lib/gitea/server.env", "path": "${dir:state}/server.env",
"mode": "0600", "mode": "0600",
"content": "GITEA__security__INTERNAL_TOKEN=${secret:internal-token}\nGITEA__database__DB_TYPE=postgres\nGITEA__database__HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nGITEA__database__NAME=${bound:postgres-database:as}\nGITEA__database__USER=${bound:postgres-database:as}\nGITEA__database__PASSWD=${secret:postgres-database}\n" "content": "GITEA__security__INTERNAL_TOKEN=${secret:internal-token}\nGITEA__database__DB_TYPE=postgres\nGITEA__database__HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nGITEA__database__NAME=${bound:postgres-database:as}\nGITEA__database__USER=${bound:postgres-database:as}\nGITEA__database__PASSWD=${secret:postgres-database}\n"
}, },
@@ -134,7 +134,7 @@
"USER_GID": "1000" "USER_GID": "1000"
}, },
"env-file": [ "env-file": [
"/var/lib/gitea/server.env" "${dir:state}/server.env"
], ],
"ports": [ "ports": [
"3000", "3000",
@@ -157,11 +157,11 @@
"MESH_GITEA_ADMIN_USER": "mesh-admin" "MESH_GITEA_ADMIN_USER": "mesh-admin"
}, },
"env-file": [ "env-file": [
"/var/lib/gitea/server.env" "${dir:state}/server.env"
], ],
"volumes": [ "volumes": [
"${dir:data}:/data", "${dir:data}:/data",
"/var/lib/gitea/admin.secret:/run/secrets/admin:ro" "${dir:state}/admin.secret:/run/secrets/admin:ro"
], ],
"args": [ "args": [
"/bin/sh", "/bin/sh",
@@ -187,7 +187,7 @@
"/var/lib/mesh/gitea/broker:/run/secrets/broker:ro", "/var/lib/mesh/gitea/broker:/run/secrets/broker:ro",
"/var/lib/mesh/gitea/config.json:/run/config/config.json:ro", "/var/lib/mesh/gitea/config.json:/run/config/config.json:ro",
"${dir:grants}:${dir:grants}:ro", "${dir:grants}:${dir:grants}:ro",
"/var/lib/gitea/admin.secret:/run/secrets/admin:ro", "${dir:state}/admin.secret:/run/secrets/admin:ro",
"/var/lib/mesh/gitea/state:/run/state" "/var/lib/mesh/gitea/state:/run/state"
], ],
"env": { "env": {
modules/mailu/module.json
+34 -35
View File
@@ -41,15 +41,15 @@
} }
}, },
"binds": { "binds": {
"postgres-database": "/var/lib/mailu/database.json", "postgres-database": "${dir:state}/database.json",
"route": "/var/lib/mailu/route.json" "route": "${dir:state}/route.json"
}, },
"secrets": { "secrets": {
"postgres-database": "/var/lib/mailu/database.secret", "postgres-database": "${dir:state}/database.secret",
"secret": { "secret": {
"secret-key": "/var/lib/mailu/secret-key.secret", "secret-key": "${dir:state}/secret-key.secret",
"admin": "/var/lib/mailu/admin.secret", "admin": "${dir:state}/admin.secret",
"api-token": "/var/lib/mailu/api-token.secret" "api-token": "${dir:state}/api-token.secret"
} }
}, },
"emits": [ "emits": [
@@ -140,13 +140,12 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/mailu", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "grants", "id": "grants",
"type": "directory", "type": "directory",
"path": "/var/lib/mailu/grants",
"mode": "0700" "mode": "0700"
}, },
{ {
@@ -157,28 +156,28 @@
{ {
"id": "config-env", "id": "config-env",
