andrew
a9e1263b01
The app owns every input to a playlist's sldl .conf (playlists in its DB, credentials in its encrypted store), so the old DB -> playlists.json -> regen.sh subprocess -> regex credential patch-back chain was three serialization hops for no reason. Collapse it: - credential_service.render_playlist_confs(db) renders each <playlist>.conf from _template.conf in one pass: path placeholders substituted as literal text, then the four credential lines set, written 0600. This is now the single source of .conf rendering. - playlist_service loses _write_playlists_json and regenerate_confs; _sync_to_disk just calls render_playlist_confs and syncs the scheduler. No subprocess, no intermediate JSON file. - render_scope for spotify/soulseek re-renders confs via the same function (spotify still also writes _spotify.env for the python scripts). The dead _patch_conf_field / _every_playlist_conf helpers are removed. - Delete pipeline/configs/regen.sh and drop it from the Dockerfile chmod; update _template.conf's comments. Nothing outside playlist_service consumed regen.sh or playlists.json (verified). Also closes the last remnants of the S2/S3 injection surface: names are re-validated and path/credential values are substituted as literals, never through sed or a shell. Verified: end-to-end render in a throwaway DB (paths, creds incl. a password with shell metacharacters, 0600, bad-name rejection) and a live re-render of all 17 playlist configs with credentials preserved. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
63 lines
1.9 KiB
Docker
63 lines
1.9 KiB
Docker
# python:3.12-slim-bookworm (glibc, not Alpine): numpy/beets/mutagen need
|
|
# manylinux wheels — Alpine's musl libc forces a from-source numpy build and
|
|
# is a known source of breakage for this exact stack.
|
|
FROM python:3.12-slim-bookworm AS builder
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN python -m venv /opt/venv
|
|
ENV PATH="/opt/venv/bin:$PATH"
|
|
|
|
COPY requirements.txt /tmp/requirements.txt
|
|
RUN pip install --no-cache-dir -r /tmp/requirements.txt
|
|
|
|
|
|
FROM python:3.12-slim-bookworm AS runtime
|
|
|
|
# libicu72: sldl (.NET self-contained publish) runtime dependency.
|
|
# ffmpeg: convert-m4a.sh. libchromaprint-tools: fpcalc for fingerprinting.
|
|
# gawk: dedup-library.sh's Pass 2-4 use gensub() and POSIX bracket classes
|
|
# that plain mawk (Debian's default /usr/bin/awk) doesn't support -- it
|
|
# silently threw "syntax error" on every run, so Pass 2-4 dedup detection
|
|
# has been a no-op in every deployed image so far. Scripts now invoke
|
|
# `gawk` explicitly rather than relying on the `awk` alternative.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libicu72 \
|
|
ca-certificates \
|
|
ffmpeg \
|
|
libchromaprint-tools \
|
|
flac \
|
|
id3v2 \
|
|
curl \
|
|
gawk \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=builder /opt/venv /opt/venv
|
|
ENV PATH="/opt/venv/bin:$PATH"
|
|
|
|
RUN groupadd -g 1000 alembic && \
|
|
useradd -u 1000 -g 1000 -m -s /usr/sbin/nologin alembic
|
|
|
|
WORKDIR /app
|
|
|
|
COPY app/ /app/app/
|
|
COPY pipeline/ /app/pipeline/
|
|
COPY schema/ /app/schema/
|
|
COPY entrypoint.sh /app/entrypoint.sh
|
|
|
|
RUN chmod +x /app/entrypoint.sh /app/pipeline/sldl /app/pipeline/bin/*.sh /app/pipeline/lib/*.sh /app/pipeline/lib/manual/* && \
|
|
chown -R alembic:alembic /app
|
|
|
|
USER alembic
|
|
|
|
ENV ALEMBIC_CONFIG_DIR=/config \
|
|
MUSIC_DATA_DIR=/data/music \
|
|
PIPELINE_DIR=/app/pipeline \
|
|
ALEMBIC_PORT=8420
|
|
|
|
EXPOSE 8420
|
|
|
|
ENTRYPOINT ["/app/entrypoint.sh"]
|