Frank
a14a70a404
The cutover unit joined dankserver_appnet but dropped the compose-era 0.0.0.0:3923 mapping (live inspect: bridge, 3923 published), so copyparty listened inside the netns while the host refused. New seam asserts every host-facing port matches the pre-cutover PortBindings: romm 8085->8080, jellyfin 8096, calibre-web 8083, copyparty 3923.
39 lines
1.4 KiB
INI
39 lines
1.4 KiB
INI
# Quadlet unit: Copyparty file server (rootless, boot-persistent).
|
|
#
|
|
# Install path on dankserver: ~/.config/containers/systemd/copyparty.container
|
|
# Unit name: copyparty.service (podman 5.x drops the container- prefix)
|
|
#
|
|
# The image's default entrypoint is /bin/ash /z/cpp.sh -c /z/initcfg; the
|
|
# Command= line below reproduces the compose-era argv exactly: the admin
|
|
# account is passed as -a <user>:<password>. ${COPAY_ACCOUNT} and
|
|
# ${COPAY_PASSWORD} are expanded by systemd at ExecStart time from the
|
|
# host-local env file /home/dank/Containers/copyparty/env (mode 0600).
|
|
# This file holds no secrets. The deployer refuses to start this unit before
|
|
# that env file exists, so a missing env file fails the unit instead of
|
|
# creating an admin account with a garbage password.
|
|
#
|
|
# /w is the entropy volume: copyparty's dank admin account is the only write
|
|
# path into it; every other service mounts the share read-only or not at all.
|
|
|
|
[Unit]
|
|
Description=Copyparty file server container
|
|
After=network.target
|
|
|
|
[Container]
|
|
ContainerName=copyparty
|
|
Image=ghcr.io/9001/copyparty-ac:latest
|
|
Network=dankserver_appnet
|
|
EnvironmentFile=/home/dank/Containers/copyparty/env
|
|
Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} -v /w::r:ra,dank
|
|
Volume=/mnt/entropy:/w
|
|
Volume=/home/dank/Containers/copyparty/cfg:/cfg
|
|
PublishPort=3923:3923
|
|
|
|
[Service]
|
|
EnvironmentFile=/home/dank/Containers/copyparty/env
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|