d7c912c7f4
Quadlets captured from the live units on bob, with the real immutable tags (0.1.44-ge06652a) rather than a placeholder, plus the hanzalova vhost that mounts the relay on /relay-api/ of the existing name. Verified end to end: /relay-api/health returns ok through the prefix, the relay's nested /v1 routes answer 401 rather than 404 (so the strip reaches them and they are genuinely protected), the remote's own /v1 is unaffected, and the served SPA bundle now carries the origin-relative /relay-api base. The vhost is committed because it is half the design: the relay only works on a path because nginx strips the prefix, and a future kanban.l4ir.net needs exactly this location block and nothing else.
48 lines
1.9 KiB
Plaintext
48 lines
1.9 KiB
Plaintext
# vibe-kanban remote-server — the self-hosted server half of the suite.
|
|
# Serves both the API and the built SPA (from /srv/static in the image) on :8081
|
|
# as uid 10001; published to the LAN on 27180 (agent-zero=5080, open-webui=5090,
|
|
# hermes=5100). Fronted by nginx on hanzalova.internal as https://kanban.internal.
|
|
#
|
|
# Image is built by lair/containers from OUR mirror of BloopAI/vibe-kanban, never
|
|
# from GitHub — upstream is sunsetting. AutoUpdate=registry picks up rebuilds.
|
|
#
|
|
# Startup order matters and is not merely cosmetic: this unit's sqlx migrations
|
|
# are what CREATE the `electric_sync` role and the publication that Electric then
|
|
# connects with, and it ALTERs that role's password from ELECTRIC_ROLE_PASSWORD on
|
|
# every start. So db -> this -> electric. Notify=healthy makes systemd hold the
|
|
# unit "starting" until /v1/health answers, so electric genuinely waits for the
|
|
# migrations rather than racing them.
|
|
#
|
|
# Auth: local single-account mode only (SELF_HOST_LOCAL_AUTH_*), deliberately no
|
|
# OAuth — the server refuses to start unless at least one provider is configured.
|
|
# Swapping to a real IdP later means adding a provider, not changing this file.
|
|
[Unit]
|
|
Description=vibe-kanban remote-server
|
|
After=network-online.target vibe-kanban-db.service
|
|
Wants=network-online.target
|
|
Requires=vibe-kanban-db.service
|
|
|
|
[Container]
|
|
Image=git.lair.cafe/lair/vibe-kanban-remote:0.1.44-ge06652a
|
|
ContainerName=vibe-kanban
|
|
Network=vibe-kanban.network
|
|
PublishPort=27180:8081
|
|
EnvironmentFile=/etc/vibe-kanban/env
|
|
Environment=SERVER_LISTEN_ADDR=0.0.0.0:8081
|
|
Environment=ELECTRIC_URL=http://vibe-kanban-electric:3000
|
|
Environment=SERVER_PUBLIC_BASE_URL=https://kanban.internal
|
|
Environment=RUST_LOG=info,remote=info
|
|
Notify=healthy
|
|
HealthCmd=wget --spider -q http://127.0.0.1:8081/v1/health
|
|
HealthInterval=10s
|
|
HealthTimeout=5s
|
|
HealthRetries=12
|
|
HealthStartPeriod=20s
|
|
|
|
[Service]
|
|
Restart=always
|
|
TimeoutStartSec=300
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|