From cdc913bdf818bd4ce014e02e438ea475cdd8c5c7 Mon Sep 17 00:00:00 2001 From: grondinalexandre Date: Tue, 7 Jul 2026 00:19:21 +0200 Subject: [PATCH] prod: compose TrueNAS Custom App (pattern Hooplab) + ajout aux assets de release - docker-compose.truenas.yml : image registry + pull_policy always + volumes bindes sur /mnt/appdata/mkv2avi et /mnt/pool-r440/data/films, ports 8091/8090 - workflow : docker-compose.truenas.yml ajoute aux assets de la release Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/release.yml | 2 +- docker-compose.truenas.yml | 120 +++++++++++++++++++++++++++++++++++ 2 files changed, 121 insertions(+), 1 deletion(-) create mode 100644 docker-compose.truenas.yml diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 75fbab6..d357970 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -49,7 +49,7 @@ jobs: -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \ -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":\"$BODY\"}" | jq -r '.id') echo "Release créée (id=$REL_ID)" - for f in docker-compose.prod.yml .env.prod.example; do + for f in docker-compose.truenas.yml docker-compose.prod.yml .env.prod.example; do curl -sSf -X POST "$API/releases/$REL_ID/assets?name=$f" \ -H "Authorization: token $TOKEN" \ -F "attachment=@$f;type=text/plain" >/dev/null diff --git a/docker-compose.truenas.yml b/docker-compose.truenas.yml new file mode 100644 index 0000000..7e3b235 --- /dev/null +++ b/docker-compose.truenas.yml @@ -0,0 +1,120 @@ +# Déploiement en App Custom TrueNAS "mkv2avi" — inspiré du déploiement Hooplab : +# image tirée du registry, `pull_policy: always` (pour que `app.redeploy` récupère +# la nouvelle image), volumes bindés sur le pool ZFS `appdata`. +# +# ── À FAIRE UNE FOIS, en SSH sur le NAS, AVANT de créer l'app ─────────────────── +# mkdir -p /mnt/appdata/mkv2avi/kc-db \ +# /mnt/appdata/mkv2avi/output \ +# /mnt/appdata/mkv2avi/keycloak +# # copier le realm Keycloak (depuis une copie locale du repo) : +# # scp keycloak/realm-mkv2avi.json truenas_admin@192.168.1.200:/tmp/ +# # sudo mv /tmp/realm-mkv2avi.json /mnt/appdata/mkv2avi/keycloak/ +# +# ── PUIS ──────────────────────────────────────────────────────────────────────── +# TrueNAS > Apps > Discover Apps > Custom App > "Install via YAML" +# Nom de l'app : mkv2avi (indispensable : c'est ce nom que cible le redeploy CI) +# Coller ce fichier, remplacer tous les « REMPLACE_MOI_* », puis Installer. +# +# ── NGINX PROXY MANAGER ────────────────────────────────────────────────────────── +# auth.mkv2avi.maisongrondin.fr -> http://:8091 (le 8080 est déjà pris) +# mkv2avi.maisongrondin.fr -> http://:8090 +# (SSL Let's Encrypt + Force SSL + Websockets sur les deux) + +name: mkv2avi + +services: + db: + image: postgres:16-alpine + environment: + POSTGRES_DB: keycloak + POSTGRES_USER: keycloak + POSTGRES_PASSWORD: REMPLACE_MOI_DB_PASSWORD + volumes: + - kc-db:/var/lib/postgresql/data + healthcheck: + test: ["CMD-SHELL", "pg_isready -U keycloak -d keycloak"] + interval: 5s + timeout: 5s + retries: 12 + restart: unless-stopped + + keycloak: + image: quay.io/keycloak/keycloak:26.0 + command: ["start", "--import-realm"] + environment: + KC_DB: postgres + KC_DB_URL: jdbc:postgresql://db:5432/keycloak + KC_DB_USERNAME: keycloak + KC_DB_PASSWORD: REMPLACE_MOI_DB_PASSWORD # identique au POSTGRES_PASSWORD ci-dessus + KC_BOOTSTRAP_ADMIN_USERNAME: admin + KC_BOOTSTRAP_ADMIN_PASSWORD: REMPLACE_MOI_KC_ADMIN_PASSWORD + KC_HOSTNAME: https://auth.mkv2avi.maisongrondin.fr + KC_HTTP_ENABLED: "true" + KC_PROXY_HEADERS: xforwarded + KC_HEALTH_ENABLED: "true" + volumes: + # Le realm-mkv2avi.json déposé dans ce dossier est importé au démarrage. + - keycloak-import:/opt/keycloak/data/import:ro + ports: + - "8091:8080" + depends_on: + db: + condition: service_healthy + healthcheck: + test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && cat <&3 | grep -q '200 OK'"] + interval: 10s + timeout: 5s + retries: 30 + start_period: 60s + restart: unless-stopped + + mkv2avi: + image: registry.maisongrondin.fr/alexandre/mkv2avi:latest + pull_policy: always # app.redeploy tire la dernière image + environment: + MAX_WORKERS: "1" + OIDC_ISSUER: https://auth.mkv2avi.maisongrondin.fr/realms/mkv2avi + OIDC_CLIENT_ID: mkv2avi + # DOIT être identique au champ "secret" du client "mkv2avi" dans realm-mkv2avi.json + # (défaut du repo = "mkv2avi-secret-change-me" → change-le des DEUX côtés). + OIDC_CLIENT_SECRET: REMPLACE_MOI_OIDC_CLIENT_SECRET + OIDC_REDIRECT_URI: https://mkv2avi.maisongrondin.fr/auth/callback + OIDC_POST_LOGOUT_REDIRECT_URI: https://mkv2avi.maisongrondin.fr/ + SESSION_SECRET: REMPLACE_MOI_SESSION_SECRET # ex: openssl rand -hex 32 + SESSION_HTTPS_ONLY: "true" + volumes: + - media:/media:ro + - output:/output + ports: + - "8090:8000" + depends_on: + keycloak: + condition: service_healthy + restart: unless-stopped + +# Volumes bindés sur les pools ZFS (pattern Hooplab). +volumes: + kc-db: + driver: local + driver_opts: + device: /mnt/appdata/mkv2avi/kc-db + o: bind + type: none + output: + driver: local + driver_opts: + device: /mnt/appdata/mkv2avi/output + o: bind + type: none + keycloak-import: + driver: local + driver_opts: + device: /mnt/appdata/mkv2avi/keycloak + o: bind + type: none + media: # bibliothèque films (lecture seule) — adapte si besoin + driver: local + driver_opts: + device: /mnt/pool-r440/data/films + o: bind + type: none