"type": "file", "type": "file",
"path": "/var/lib/mailu/mailu.env", "path": "${dir:state}/mailu.env",
"mode": "0644", "mode": "0644",
"content": "ADMIN_ADDRESS=mailu-admin\nANTISPAM_ADDRESS=mailu-antispam\nANTIVIRUS_ADDRESS=mailu-antivirus\nIMAP_ADDRESS=mailu-imap\nSMTP_ADDRESS=mailu-smtp\nFRONT_ADDRESS=mailu-front\nWEBMAIL_ADDRESS=mailu-webmail\nWEBDAV_ADDRESS=mailu-webdav\nREDIS_ADDRESS=mailu-redis\nPORTS=25,80,443,465,993,995,4190,110,143,587\nDOMAIN=novox.be\nHOSTNAMES=mail.novox.be\nPOSTMASTER=admin\nSITENAME=Novox\nWEBSITE=https://novox.be\nTLS_FLAVOR=letsencrypt\nSUBNET=192.168.203.0/24\nCOMPOSE_PROJECT_NAME=mailu\nANTIVIRUS=clamav\nWEBMAIL=roundcube\nWEBDAV=radicale\nFETCHMAIL_ENABLED=True\nFETCHMAIL_DELAY=600\nADMIN=true\nWEB_ADMIN=/admin\nWEB_WEBMAIL=/webmail\nWEBROOT_REDIRECT=/webmail\nAPI=true\nWEB_API=/api\nAUTH_RATELIMIT_IP=6000/hour\nAUTH_RATELIMIT_USER=1000/day\nCREDENTIAL_ROUNDS=12\nPASSWORD_SCHEME=PBKDF2\nDISABLE_STATISTICS=True\nMESSAGE_SIZE_LIMIT=50000000\nMESSAGE_RATELIMIT=200/day\nRECIPIENT_DELIMITER=+\nPOSTFIX_MYNETWORKS=127.0.0.0/8 [::1]/128\nRELAYNETS=\nRELAYHOST=\nREJECT_UNLISTED_RECIPIENT=\nDB_FLAVOR=postgresql\nINITIAL_ADMIN_ACCOUNT=admin\nINITIAL_ADMIN_DOMAIN=novox.be\nINITIAL_ADMIN_MODE=ifmissing\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nPOP3_PORT=110\nPOP3S_PORT=995\nIMAP_PORT=143\nIMAPS_PORT=993\nHTTP_PORT=7080\nHTTPS_PORT=7443\nAUTOMX_PORT=4243\nAMX_SMTP_ADDRESS=mail.novox.be\nAMX_SMTP_PORT=587\nAMX_IMAP_ADDRESS=mail.novox.be\nAMX_IMAP_PORT=143\nAMX_MAIL_DOMAINS=novox.be\nDMARC_RUA=admin\nDMARC_RUF=admin\nLETSENCRYPT_SHORTCHAIN=True\nTZ=Etc/UTC\nLOG_LEVEL=INFO\nWELCOME=false\nREAL_IP_HEADER=X-Real-IP\nREAL_IP_FROM=142.132.152.141\nCOMPRESSION=\nCOMPRESS_LEVEL=\nCOMPRESSION_LEVEL=\nBIND_ADDRESS4=127.0.0.1\nBIND_ADDRESS6=::1\nMAILU_VERSION=1.9\nDOCKER_ORG=mailu\nDOCKER_PREFIX=\nWELCOME_SUBJECT=Welcome to your new email account\nWELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!\n" "content": "ADMIN_ADDRESS=mailu-admin\nANTISPAM_ADDRESS=mailu-antispam\nANTIVIRUS_ADDRESS=mailu-antivirus\nIMAP_ADDRESS=mailu-imap\nSMTP_ADDRESS=mailu-smtp\nFRONT_ADDRESS=mailu-front\nWEBMAIL_ADDRESS=mailu-webmail\nWEBDAV_ADDRESS=mailu-webdav\nREDIS_ADDRESS=mailu-redis\nPORTS=25,80,443,465,993,995,4190,110,143,587\nDOMAIN=novox.be\nHOSTNAMES=mail.novox.be\nPOSTMASTER=admin\nSITENAME=Novox\nWEBSITE=https://novox.be\nTLS_FLAVOR=letsencrypt\nSUBNET=192.168.203.0/24\nCOMPOSE_PROJECT_NAME=mailu\nANTIVIRUS=clamav\nWEBMAIL=roundcube\nWEBDAV=radicale\nFETCHMAIL_ENABLED=True\nFETCHMAIL_DELAY=600\nADMIN=true\nWEB_ADMIN=/admin\nWEB_WEBMAIL=/webmail\nWEBROOT_REDIRECT=/webmail\nAPI=true\nWEB_API=/api\nAUTH_RATELIMIT_IP=6000/hour\nAUTH_RATELIMIT_USER=1000/day\nCREDENTIAL_ROUNDS=12\nPASSWORD_SCHEME=PBKDF2\nDISABLE_STATISTICS=True\nMESSAGE_SIZE_LIMIT=50000000\nMESSAGE_RATELIMIT=200/day\nRECIPIENT_DELIMITER=+\nPOSTFIX_MYNETWORKS=127.0.0.0/8 [::1]/128\nRELAYNETS=\nRELAYHOST=\nREJECT_UNLISTED_RECIPIENT=\nDB_FLAVOR=postgresql\nINITIAL_ADMIN_ACCOUNT=admin\nINITIAL_ADMIN_DOMAIN=novox.be\nINITIAL_ADMIN_MODE=ifmissing\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nPOP3_PORT=110\nPOP3S_PORT=995\nIMAP_PORT=143\nIMAPS_PORT=993\nHTTP_PORT=7080\nHTTPS_PORT=7443\nAUTOMX_PORT=4243\nAMX_SMTP_ADDRESS=mail.novox.be\nAMX_SMTP_PORT=587\nAMX_IMAP_ADDRESS=mail.novox.be\nAMX_IMAP_PORT=143\nAMX_MAIL_DOMAINS=novox.be\nDMARC_RUA=admin\nDMARC_RUF=admin\nLETSENCRYPT_SHORTCHAIN=True\nTZ=Etc/UTC\nLOG_LEVEL=INFO\nWELCOME=false\nREAL_IP_HEADER=X-Real-IP\nREAL_IP_FROM=142.132.152.141\nCOMPRESSION=\nCOMPRESS_LEVEL=\nCOMPRESSION_LEVEL=\nBIND_ADDRESS4=127.0.0.1\nBIND_ADDRESS6=::1\nMAILU_VERSION=1.9\nDOCKER_ORG=mailu\nDOCKER_PREFIX=\nWELCOME_SUBJECT=Welcome to your new email account\nWELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!\n"
}, },
{ {
"id": "secret-env", "id": "secret-env",
"type": "file", "type": "file",
"path": "/var/lib/mailu/secret.env", "path": "${dir:state}/secret.env",
"mode": "0600", "mode": "0600",
"content": "SECRET_KEY=${secret:secret-key}\n" "content": "SECRET_KEY=${secret:secret-key}\n"
}, },
{ {
"id": "database-env", "id": "database-env",
"type": "file", "type": "file",
"path": "/var/lib/mailu/database.env", "path": "${dir:state}/database.env",
"mode": "0600", "mode": "0600",
"content": "DB_FLAVOR=postgresql\nDB_HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nDB_USER=${bound:postgres-database:as}\nDB_NAME=${bound:postgres-database:as}\nDB_PW=${secret:postgres-database}\n" "content": "DB_FLAVOR=postgresql\nDB_HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nDB_USER=${bound:postgres-database:as}\nDB_NAME=${bound:postgres-database:as}\nDB_PW=${secret:postgres-database}\n"
}, },
{ {
"id": "admin-env", "id": "admin-env",
"type": "file", "type": "file",
"path": "/var/lib/mailu/admin.env", "path": "${dir:state}/admin.env",
"mode": "0600", "mode": "0600",
"content": "INITIAL_ADMIN_PW=${secret:admin}\nAPI_TOKEN=${secret:api-token}\n" "content": "INITIAL_ADMIN_PW=${secret:admin}\nAPI_TOKEN=${secret:api-token}\n"
}, },
@@ -274,8 +273,8 @@
"image": "ghcr.io/mailu/unbound@sha256:3a0fdfb364a63f4f9259526e013c1ef40f5f14de3621ce1560804b3a5909584a", "image": "ghcr.io/mailu/unbound@sha256:3a0fdfb364a63f4f9259526e013c1ef40f5f14de3621ce1560804b3a5909584a",
"network": "mailu", "network": "mailu",
"env-file": [ "env-file": [
"/var/lib/mailu/mailu.env", "${dir:state}/mailu.env",
"/var/lib/mailu/secret.env" "${dir:state}/secret.env"
], ],
"secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified", "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
"ip": "192.168.203.254" "ip": "192.168.203.254"
@@ -297,10 +296,10 @@
"image": "ghcr.io/mailu/admin@sha256:6dbfdadc4a9590dcb7652357b505200115b689b74008653bbf369e4599a3be5a", "image": "ghcr.io/mailu/admin@sha256:6dbfdadc4a9590dcb7652357b505200115b689b74008653bbf369e4599a3be5a",
"network": "mailu", "network": "mailu",
"env-file": [ "env-file": [
