Update HTTPS port configuration and add cloudflared setup in Docker Compose

.docker-build.env

@@ -1,4 +1,4 @@
 NUITKA_BUILD=0
 INVENTAR_HTTP_PORT=80
-INVENTAR_HTTPS_PORT=443
+INVENTAR_HTTPS_PORT=8000
 INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:latest

config.json

@@ -1,9 +1,9 @@
 {
     "dbg": false,
     "key": "InventarsystemSecureKey2026XYZ789abcdef012",
-    "ver": "0.0.2",
+    "ver": "0.6.44",
     "host": "0.0.0.0",
-    "port": 443,
+    "port": 8000,
 
     "mongodb": {
         "host": "localhost",

config.yml

@@ -0,0 +1,13 @@
+tunnel: homeserver
+credentials-file: /etc/cloudflared/credentials.json
+
+ingress:
+  # Repo 1: Inventar
+  - hostname: inventar.maximiliangruendinger.de
+    service: http://inventory-app:3000
+
+  # Repo 2: Key-Service (Buchung)
+  - hostname: booking.maximiliangruendinger.de
+    service: http://key-service-app:8080 
+
+  - service: http_status:404

docker-compose-multitenant.yml

@@ -48,7 +48,7 @@ services:
         condition: service_started
     ports:
       - "${INVENTAR_HTTP_PORT:-80}:80"
-      - "${INVENTAR_HTTPS_PORT:-443}:443"
+      - "${INVENTAR_HTTPS_PORT:-8000}:8000"
     volumes:
       - ./docker/nginx/multitenant.conf:/etc/nginx/conf.d/default.conf:ro
       - ./certs:/etc/nginx/certs:ro
@@ -85,7 +85,6 @@ services:
     image: mongo:7.0
     container_name: inventarsystem-mongodb
     restart: unless-stopped
-    command: mongod --wiredTigerCacheSizeGB 2
     expose:
       - "27017"
     volumes:

docker-compose.yml

@@ -1,102 +1,41 @@
+version: "3.8"
+
 services:
+  app:
+    build: .
+    container_name: inventory-app
+    restart: unless-stopped
+    environment:
+      - MONGO_URL=mongodb://mongodb:27017/inventar
+      - REDIS_URL=redis://redis:6379
+      - BASE_URL=https://inventar.maximiliangruendinger.de #alle öffentliche subdomains
+    depends_on:
+      - mongodb
+      - redis
+
+  mongodb:
+    image: mongo:latest
+    container_name: mongodb
+    restart: unless-stopped
+    volumes:
+      - mongo_data:/data/db
+
+  redis:
+    image: redis:alpine
+    container_name: redis
+    restart: unless-stopped
+
   cloudflared:
     image: cloudflare/cloudflared:latest
     container_name: cloudflared
     restart: unless-stopped
-    profiles:
-      - cloudflare
-    command: ["--config", "/etc/cloudflared/config.yml", "tunnel", "run"]
+    # Der Tunnel-Name 'homeserver' muss zu deiner credentials.json passen
+    command: tunnel run homeserver
     volumes:
-      - ./docker/cloudflared/config.yml:/etc/cloudflared/config.yml:ro
-      - /etc/cloudflared/credentials.json:/etc/cloudflared/credentials.json:ro
+      - ./config.yml:/etc/cloudflared/config.yml
+      - ./credentials.json:/etc/cloudflared/credentials.json
     depends_on:
-      nginx:
-        condition: service_started
-
-  nginx:
-    image: nginx:1.27-alpine
-    container_name: inventarsystem-nginx
-    restart: unless-stopped
-    depends_on:
-      app:
-        condition: service_started
-    ports:
-      - "${INVENTAR_HTTP_PORT:-80}:80"
-      - "${INVENTAR_HTTPS_PORT:-443}:443"
-    volumes:
-      - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
-      - ./certs:/etc/nginx/certs:ro
-
-  mongodb:
-    image: mongo:7.0
-    container_name: inventarsystem-mongodb
-    restart: unless-stopped
-    volumes:
-      - mongodb_data:/data/db
-    healthcheck:
-      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-
-  redis:
-    image: redis:7-alpine
-    container_name: inventarsystem-redis
-    restart: unless-stopped
-    command: ["redis-server", "--appendonly", "yes", "--save", "60", "1000"]
-    volumes:
-      - redis_data:/data
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 10s
-      timeout: 3s
-      retries: 10
-
-  app:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    working_dir: /app/Web
-    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "30", "--graceful-timeout", "20", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
-    container_name: inventarsystem-app
-    restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
-    depends_on:
-      mongodb:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    environment:
-      INVENTAR_MONGODB_HOST: mongodb
-      INVENTAR_MONGODB_PORT: "27017"
-      INVENTAR_MONGODB_DB: Inventarsystem
-      INVENTAR_REDIS_HOST: redis
-      INVENTAR_REDIS_PORT: "6379"
-      INVENTAR_REDIS_CACHE_DB: "1"
-      INVENTAR_NOTIFICATION_STATUS_CACHE_TTL: "8"
-      INVENTAR_BACKUP_FOLDER: /data/backups
-      INVENTAR_LOGS_FOLDER: /data/logs
-      INVENTAR_DELETED_ARCHIVE_FOLDER: /data/deleted-archives
-    expose:
-      - "8000"
-    volumes:
-      - ./config.json:/app/config.json:ro
-      - app_uploads:/app/Web/uploads
-      - app_thumbnails:/app/Web/thumbnails
-      - app_previews:/app/Web/previews
-      - app_qrcodes:/app/Web/QRCodes
-      - app_backups:/data/backups
-      - app_logs:/data/logs
-      - app_deleted_archives:/data/deleted-archives
+      - app
 
