Import the MetaMesh app family from Worph/AppStore

23 apps (MetaCore, the library/network/client tiers and 13 MetaFeeder*) move out of the general-purpose Worph/AppStore into their own store so the MetaMesh family releases on its own cadence. - asset URLs repointed to cdn.jsdelivr.net/gh/Worph/MetaAppStore@main - store scaffolding added (category/recommend/featured lists, licence, contributing, gitattributes) - psd-source/meta-icons-v2 icon generator follows the apps MetaMCP stays in Worph/AppStore: it is third-party metatool-ai software, not part of MetaMesh.
2026-09-13 16:18:29 +00:00
parent 998eba19f4
commit 39f82e1f96
145 changed files with 12964 additions and 1 deletions
@@ -0,0 +1,238 @@
+name: metafeedersuwayomi
+
+# =============================================================================
+# MetaFeeder · Suwayomi — the comics/manga CHAPTER tier for MetaMesh.
+#
+# Turns a work into actual chapters by searching the operator's Suwayomi, and
+# (since 1.0.3) mints its own work cards for free-text search, so it works on its
+# own. Split out of the former MetaFeeder · Comic app; **MetaFeeder · AniList**
+# is the optional identity tier beside it.
+#
+# ⚠ **Needs meta-gateway ≥ 1.0.28** — chapters arrive unresolved and their page
+# list follows as an EnrichPatch, which an older gateway drops.
+#
+# ⚠ **Suwayomi itself is a SEPARATE app — install it first.** This feeder ships
+# pointed at `suwayomi:4567`, the container the **Suwayomi** store app publishes
+# on the shared `pcs` network.
+#
+# ⚠ **Querying Suwayomi WRITES.** Its search and chapter calls are GraphQL
+# mutations that cache source results into its library database.
+#
+# ⚠ **Suwayomi must be reachable UNAUTHENTICATED.** An undownloaded chapter is a
+# list of per-page URLs pointing at the Suwayomi container, redeemed by the
+# READER's meta-share peer with no credentials. Suwayomi's `simple_login` 401s
+# those routes — a library that lists every chapter and opens none. The Suwayomi
+# store app therefore runs `AUTH_MODE: none` behind an AppShield/OIDC gate.
+#
+# It needs, over the shared `pcs` network:
+#   - the **MetaGateway** app — which must list this feeder's URL
+#     (`http://metafeedersuwayomi-feeder:8080`) in its feeders config so it gets discovered.
+#     Discovery is startup-only, so restart the gateway afterwards.
+#
+# Everything is scoped under the `metafeedersuwayomi-*` prefix + the per-stack `metafeedersuwayomi` network +
+# /DATA/AppData/metafeedersuwayomi/ data root, so it installs beside the other Meta* apps with
+# zero collisions.
+# =============================================================================
+
+services:
+  # ---------------------------------------------------------------------------
+  # metafeedersuwayomi-feeder — the chapter tier. Resolves a work to titles,
+  # searches every installed source, returns the chapters. Chapters are listed
+  # lazily: each chapter's page list is fetched only when a reader opens it.
+  # ---------------------------------------------------------------------------
+  metafeedersuwayomi-feeder:
+    image: ghcr.io/worph/meta-feeder-suwayomi:1.0.4
+    cpu_shares: 30
+    container_name: metafeedersuwayomi-feeder
+    mem_limit: 256m
+    memswap_limit: 256m
+    hostname: metafeedersuwayomi-feeder
+    restart: unless-stopped
+    user: "0:0"
+    expose:
+      - 8080
+    environment:
+      RUST_LOG: "info,meta_feeder=info,suwayomi_feeder=info"
+      META_FEEDER_STATE_DIR: "/data/meta-feeder"
+      # INFRA-ONLY env, and only a FIRST-BOOT SEED: `base_url` is a field on
+      # this feeder's own config page (the dashboard link), and a value saved
+      # there wins. `suwayomi` is the container the Suwayomi store app publishes
+      # on `pcs` — change it only to point at a Suwayomi somewhere else, and see
+      # the reachability warning in the header before you do.
