mirror of
https://github.com/Ar9av/obsidian-wiki.git
synced 2026-09-14 20:36:34 +08:00
Arnav
3e9e6abeae
main() bound 0.0.0.0 unconditionally. That was defensible while the server was an API for remote agents; now that /ui serves a browser console over the whole vault, a bare `python -m obsidian_wiki.server` on a box with a public address exposes it to the internet. Default to 127.0.0.1 and read WIKI_HOST to override. A container has to listen on every interface, so the Dockerfile now sets WIKI_HOST=0.0.0.0 explicitly — `docker run -p 8080:8080` behaves exactly as before. Closes the loopback-by-default point raised in #208.
29 lines
1.2 KiB
Docker
29 lines
1.2 KiB
Docker
# Memory service: one container, one vault on a mounted volume.
|
|
# Build: docker build -t obsidian-wiki .
|
|
# Run: docker run -p 8080:8080 -e WIKI_API_KEY=... -v wiki-data:/vault obsidian-wiki
|
|
FROM python:3.12-slim
|
|
|
|
# git: obsidian_wiki/sync.py shells out to it for vault backup.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends git \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /src
|
|
COPY . .
|
|
# .git is excluded from the build context, so hatch-vcs cannot read the tag.
|
|
# CI passes the real one: docker build --build-arg VERSION=2026.8.1
|
|
ARG VERSION=0.0.0
|
|
ENV HATCH_VCS_PRETEND_VERSION=$VERSION SETUPTOOLS_SCM_PRETEND_VERSION=$VERSION
|
|
RUN pip install --no-cache-dir '.[server]'
|
|
|
|
RUN useradd --create-home wiki && mkdir -p /vault && chown wiki:wiki /vault
|
|
USER wiki
|
|
|
|
# WIKI_HOST is loopback by default; a container must listen on every interface.
|
|
ENV OBSIDIAN_VAULT_PATH=/vault WIKI_PORT=8080 WIKI_HOST=0.0.0.0
|
|
VOLUME /vault
|
|
EXPOSE 8080
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
|
|
CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8080/health').status==200 else 1)"
|
|
|
|
CMD ["python", "-m", "obsidian_wiki.server"]
|