"/var/lib/mailu/mailu.env", "${dir:state}/mailu.env",
"/var/lib/mailu/secret.env", "${dir:state}/secret.env",
"/var/lib/mailu/database.env", "${dir:state}/database.env",
"/var/lib/mailu/admin.env" "${dir:state}/admin.env"
], ],
"volumes": [ "volumes": [
"${dir:data-data}:/data", "${dir:data-data}:/data",
@@ -318,7 +317,7 @@
"image": "ghcr.io/mailu/dovecot@sha256:7f0ed5db996fbdc00adc5c5e38a08492e04f7eb4a9fbd66a03aa9a28ddf23993", "image": "ghcr.io/mailu/dovecot@sha256:7f0ed5db996fbdc00adc5c5e38a08492e04f7eb4a9fbd66a03aa9a28ddf23993",
"network": "mailu", "network": "mailu",
"env-file": [ "env-file": [
"/var/lib/mailu/mailu.env" "${dir:state}/mailu.env"
], ],
"volumes": [ "volumes": [
"${dir:data-mail}:/mail", "${dir:data-mail}:/mail",
@@ -335,7 +334,7 @@
"image": "ghcr.io/mailu/postfix@sha256:e2e49f39e53b80eac9e7a2f18d9df11edeb4914fd62dbba89b3155e8e034f62e", "image": "ghcr.io/mailu/postfix@sha256:e2e49f39e53b80eac9e7a2f18d9df11edeb4914fd62dbba89b3155e8e034f62e",
"network": "mailu", "network": "mailu",
"env-file": [ "env-file": [
"/var/lib/mailu/mailu.env" "${dir:state}/mailu.env"
], ],
"volumes": [ "volumes": [
"${dir:data-mailqueue}:/queue", "${dir:data-mailqueue}:/queue",
@@ -352,7 +351,7 @@
"image": "ghcr.io/mailu/rspamd@sha256:ff3666d8a61f17d309c5c6f6bcf4d40470b82299ca706ac650301175bb1a079d", "image": "ghcr.io/mailu/rspamd@sha256:ff3666d8a61f17d309c5c6f6bcf4d40470b82299ca706ac650301175bb1a079d",
"network": "mailu", "network": "mailu",
"env-file": [ "env-file": [
"/var/lib/mailu/mailu.env" "${dir:state}/mailu.env"
], ],
"volumes": [ "volumes": [
"${dir:data-filter}:/var/lib/rspamd", "${dir:data-filter}:/var/lib/rspamd",
@@ -382,8 +381,8 @@
"image": "ghcr.io/mailu/webmail@sha256:bdbee44cdb05a4658f0e3b62cc448de55ca8f8aea172279fda594826144c04f6", "image": "ghcr.io/mailu/webmail@sha256:bdbee44cdb05a4658f0e3b62cc448de55ca8f8aea172279fda594826144c04f6",
"network": "mailu", "network": "mailu",
"env-file": [ "env-file": [
"/var/lib/mailu/mailu.env", "${dir:state}/mailu.env",
"/var/lib/mailu/secret.env" "${dir:state}/secret.env"
], ],
"volumes": [ "volumes": [
"${dir:data-webmail}:/data", "${dir:data-webmail}:/data",
@@ -401,8 +400,8 @@
"image": "ghcr.io/mailu/radicale@sha256:690ed6edf189dfef100a5a8b37c195ebf5d9241ac5f23f2f44b8b7b75726e3de", "image": "ghcr.io/mailu/radicale@sha256:690ed6edf189dfef100a5a8b37c195ebf5d9241ac5f23f2f44b8b7b75726e3de",
"network": "mailu", "network": "mailu",
"env-file": [ "env-file": [
"/var/lib/mailu/mailu.env", "${dir:state}/mailu.env",
"/var/lib/mailu/secret.env" "${dir:state}/secret.env"
], ],
"volumes": [ "volumes": [
"${dir:data-dav}:/data" "${dir:data-dav}:/data"
@@ -419,8 +418,8 @@
"image": "ghcr.io/mailu/fetchmail@sha256:f881c8412d3bbe73d638469b48321558d6403a9d45bfa043c1e52c752103d42d", "image": "ghcr.io/mailu/fetchmail@sha256:f881c8412d3bbe73d638469b48321558d6403a9d45bfa043c1e52c752103d42d",
"network": "mailu", "network": "mailu",
"env-file": [ "env-file": [
"/var/lib/mailu/mailu.env", "${dir:state}/mailu.env",
