Johnny 5
89eddd2ad0
- Dockerfile: multi-stage build (Node frontend + Python backend) - StartOS manifest, interfaces, backups, version graph - start.sh: auto-generates session secret, creates first approver on boot - Backend serves built frontend as SPA in production - Single data volume for SQLite DB, platform backups cover it
39 lines
1.1 KiB
Bash
39 lines
1.1 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
# Generate session secret if not set or default
|
|
if [ "$TEN31_SESSION_SECRET" = "change-me" ]; then
|
|
if [ -f /data/.session-secret ]; then
|
|
export TEN31_SESSION_SECRET=$(cat /data/.session-secret)
|
|
else
|
|
export TEN31_SESSION_SECRET=$(python3 -c "import secrets; print(secrets.token_hex(32))")
|
|
echo "$TEN31_SESSION_SECRET" > /data/.session-secret
|
|
chmod 600 /data/.session-secret
|
|
fi
|
|
fi
|
|
|
|
# Create first approver on first boot if no users exist
|
|
if [ ! -f /data/.initialized ]; then
|
|
echo "First boot: running migrations and creating default approver..."
|
|
|
|
# Set default credentials (user can change via CLI later)
|
|
ADMIN_NAME="${TEN31_ADMIN_NAME:-Admin}"
|
|
ADMIN_EMAIL="${TEN31_ADMIN_EMAIL:-admin@ten31.com}"
|
|
ADMIN_PASSWORD="${TEN31_ADMIN_PASSWORD:-changeme}"
|
|
|
|
python3 -m ten31portal.cli create-user \
|
|
--name "$ADMIN_NAME" \
|
|
--email "$ADMIN_EMAIL" \
|
|
--role approver \
|
|
--password "$ADMIN_PASSWORD" || true
|
|
|
|
touch /data/.initialized
|
|
echo "Default approver created: $ADMIN_EMAIL"
|
|
fi
|
|
|
|
# Serve frontend static files from the backend
|
|
exec uvicorn ten31portal.main:app \
|
|
--host 0.0.0.0 \
|
|
--port 8000 \
|
|
--log-level info
|