mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-13 11:40:53 +08:00
BaaRai
65bdc5d73c
The server wrote jwt.key to the executable's directory, /app in the image, so it lived in the container's writable layer and every container rebuild generated a new key and signed all users out. - ARTEX_JWT_KEY_DIR selects the key directory (default: config.BaseDir(), unchanged for non-Docker installs). docker-compose.yml sets it to /app/keys and bind-mounts ./keys there; the Dockerfile declares the volume. The key stays out of data/, which the file manager browses. - loadOrCreateJWTKey creates the directory (0700). When keyDir/jwt.key is missing it migrates dataDir/jwt.key, then BaseDir()/jwt.key (mode 0600, old file removed), otherwise generates a new key. An existing key is never overwritten; a short one is now a startup error. - .gitignore and .dockerignore exclude keys/. - README and CHANGELOG updated; the 0.5.0 known issue is removed.
55 lines
2.0 KiB
YAML
55 lines
2.0 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-artex}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Please set POSTGRES_PASSWORD in .env}
|
|
POSTGRES_DB: ${POSTGRES_DB:-artex}
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-artex} -d ${POSTGRES_DB:-artex}"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
restart: unless-stopped
|
|
|
|
artex:
|
|
# Built from this checkout. The previous reference was a third-party
|
|
# namespace whose repository is gone: whoever controls that name could
|
|
# publish the tag this file would pull.
|
|
build:
|
|
context: .
|
|
args:
|
|
ARTEX_VERSION: ${ARTEX_VERSION:-dev}
|
|
image: artex:local
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
ARTEX_PG_DSN: postgres://${POSTGRES_USER:-artex}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-artex}?sslmode=disable
|
|
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
|
|
OPENAI_API_KEY: ${OPENAI_API_KEY:-}
|
|
ARTEX_LLM_PROVIDER: ${ARTEX_LLM_PROVIDER:-}
|
|
ARTEX_LLM_MODEL: ${ARTEX_LLM_MODEL:-}
|
|
ARTEX_LLM_BASE_URL: ${ARTEX_LLM_BASE_URL:-}
|
|
ARTEX_LLM_PROXY: ${ARTEX_LLM_PROXY:-}
|
|
ARTEX_JWT_KEY_DIR: /app/keys
|
|
ports:
|
|
- "${ARTEX_BIND_ADDR:-127.0.0.1}:8787:8787"
|
|
- "127.0.0.1:8788:8788"
|
|
volumes:
|
|
# Bind the data directory (SQLite, task files, etc.) to data/ in the project root,
|
|
# so it is easy to inspect/back up on the host and survives container rebuilds.
|
|
- ./data:/app/data
|
|
# JWT signing key (jwt.key), kept out of data/, which the file manager browses.
|
|
# Persisting it keeps users signed in across container rebuilds.
|
|
- ./keys:/app/keys
|
|
# Mount skills/ from the project root into the container (overriding the image's built-in /app/skills);
|
|
# skill changes require no image rebuild — the container reads the host copy.
|
|
- ./skills:/app/skills
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
pgdata:
|