Alexandre
cdc913bdf8
- docker-compose.truenas.yml : image registry + pull_policy always + volumes bindes sur /mnt/appdata/mkv2avi et /mnt/pool-r440/data/films, ports 8091/8090 - workflow : docker-compose.truenas.yml ajoute aux assets de la release Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
121 lines
4.6 KiB
YAML
121 lines
4.6 KiB
YAML
# Déploiement en App Custom TrueNAS "mkv2avi" — inspiré du déploiement Hooplab :
|
|
# image tirée du registry, `pull_policy: always` (pour que `app.redeploy` récupère
|
|
# la nouvelle image), volumes bindés sur le pool ZFS `appdata`.
|
|
#
|
|
# ── À FAIRE UNE FOIS, en SSH sur le NAS, AVANT de créer l'app ───────────────────
|
|
# mkdir -p /mnt/appdata/mkv2avi/kc-db \
|
|
# /mnt/appdata/mkv2avi/output \
|
|
# /mnt/appdata/mkv2avi/keycloak
|
|
# # copier le realm Keycloak (depuis une copie locale du repo) :
|
|
# # scp keycloak/realm-mkv2avi.json truenas_admin@192.168.1.200:/tmp/
|
|
# # sudo mv /tmp/realm-mkv2avi.json /mnt/appdata/mkv2avi/keycloak/
|
|
#
|
|
# ── PUIS ────────────────────────────────────────────────────────────────────────
|
|
# TrueNAS > Apps > Discover Apps > Custom App > "Install via YAML"
|
|
# Nom de l'app : mkv2avi (indispensable : c'est ce nom que cible le redeploy CI)
|
|
# Coller ce fichier, remplacer tous les « REMPLACE_MOI_* », puis Installer.
|
|
#
|
|
# ── NGINX PROXY MANAGER ──────────────────────────────────────────────────────────
|
|
# auth.mkv2avi.maisongrondin.fr -> http://<IP_HOTE>:8091 (le 8080 est déjà pris)
|
|
# mkv2avi.maisongrondin.fr -> http://<IP_HOTE>:8090
|
|
# (SSL Let's Encrypt + Force SSL + Websockets sur les deux)
|
|
|
|
name: mkv2avi
|
|
|
|
services:
|
|
db:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_DB: keycloak
|
|
POSTGRES_USER: keycloak
|
|
POSTGRES_PASSWORD: REMPLACE_MOI_DB_PASSWORD
|
|
volumes:
|
|
- kc-db:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U keycloak -d keycloak"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 12
|
|
restart: unless-stopped
|
|
|
|
keycloak:
|
|
image: quay.io/keycloak/keycloak:26.0
|
|
command: ["start", "--import-realm"]
|
|
environment:
|
|
KC_DB: postgres
|
|
KC_DB_URL: jdbc:postgresql://db:5432/keycloak
|
|
KC_DB_USERNAME: keycloak
|
|
KC_DB_PASSWORD: REMPLACE_MOI_DB_PASSWORD # identique au POSTGRES_PASSWORD ci-dessus
|
|
KC_BOOTSTRAP_ADMIN_USERNAME: admin
|
|
KC_BOOTSTRAP_ADMIN_PASSWORD: REMPLACE_MOI_KC_ADMIN_PASSWORD
|
|
KC_HOSTNAME: https://auth.mkv2avi.maisongrondin.fr
|
|
KC_HTTP_ENABLED: "true"
|
|
KC_PROXY_HEADERS: xforwarded
|
|
KC_HEALTH_ENABLED: "true"
|
|
volumes:
|
|
# Le realm-mkv2avi.json déposé dans ce dossier est importé au démarrage.
|
|
- keycloak-import:/opt/keycloak/data/import:ro
|
|
ports:
|
|
- "8091:8080"
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && cat <&3 | grep -q '200 OK'"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 30
|
|
start_period: 60s
|
|
restart: unless-stopped
|
|
|
|
mkv2avi:
|
|
image: registry.maisongrondin.fr/alexandre/mkv2avi:latest
|
|
pull_policy: always # app.redeploy tire la dernière image
|
|
environment:
|
|
MAX_WORKERS: "1"
|
|
OIDC_ISSUER: https://auth.mkv2avi.maisongrondin.fr/realms/mkv2avi
|
|
OIDC_CLIENT_ID: mkv2avi
|
|
# DOIT être identique au champ "secret" du client "mkv2avi" dans realm-mkv2avi.json
|
|
# (défaut du repo = "mkv2avi-secret-change-me" → change-le des DEUX côtés).
|
|
OIDC_CLIENT_SECRET: REMPLACE_MOI_OIDC_CLIENT_SECRET
|
|
OIDC_REDIRECT_URI: https://mkv2avi.maisongrondin.fr/auth/callback
|
|
OIDC_POST_LOGOUT_REDIRECT_URI: https://mkv2avi.maisongrondin.fr/
|
|
SESSION_SECRET: REMPLACE_MOI_SESSION_SECRET # ex: openssl rand -hex 32
|
|
SESSION_HTTPS_ONLY: "true"
|
|
volumes:
|
|
- media:/media:ro
|
|
- output:/output
|
|
ports:
|
|
- "8090:8000"
|
|
depends_on:
|
|
keycloak:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
|
|
# Volumes bindés sur les pools ZFS (pattern Hooplab).
|
|
volumes:
|
|
kc-db:
|
|
driver: local
|
|
driver_opts:
|
|
device: /mnt/appdata/mkv2avi/kc-db
|
|
o: bind
|
|
type: none
|
|
output:
|
|
driver: local
|
|
driver_opts:
|
|
device: /mnt/appdata/mkv2avi/output
|
|
o: bind
|
|
type: none
|
|
keycloak-import:
|
|
driver: local
|
|
driver_opts:
|
|
device: /mnt/appdata/mkv2avi/keycloak
|
|
o: bind
|
|
type: none
|
|
media: # bibliothèque films (lecture seule) — adapte si besoin
|
|
driver: local
|
|
driver_opts:
|
|
device: /mnt/pool-r440/data/films
|
|
o: bind
|
|
type: none
|