"/var/lib/mailu/secret.env" "${dir:state}/secret.env"
], ],
"volumes": [ "volumes": [
"${dir:data-fetchmail}:/data" "${dir:data-fetchmail}:/data"
@@ -437,7 +436,7 @@
"image": "ghcr.io/mailu/nginx@sha256:36f98897cd1bc9d27628bbb4e04bdf60147af2ec7507d6da77f002c4f256896d", "image": "ghcr.io/mailu/nginx@sha256:36f98897cd1bc9d27628bbb4e04bdf60147af2ec7507d6da77f002c4f256896d",
"network": "mailu", "network": "mailu",
"env-file": [ "env-file": [
"/var/lib/mailu/mailu.env" "${dir:state}/mailu.env"
], ],
"ports": [ "ports": [
"25", "25",
@@ -473,8 +472,8 @@
"network": "mailu", "network": "mailu",
"volumes": [ "volumes": [
"/var/lib/mesh/mailu/broker:/run/secrets/broker:ro", "/var/lib/mesh/mailu/broker:/run/secrets/broker:ro",
"/var/lib/mailu/api-token.secret:/run/secrets/api-token:ro", "${dir:state}/api-token.secret:/run/secrets/api-token:ro",
"/var/lib/mailu/grants:/var/lib/mailu/grants:ro", "${dir:grants}:${dir:grants}:ro",
"/var/lib/mesh/mailu/config.json:/run/config/config.json:ro", "/var/lib/mesh/mailu/config.json:/run/config/config.json:ro",
"/var/run/docker.sock:/var/run/docker.sock" "/var/run/docker.sock:/var/run/docker.sock"
], ],
@@ -485,7 +484,7 @@
"MESH_MAILU_IMAP_CONTAINER": "mailu-imap", "MESH_MAILU_IMAP_CONTAINER": "mailu-imap",
"MESH_MAILU_CONFIG_FILE": "/run/config/config.json", "MESH_MAILU_CONFIG_FILE": "/run/config/config.json",
"MESH_MAILU_DOMAIN": "novox.be", "MESH_MAILU_DOMAIN": "novox.be",
"MESH_RECEIVES": "/var/lib/mailu/grants/mesh.json" "MESH_RECEIVES": "${dir:grants}/mesh.json"
}, },
"restart-on": [ "restart-on": [
"runtime-config" "runtime-config"
@@ -499,7 +498,7 @@
"artifact": "automx", "artifact": "automx",
"network": "mailu", "network": "mailu",
"env-file": [ "env-file": [
"/var/lib/mailu/mailu.env" "${dir:state}/mailu.env"
], ],
"ports": [ "ports": [
"4243" "4243"
@@ -552,9 +551,9 @@
} }
}, },
"receives": { "receives": {
"smtp": "/var/lib/mailu/grants/mesh.json" "smtp": "${dir:grants}/mesh.json"
}, },
"grants": { "grants": {
"smtp": "/var/lib/mailu/grants" "smtp": "${dir:grants}"
} }
} }
modules/mongodb/module.json
+9 -10
View File
@@ -32,13 +32,13 @@
} }
}, },
"receives": { "receives": {
"mongodb-database": "/var/lib/mongodb/grants/mesh.json" "mongodb-database": "${dir:grants}/mesh.json"
}, },
"grants": { "grants": {
"mongodb-database": "/var/lib/mongodb/grants" "mongodb-database": "${dir:grants}"
}, },
"own-secrets": { "own-secrets": {
"root": "/var/lib/mongodb/root.secret", "root": "${dir:state}/root.secret",
"broker": "/var/lib/mesh/mongodb/broker" "broker": "/var/lib/mesh/mongodb/broker"
}, },
"secrets-owner": "999:999", "secrets-owner": "999:999",
@@ -52,13 +52,12 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/mongodb", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "grants", "id": "grants",
"type": "directory", "type": "directory",
"path": "/var/lib/mongodb/grants",
"mode": "0700" "mode": "0700"
}, },
{ {
@@ -86,7 +85,7 @@
], ],
"volumes": [ "volumes": [