 volumes:
-  mongodb_data:
-  app_uploads:
-  app_thumbnails:
-  app_previews:
-  app_qrcodes:
-  app_backups:
-  app_logs:
-  app_deleted_archives:
-  redis_data:
+  mongo_data:

restart.sh

@@ -1,4 +1,11 @@
 #!/bin/bash
+
+# Nur die App neu bauen und starten, ohne den Tunnel oder die DB zu killen
+docker compose up -d --build app
+
+# Optional: Alles aufräumen, was nicht mehr gebraucht wird
+docker image prune -f
+
 set -euo pipefail
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"

start.sh

@@ -21,6 +21,7 @@ CRON_SETUP_VALUE="${INVENTAR_SETUP_CRON:-1}"
 APP_IMAGE_VALUE="${INVENTAR_APP_IMAGE:-$APP_IMAGE_REPO:latest}"
 COMPOSE_FILE="docker-compose-multitenant.yml"
 COMPOSE_PROFILES_VALUE=""
+MIN_DOCKER_FREE_MB="${INVENTAR_MIN_DOCKER_FREE_MB:-1024}"
 
 usage() {
     cat <<EOF
@@ -562,6 +563,37 @@ configure_host_ports() {
     fi
 }
 
+ensure_min_docker_disk_space() {
+    local docker_root available_kb available_mb
+
+    if ! command -v df >/dev/null 2>&1; then
+        return 0
+    fi
+
+    docker_root="$(docker info --format '{{.DockerRootDir}}' 2>/dev/null || true)"
+    if [ -z "$docker_root" ]; then
+        docker_root="/var/lib/docker"
+    fi
+
+    if [ ! -d "$docker_root" ]; then
+        return 0
+    fi
+
+    available_kb="$(df -Pk "$docker_root" 2>/dev/null | awk 'NR==2 {print $4}' || true)"
+    if [ -z "$available_kb" ]; then
+        return 0
+    fi
+
+    available_mb=$((available_kb / 1024))
+
+    if [ "$available_mb" -lt "$MIN_DOCKER_FREE_MB" ]; then
+        echo "Error: low disk space in Docker data root ($docker_root)."
+        echo "Available: ${available_mb} MB; required minimum: ${MIN_DOCKER_FREE_MB} MB"
+        echo "MongoDB may fail with 'No space left on device'. Free space and retry."
+        exit 1
+    fi
+}
+
 write_env_file() {
     cat > "$ENV_FILE" <<EOF
 NUITKA_BUILD=$NUITKA_BUILD_VALUE
@@ -640,6 +672,7 @@ configure_nuitka_mode
 resolve_app_image
 configure_cloudflared_profile
 configure_host_ports
+ensure_min_docker_disk_space
 ensure_app_image_loaded
 write_env_file
 write_runtime_compose_override

