schmidt.florian
e23df37a3f
ci / build-test (push) Successful in 1m12s
Reference-only secrets (SDD §6.4) meant adding a connector required editing a file on the server and restarting the service. In practice that leads to the token being pasted into the env-var *name* field, which fails with "environment variable '<token>' is not set" and gives no hint what went wrong. Add a second storage form, chosen per connector: type the secret in and it is encrypted via ASP.NET Core data protection before it is stored. The env-var reference stays as an equal alternative — this widens the choice rather than replacing it. Exactly one form survives a save, so a stale secret cannot linger and silently win; EndpointSecret.Resolve is the single resolution path. The guarantee that matters is preserved: no plaintext in the database, so pg_dump and JSON exports carry nothing usable. The trust boundary is stated plainly in §6.4 — the key ring is on disk, so this protects against leaked database content, not an attacker who already has the host, which is the same boundary an env var has. Details worth noting: - Key ring defaults to /var/lib/metervault/keys, outside the app directory, because the LXC updater republishes /opt/metervault on every update. Docker gets a named volume. Overridable via MeterVault__DataProtectionKeyPath. - Undecryptable ciphertext (key ring lost) falls back rather than throwing: an ingestion worker on a timer should degrade, not crash. - The stored secret is never sent to the browser; a blank field means "unchanged", not "cleared". - MQTT usernames are stored as-is — §6.4 covers tokens and passwords, and encrypting a username would only blank the field on every edit. - ExportService drops *_enc values: bound to the originating key ring, so useless where an export would be restored. Expect to re-enter after a restore. - HaConnectionTester now takes a resolved token, so the admin UI can test a token that has been typed but not yet saved. SDD §6.4 and §9 updated to describe both forms rather than contradict the code. Claude-Session: https://claude.ai/code/session_01V6joyergfvVLFEizH1hJLd
60 lines
2.2 KiB
YAML
60 lines
2.2 KiB
YAML
# MeterVault self-host stack: the Blazor app + TimescaleDB.
|
|
# docker compose -f deploy/docker-compose.yml up -d
|
|
# Secrets are supplied via environment variables (Section__Key double-underscore mapping)
|
|
# with ${VAR:-default} fallbacks — never baked into the image.
|
|
|
|
services:
|
|
db:
|
|
image: timescale/timescaledb:2.17.2-pg16
|
|
environment:
|
|
POSTGRES_DB: metervault
|
|
POSTGRES_USER: metervault
|
|
POSTGRES_PASSWORD: ${METERVAULT_DB_PASSWORD:-metervault}
|
|
volumes:
|
|
- metervault_db:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U metervault -d metervault"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 10
|
|
restart: unless-stopped
|
|
|
|
app:
|
|
build:
|
|
context: ..
|
|
dockerfile: deploy/Dockerfile
|
|
image: ${METERVAULT_IMAGE:-metervault/metervault:local}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
environment:
|
|
ConnectionStrings__Default: "Host=db;Port=5432;Database=metervault;Username=metervault;Password=${METERVAULT_DB_PASSWORD:-metervault}"
|
|
ASPNETCORE_ENVIRONMENT: Production
|
|
MeterVault__TimeZone: ${METERVAULT_TIMEZONE:-Europe/Berlin}
|
|
MeterVault__Currency: ${METERVAULT_CURRENCY:-EUR}
|
|
MeterVault__Locale: ${METERVAULT_LOCALE:-en}
|
|
# Set true for a populated demo: loads the bundled Energiebilanz dataset on first start
|
|
# (idempotent). Leave false for a clean instance.
|
|
MeterVault__SeedReferenceData: ${METERVAULT_SEED:-false}
|
|
# Key ring for connector secrets typed into the admin UI. On the named volume below so it
|
|
# survives image updates — lose it and every stored token must be re-entered.
|
|
MeterVault__DataProtectionKeyPath: /var/lib/metervault/keys
|
|
# REST API is closed by default. Set a key to enable it (or AllowAnonymousApi on a trusted LAN):
|
|
# MeterVault__ApiKeys__0: your-secret-key
|
|
# MeterVault__AllowAnonymousApi: "true"
|
|
volumes:
|
|
- metervault_keys:/var/lib/metervault/keys
|
|
ports:
|
|
- "${METERVAULT_PORT:-8760}:8760"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -fsS http://localhost:8760/healthz || exit 1"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
metervault_db:
|
|
metervault_keys:
|