Tobias Wüst
9d539d0da4
Deploy BookStack with linuxserver.io images behind Traefik, including Entra ID OIDC SSO support and a daily backup timer. Stack: - lscr.io/linuxserver/bookstack:version-v26.03.3 - lscr.io/linuxserver/mariadb:11.4.9 - Traefik labels for websecure entrypoint on internal network - Healthcheck via mariadb-admin ping (LSIO image lacks healthcheck.sh) Features: - Persistent APP_KEY generated on first run, stored in volume dir - Optional OIDC SSO via Microsoft Entra ID (configurable per-instance) - Idempotent admin user creation with DB-based existence check - Daily systemd timer backup (DB dump + uploads tar + APP_KEY) with configurable retention Implementation notes: - DB queries use --protocol=tcp with the app user because root@localhost uses unix_socket auth in the LSIO MariaDB image (no password) and root@% does not exist - docker_container_exec uses argv: (list) instead of command: (string) to avoid argument-splitting issues - Migration-wait task ensures users table exists before admin check, since /login returns 200 before Laravel migrations complete - no_log: true on all tasks that reference DB or admin passwords - artisan absolute path (/app/www/artisan) because LSIO image WORKDIR is not the app directory Adds bookstack route to DMZ Traefik service registry.
71 lines
3.1 KiB
YAML
71 lines
3.1 KiB
YAML
#SPDX-License-Identifier: MIT-0
|
|
### REQUIRED
|
|
# The namespace of the collection. This can be a company/brand/organization or product namespace under which all
|
|
# content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with
|
|
# underscores or numbers and cannot contain consecutive underscores
|
|
namespace: digitalboard
|
|
|
|
# The name of the collection. Has the same character restrictions as 'namespace'
|
|
name: core
|
|
|
|
# The version of the collection. Must be compatible with semantic versioning
|
|
version: 1.0.0
|
|
|
|
# The path to the Markdown (.md) readme file. This path is relative to the root of the collection
|
|
readme: README.md
|
|
|
|
# A list of the collection's content authors. Can be just the name or in the format 'Full Name <email> (url)
|
|
# @nicks:irc/im.site#channel'
|
|
authors:
|
|
- Bert-Jan Fikse <bert-jan@whatwedo.ch>
|
|
- Tobias Wüst <tobias.wuest@wksbern.ch>
|
|
- Simon Bärlocher <simon@whatwedo.ch>
|
|
|
|
### OPTIONAL but strongly recommended
|
|
# A short summary description of the collection
|
|
description: your collection description
|
|
|
|
# Either a single license or a list of licenses for content inside of a collection. Ansible Galaxy currently only
|
|
# accepts L(SPDX,https://spdx.org/licenses/) licenses. This key is mutually exclusive with 'license_file'
|
|
license:
|
|
- GPL-2.0-or-later
|
|
|
|
# The path to the license file for the collection. This path is relative to the root of the collection. This key is
|
|
# mutually exclusive with 'license'
|
|
license_file: ''
|
|
|
|
# A list of tags you want to associate with the collection for indexing/searching. A tag name has the same character
|
|
# requirements as 'namespace' and 'name'
|
|
tags: []
|
|
|
|
# Collections that this collection requires to be installed for it to be usable. The key of the dict is the
|
|
# collection label 'namespace.name'. The value is a version range
|
|
# L(specifiers,https://python-semanticversion.readthedocs.io/en/latest/#requirement-specification). Multiple version
|
|
# range specifiers can be set and are separated by ','
|
|
dependencies: {}
|
|
|
|
# The URL of the originating SCM repository
|
|
repository: https://git.digitalboard.ch/Digitalboard/digitalboard.core
|
|
|
|
# The URL to any online docs
|
|
documentation: http://docs.example.com
|
|
|
|
# The URL to the homepage of the collection/project
|
|
homepage: http://example.com
|
|
|
|
# The URL to the collection issue tracker
|
|
issues: http://example.com/issue/tracker
|
|
|
|
# A list of file glob-like patterns used to filter any files or directories that should not be included in the build
|
|
# artifact. A pattern is matched from the relative path of the file or directory of the collection directory. This
|
|
# uses 'fnmatch' to match the files or directories. Some directories and files like 'galaxy.yml', '*.pyc', '*.retry',
|
|
# and '.git' are always filtered. Mutually exclusive with 'manifest'
|
|
build_ignore: []
|
|
|
|
# A dict controlling use of manifest directives used in building the collection artifact. The key 'directives' is a
|
|
# list of MANIFEST.in style
|
|
# L(directives,https://packaging.python.org/en/latest/guides/using-manifest-in/#manifest-in-commands). The key
|
|
# 'omit_default_directives' is a boolean that controls whether the default directives are used. Mutually exclusive
|
|
# with 'build_ignore'
|
|
# manifest: null
|
|
|