f680e1d9f6
Five tasks, four delegated to agents on disjoint files and one on the critical
path. Board and verification log: ~/.opencode/plan/vellum-beta-tasks.md
T1 Async scans (coordinator)
- migration 0007 adds ref_id + result to jobs, indexed by (kind, ref_id, id),
so a job can be found by what it operates on and can report back.
- jobs: EnqueueRef, JobID(ctx) so a handler can attach a result, SetResult.
- POST /libraries/{id}/scan now enqueues and returns 202; a real library takes
longer than any request timeout, and a hanging request looks like a broken
server. GET /libraries/{id}/scan/status reports the latest run.
- Libraries.svelte polls and shows "Scanning…" instead of freezing.
T2 Admin CLI (agent)
- internal/cli: `user add|passwd|list`, `backup <path>` via VACUUM INTO, with
tests. Wired into main.go, which the coordinator kept.
T3 Deploy (agent)
- compose.yml now mounts all six media kinds read-only with :z and carries the
metadata env keys. DEPLOY.md covers volumes, SELinux, admin bootstrap, TLS,
backup and upgrade.
T4 Pagination (agent)
- GET /items takes offset and returns total; Browse loads 60 at a time with
"Load more" and "Showing X of Y" instead of silently truncating at 300.
T5 Password change UI (agent)
- A Password section in Settings with validation, busy and success states.
Verified end to end: scan returns 202 in 0.7 ms and polls to done; the CLI
created a user, changed a password, and produced a complete 240 KB backup while
the server ran; pagination reports total 8 and pages correctly; compose parses
with every mount :z. go vet and 14 test packages pass; svelte-check 0/0.
65 lines
2.4 KiB
YAML
65 lines
2.4 KiB
YAML
# Vellum — one container, alongside the existing stack.
|
|
#
|
|
# Volume layout:
|
|
# /data the SQLite database (vellum.db) and persistent state — read/write
|
|
# /config regenerable cache: covers, thumbnails, extracted pages — read/write
|
|
# /media/* the media library, one bind mount per kind, ALL read-only.
|
|
#
|
|
# Vellum never writes to /media. It only ever reads. If a media mount is not
|
|
# read-only, that is a bug in this file, not a feature.
|
|
#
|
|
# Mount flags match the conventions used elsewhere in this stack:
|
|
# :z SELinux relabel (mandatory on this host, getenforce = Enforcing)
|
|
# :ro the media library is read-only; Vellum never writes to it
|
|
#
|
|
# Paths here are the TARGET HOST's (/opt/mediaserver, /mnt/storage). They do
|
|
# not exist on the dev workstation — build locally with the Dockerfile instead.
|
|
|
|
services:
|
|
vellum:
|
|
build:
|
|
context: .
|
|
args:
|
|
VERSION: 0.1.0-dev
|
|
image: localhost/vellum:0.1.0-dev
|
|
container_name: vellum
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2.0'
|
|
memory: 1G
|
|
environment:
|
|
- PUID=1001
|
|
- PGID=1001
|
|
- TZ=America/New_York
|
|
- VELLUM_LISTEN=:7788
|
|
- VELLUM_LOG_LEVEL=info
|
|
# Read-only library roots, colon-separated. Each entry must correspond to
|
|
# one of the read-only mounts below.
|
|
- VELLUM_MEDIA_DIRS=/media/ebooks:/media/comics:/media/audiobooks:/media/music:/media/photos:/media/games
|
|
# Metadata providers (optional; leave blank to disable).
|
|
- VELLUM_IGDB_CLIENT_ID=
|
|
- VELLUM_IGDB_CLIENT_SECRET=
|
|
- VELLUM_COMICVINE_API_KEY=
|
|
# Set to true when serving over TLS behind a reverse proxy.
|
|
- VELLUM_COOKIE_SECURE=false
|
|
volumes:
|
|
- /opt/mediaserver/vellum/data:/data:z
|
|
- /opt/mediaserver/vellum/config:/config:z
|
|
# Media: one read-only mount per kind. The container never writes here.
|
|
- /mnt/storage/media/ebooks:/media/ebooks:ro,z
|
|
- /mnt/storage/media/comics:/media/comics:ro,z
|
|
- /mnt/storage/media/audiobooks:/media/audiobooks:ro,z
|
|
- /mnt/storage/media/music:/media/music:ro,z
|
|
- /mnt/storage/media/photos:/media/photos:ro,z
|
|
- /mnt/storage/media/games:/media/games:ro,z
|
|
ports:
|
|
- 127.0.0.1:7788:7788
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|