"${dir:data}:/data/db", "${dir:data}:/data/db",
"/var/lib/mongodb/root.secret:/run/secrets/root:ro" "${dir:state}/root.secret:/run/secrets/root:ro"
] ]
}, },
{ {
@@ -96,14 +95,14 @@
"network": "mongodb", "network": "mongodb",
"volumes": [ "volumes": [
"/var/lib/mesh/mongodb/broker:/run/secrets/broker:ro", "/var/lib/mesh/mongodb/broker:/run/secrets/broker:ro",
"/var/lib/mongodb/grants:/var/lib/mongodb/grants:ro", "${dir:grants}:${dir:grants}:ro",
"/var/lib/mongodb/root.secret:/run/secrets/root:ro" "${dir:state}/root.secret:/run/secrets/root:ro"
], ],
"env": { "env": {
"MESH_PROVISION_MONGODB": "mongodb://root@mongodb-server:27017/admin?authSource=admin", "MESH_PROVISION_MONGODB": "mongodb://root@mongodb-server:27017/admin?authSource=admin",
"MESH_PROVISION_PASSWORD_FILE": "/run/secrets/root", "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/root",
"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_BROKER_FILE": "/run/secrets/broker",
"MESH_RECEIVES": "/var/lib/mongodb/grants/mesh.json" "MESH_RECEIVES": "${dir:grants}/mesh.json"
}, },
"artifact": "runtime" "artifact": "runtime"
} }
modules/nextcloud/module.json
+11 -11
View File
@@ -17,20 +17,20 @@
} }
}, },
"binds": { "binds": {
"postgres-database": "/var/lib/nextcloud/database.json", "postgres-database": "${dir:state}/database.json",
"s3-bucket": "/var/lib/nextcloud/store.json", "s3-bucket": "${dir:state}/store.json",
"route": "/var/lib/nextcloud/route.json" "route": "${dir:state}/route.json"
}, },
"secrets": { "secrets": {
"postgres-database": "/var/lib/nextcloud/database.secret", "postgres-database": "${dir:state}/database.secret",
"s3-bucket": "/var/lib/nextcloud/store.secret" "s3-bucket": "${dir:state}/store.secret"
}, },
"emits": [ "emits": [
"module.nextcloud.user.created", "module.nextcloud.user.created",
"module.nextcloud.share.created" "module.nextcloud.share.created"
], ],
"own-secrets": { "own-secrets": {
"admin": "/var/lib/nextcloud/admin.secret", "admin": "${dir:state}/admin.secret",
"broker": "/var/lib/mesh/nextcloud/broker" "broker": "/var/lib/mesh/nextcloud/broker"
}, },
"capabilities": [ "capabilities": [
@@ -54,13 +54,13 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/nextcloud", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "server-env", "id": "server-env",
"type": "file", "type": "file",
"path": "/var/lib/nextcloud/server.env", "path": "${dir:state}/server.env",
"mode": "0600", "mode": "0600",
"content": "POSTGRES_HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nPOSTGRES_DB=${bound:postgres-database:as}\nPOSTGRES_USER=${bound:postgres-database:as}\nPOSTGRES_PASSWORD=${secret:postgres-database}\nNEXTCLOUD_ADMIN_USER=mesh-admin\nNEXTCLOUD_ADMIN_PASSWORD=${secret:admin}\nOBJECTSTORE_S3_HOST=${bound:s3-bucket:at}\nOBJECTSTORE_S3_PORT=${bound:s3-bucket:port}\nOBJECTSTORE_S3_BUCKET=mesh-novox-ncloud\nOBJECTSTORE_S3_KEY=${bound:s3-bucket:as}\nOBJECTSTORE_S3_SECRET=${secret:s3-bucket}\nOBJECTSTORE_S3_SSL=false\nOBJECTSTORE_