update.sh

@@ -16,6 +16,8 @@ ENV_FILE="$PROJECT_DIR/.docker-build.env"
 APP_IMAGE_REPO="ghcr.io/aiirondev/legendary-octo-garbanzo"
 DIST_DIR="$PROJECT_DIR/dist"
 COMPOSE_FILE="docker-compose-multitenant.yml"
+MIN_ROOT_FREE_MB="${INVENTAR_MIN_ROOT_FREE_MB:-2048}"
+DIST_KEEP_COUNT="${INVENTAR_DIST_KEEP_COUNT:-2}"
 
 mkdir -p "$LOG_DIR"
 chmod 777 "$LOG_DIR" 2>/dev/null || true
@@ -119,6 +121,65 @@ server {
     return 301 https://$host$request_uri;
 }
 
+ensure_min_root_disk_space() {
+    local available_kb available_mb
+
+    if ! command -v df >/dev/null 2>&1; then
+        return 0
+    fi
+
+    available_kb="$(df -Pk "$PROJECT_DIR" 2>/dev/null | awk 'NR==2 {print $4}' || true)"
+    if [ -z "$available_kb" ]; then
+        return 0
+    fi
+
+    available_mb=$((available_kb / 1024))
+    if [ "$available_mb" -lt "$MIN_ROOT_FREE_MB" ]; then
+        log_message "ERROR: Low disk space on filesystem containing $PROJECT_DIR"
+        log_message "Available: ${available_mb} MB; required minimum: ${MIN_ROOT_FREE_MB} MB"
+        log_message "Free disk space and rerun update."
+        exit 1
+    fi
+}
+
+cleanup_old_dist_artifacts() {
+    local keep_count
+    keep_count="$DIST_KEEP_COUNT"
+
+    if [ ! -d "$DIST_DIR" ]; then
+        return 0
+    fi
+
+    if ! [[ "$keep_count" =~ ^[0-9]+$ ]]; then
+        keep_count=2
+    fi
+
+    mapfile -t archives < <(find "$DIST_DIR" -maxdepth 1 -type f \( -name 'inventarsystem-image-*.tar.gz' -o -name 'inventarsystem-image-*.tar' \) -printf '%T@ %p\n' | sort -nr | awk '{print $2}')
+    if [ "${#archives[@]}" -le "$keep_count" ]; then
+        return 0
+    fi
+
+    local index old_archive deleted=0
+    for (( index=keep_count; index<${#archives[@]}; index++ )); do
+        old_archive="${archives[$index]}"
+        if rm -f "$old_archive"; then
+            deleted=$((deleted + 1))
+        fi
+    done
+
+    if [ "$deleted" -gt 0 ]; then
+        log_message "Cleaned up $deleted old dist image archive(s)"
+    fi
+}
+
+cleanup_docker_dangling_images() {
+    if docker image prune -f >> "$LOG_FILE" 2>&1; then
+        log_message "Cleaned up dangling Docker images"
+    else
+        log_message "WARNING: Could not prune dangling Docker images"
+    fi
+}
+
 server {
     listen 443 ssl;
     server_name _;
@@ -472,6 +533,7 @@ main() {
     require_cmd docker
     require_cmd python3
 
+    ensure_min_root_disk_space
     archive_logs
     create_backup
 
@@ -559,6 +621,8 @@ main() {
     fi
 
     echo "$latest_tag" > "$STATE_FILE"
+    cleanup_old_dist_artifacts
+    cleanup_docker_dangling_images
     log_message "Update completed successfully to release $latest_tag"
 }