Frank
d2810ab610
Closing the command-center security queue #70/#71/#72/#73/#74: rolling tags let a rebuild move under a running service with nobody approving it, and make a CVE audit ungradeable. 36 quadlet units across dankclaw, dankserver and frankbook-pro now carry tag@sha256; localhost/* builds stay exempt (their build is the pin). The pihole and copyparty pins pull the fixed builds; valkey 9.1.2 (already running) and redis 7.4.11 are pinned in place, vendor fixes TBD. New gate tests/quadlet_image_pins.bats: no unpinned registry image, no generator-rejected key anywhere. Three seams that pinned the old exact-tag law (frankbook readarr, open_webui, seerr) now require tag AND digest - strictly stronger. Quadlet Lifecycle docs: batch-abort law, entrypoint flags-only law, pin law.
44 lines
1.5 KiB
INI
44 lines
1.5 KiB
INI
# Quadlet unit: Calibre-Web library server (rootless, boot-persistent).
|
|
#
|
|
# Install path on dankserver:
|
|
# ~/.config/containers/systemd/calibre-web.container
|
|
# Unit name: calibre-web.service (podman 5.x drops the container- prefix)
|
|
#
|
|
# The data roots already lived under /home/dank/Containers/calibre-web in the
|
|
# compose era; this unit keeps those exact paths. The image pin is the exact
|
|
# tag of the image the live container runs (image id 986277563e76), so the
|
|
# cutover recreation changes zero bits of application code. No secrets: this
|
|
# unit takes no EnvironmentFile.
|
|
|
|
[Unit]
|
|
Description=Calibre-Web library server container
|
|
After=network.target
|
|
|
|
[Container]
|
|
ContainerName=calibre-web
|
|
Image=lscr.io/linuxserver/calibre-web:0.6.27-ls402@sha256:802729966faed5e32d671cd4f92ba6196e9e754a6c0f740ce1ee9acd86b10e55
|
|
Network=pasta
|
|
Environment=DOCKER_MODS=linuxserver/mods:universal-calibre
|
|
Environment=LANG=en_US.UTF-8
|
|
Environment=LANGUAGE=en_US.UTF-8
|
|
Environment=LSIO_FIRST_PARTY=true
|
|
Environment=OAUTHLIB_RELAX_TOKEN_SCOPE=1
|
|
Environment=PGID=1000
|
|
Environment=PUID=1000
|
|
Environment=QTWEBENGINE_CHROMIUM_FLAGS=--no-sandbox
|
|
Environment=S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
|
|
Environment=S6_STAGE2_HOOK=/docker-mods
|
|
Environment=TERM=xterm
|
|
Environment=TZ=America/Vancouver
|
|
Environment=VIRTUAL_ENV=/lsiopy
|
|
PublishPort=8083:8083
|
|
Volume=/home/dank/Containers/calibre-web/config:/config
|
|
Volume=/home/dank/Containers/calibre-web/books:/books
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|