S3_USEPATH_STYLE=true\nOBJECTSTORE_S3_REGION=${bound:s3-bucket:region}\n" "content": "POSTGRES_HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nPOSTGRES_DB=${bound:postgres-database:as}\nPOSTGRES_USER=${bound:postgres-database:as}\nPOSTGRES_PASSWORD=${secret:postgres-database}\nNEXTCLOUD_ADMIN_USER=mesh-admin\nNEXTCLOUD_ADMIN_PASSWORD=${secret:admin}\nOBJECTSTORE_S3_HOST=${bound:s3-bucket:at}\nOBJECTSTORE_S3_PORT=${bound:s3-bucket:port}\nOBJECTSTORE_S3_BUCKET=mesh-novox-ncloud\nOBJECTSTORE_S3_KEY=${bound:s3-bucket:as}\nOBJECTSTORE_S3_SECRET=${secret:s3-bucket}\nOBJECTSTORE_S3_SSL=false\nOBJECTSTORE_S3_USEPATH_STYLE=true\nOBJECTSTORE_S3_REGION=${bound:s3-bucket:region}\n"
}, },
@@ -76,7 +76,7 @@
"name": "nextcloud", "name": "nextcloud",
"image": "nextcloud@sha256:fb966733647ea03f0446b0c22eac9733c8eb616d37b960caca9d4c3010e14a08", "image": "nextcloud@sha256:fb966733647ea03f0446b0c22eac9733c8eb616d37b960caca9d4c3010e14a08",
"env-file": [ "env-file": [
"/var/lib/nextcloud/server.env" "${dir:state}/server.env"
], ],
"ports": [ "ports": [
"80" "80"
@@ -102,7 +102,7 @@
"volumes": [ "volumes": [
"/var/lib/mesh/nextcloud/broker:/run/secrets/broker:ro", "/var/lib/mesh/nextcloud/broker:/run/secrets/broker:ro",
"/var/lib/mesh/nextcloud/config.json:/run/config/config.json:ro", "/var/lib/mesh/nextcloud/config.json:/run/config/config.json:ro",
"/var/lib/nextcloud/admin.secret:/run/secrets/admin:ro", "${dir:state}/admin.secret:/run/secrets/admin:ro",
"/var/run/docker.sock:/var/run/docker.sock" "/var/run/docker.sock:/var/run/docker.sock"
], ],
"env": { "env": {
modules/only-office/module.json
+6 -6
View File
@@ -15,10 +15,10 @@
} }
}, },
"binds": { "binds": {
"route": "/var/lib/only-office/route.json" "route": "${dir:state}/route.json"
}, },
"own-secrets": { "own-secrets": {
"jwt": "/var/lib/only-office/jwt.secret" "jwt": "${dir:state}/jwt.secret"
}, },
"listens": [ "listens": [
{ {
@@ -32,13 +32,13 @@
{ {
"id": "state", "id": "state",
"type": "directory", "type": "directory",
"path": "/var/lib/only-office", "mode": "0700",
"mode": "0700" "place": "."
}, },
{ {
"id": "server-env", "id": "server-env",
"type": "file", "type": "file",
"path": "/var/lib/only-office/server.env", "path": "${dir:state}/server.env",
"mode": "0600", "mode": "0600",
"content": "JWT_ENABLED=true\nJWT_SECRET=${secret:jwt}\nJWT_HEADER=Authorization\nJWT_IN_BODY=true\nALLOW_PRIVATE_IP_ADDRESS=true\n" "content": "JWT_ENABLED=true\nJWT_SECRET=${secret:jwt}\nJWT_HEADER=Authorization\nJWT_IN_BODY=true\nALLOW_PRIVATE_IP_ADDRESS=true\n"
}, },
@@ -89,7 +89,7 @@
"image": "onlyoffice/documentserver@sha256:3ab6ebc7c605e5a32b7ae3ff19daed4925090245acc8100ce2230bd766c88212", "image": "onlyoffice/documentserver@sha256:3ab6ebc7c605e5a32b7ae3ff19daed4925090245acc8100ce2230bd766c88212",
"network": "only-office", "network": "only-office",
"env-file": [ "env-file": [
"/var/lib/only-office/server.env" "${dir:state}/server.env"
], ],
"ports": [ "ports": [
"9070:80" "9070:80"