From dfd44a39f0c66d4b5dcc8ff9d59191d44fe83cf3 Mon Sep 17 00:00:00 2001 From: Dinesh Pandiyan Date: Mon, 12 Oct 2026 23:27:31 +1100 Subject: [PATCH] chore: pin compose project and pass server token from .env - Name the compose project diffx so the data volume no longer depends on the checkout directory - Forward DIFFX_SERVER_TOKEN so a git-ignored .env can set the bootstrap credential; empty keeps the generated token - Ignore .env --- .gitignore | 1 + README.md | 7 ++++++- compose.yaml | 5 +++++ docs/development.md | 5 ++++- 4 files changed, 16 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 0b493741..20e3c89c 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ dist/ .agents/ignore/ test-results/ mise.local.toml +.env diff --git a/README.md b/README.md index 412b2e1d..9404994d 100644 --- a/README.md +++ b/README.md @@ -174,8 +174,13 @@ mise run docker:down Compose publishes HTTP on `127.0.0.1:7980`, outside the local 7981–7990 range, and preserves the named SQLite volume when stopped or recreated. Set -`DIFFX_SERVER_PORT=7979` to publish another host port. Retrieve +`DIFFX_SERVER_PORT=7979` to publish another host port. The project is named +`diffx`, so its volume is shared by every checkout. Retrieve the initial credential with `docker compose cp server:/data/state.db.admin-token ./admin-token`. +To choose the credential instead, put `DIFFX_SERVER_TOKEN=…` (at least 32 +characters) in a git-ignored `.env` beside `compose.yaml` before the first start. +It only applies to a new database; a different token for an existing account +fails startup. See [server development](docs/development.md#server-development) for configuration and persistence details. Deploy behind HTTPS when exposing the server remotely. diff --git a/compose.yaml b/compose.yaml index ebab2cb2..ac716af4 100644 --- a/compose.yaml +++ b/compose.yaml @@ -1,3 +1,6 @@ +# A fixed project name keeps the data volume independent of the checkout directory. +name: diffx + services: server: build: . @@ -8,6 +11,8 @@ services: DIFFX_SERVER_STATE: /data/state.db DIFFX_SERVER_ACCOUNT: "${DIFFX_SERVER_ACCOUNT:-admin}" DIFFX_SERVER_RETENTION_DAYS: "${DIFFX_SERVER_RETENTION_DAYS:-7}" + # Bootstrap credential for a new database; empty generates one. + DIFFX_SERVER_TOKEN: "${DIFFX_SERVER_TOKEN:-}" ports: # Only the published host port varies; local `diffx [PATH]` uses 7981-7990. - "127.0.0.1:${DIFFX_SERVER_PORT:-7980}:7980" diff --git a/docs/development.md b/docs/development.md index 1d7ea73a..856646b1 100644 --- a/docs/development.md +++ b/docs/development.md @@ -186,7 +186,10 @@ starting with a fresh database; a volume is not a backup. Set `DIFFX_SERVER_PORT=7979 mise run docker:up` for a different published host port; the container always listens on 7980. Compose also accepts -`DIFFX_SERVER_ACCOUNT` and `DIFFX_SERVER_RETENTION_DAYS` overrides. +`DIFFX_SERVER_ACCOUNT`, `DIFFX_SERVER_RETENTION_DAYS` and `DIFFX_SERVER_TOKEN` +overrides, from the shell or a git-ignored `.env` beside `compose.yaml`. An empty +token keeps the generated credential. The fixed `diffx` project name keeps one +volume regardless of the checkout directory. For other settings, use image env overrides or a Compose override file. Only one server may own a SQLite database; competing starts fail rather than share ownership. SIGTERM stops HTTP and workers before releasing storage;