+      SUWAYOMI_URL: "http://suwayomi:4567"
+      # Listing chapters is cheap (one call returns them all); RESOLVING a
+      # chapter's page list is what costs. 0 = fetch nothing until a reader
+      # clicks. Raise it to pre-warm the first N ordinals per work.
+      SUWAYOMI_WARM_CHAPTERS: "0"
+      # ⚠ SUWAYOMI_MAX_CHAPTERS is deliberately NOT set: it bounds how many
+      # chapters are LISTED, and any value can only truncate a long series into
+      # looking short.
+      TZ: "$TZ"
+    volumes:
+      # Persist feeder config.json + redb cache so it survives recreate.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeedersuwayomi/state:/data/meta-feeder:rw
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:8080/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+      start_period: 5s
+    networks:
+      - metafeedersuwayomi
+      - pcs
+
+  # ---------------------------------------------------------------------------
+  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
+  # container_name == subdomain prefix (the auth-registrar derives the client_id
+  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
+  # ---------------------------------------------------------------------------
+  metafeedersuwayomi:
+    image: ghcr.io/yundera/appshield:2.0.9
+    cpu_shares: 80
+    container_name: metafeedersuwayomi
+    hostname: metafeedersuwayomi
+    restart: unless-stopped
+    user: "0:0"
+    expose:
+      - 80
+    environment:
+      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
+      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      BACKEND_HOST: "metafeedersuwayomi-feeder"
+      BACKEND_PORT: "8080"
+      LISTEN_PORT: "80"
+    labels:
+      caddy_0: metafeedersuwayomi-${APP_DOMAIN}
+      caddy_0.import: gateway_tls
+      caddy_0.reverse_proxy: "{{upstreams 80}}"
+      caddy_1: metafeedersuwayomi-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1.import: gateway_tls
+      caddy_1.reverse_proxy: "{{upstreams 80}}"
+      caddy_2: metafeedersuwayomi-${APP_PUBLIC_IP_DASH}.sslip.io
+      caddy_2.reverse_proxy: "{{upstreams 80}}"
+    depends_on:
+      - metafeedersuwayomi-feeder
+    networks:
+      - metafeedersuwayomi
+      - pcs
+
+networks:
+  metafeedersuwayomi:
+    name: metafeedersuwayomi
+    driver: bridge
+  pcs:
+    name: ${APP_NET:-pcs}
+    external: true
+
+x-casaos:
+  architectures:
+    - amd64
+    - arm64
+  author: Worph Team
+  category: Media
+  developer: Aptero Team
+  main: metafeedersuwayomi
+  webui_port: 80
+  index: /config
+
+  description:
+    en_us: |
+      **The comics and manga chapter tier for MetaMesh — what gives MetaRead
+      something to read.**
+
+      MetaFeeder · Suwayomi supplies the *chapters*, from whichever source extensions
+      you installed in the **Suwayomi** app, and mints its own work cards so search
+      works on its own. Add **MetaFeeder · AniList** to name works across sources.
+
+      **Install Suwayomi first.** It is a separate app in this store (with a
+      FlareSolverr sidecar, so Cloudflare-protected sources work). This feeder arrives
+      pointed at it and needs no wiring.
+
+      **You own the sources.** Suwayomi ships exactly one built-in source — *Local
+      source*, which reads CBZ/CBR from its own folder. Everything else is an extension
+      **you** install through the Suwayomi app's own UI. That keeps the scraping and the
+      legal surface outside MetaMesh, exactly as **MetaFeeder · Prowlarr** keeps
+      indexers outside it.
+
+      **Multi-source by design.** Every installed source that carries a work
+      contributes, and each chapter row offers a chooser across them.
+
+      **Lazy by default.** Listing a series' chapters costs one upstream call however
+      long it is; a chapter's page list is fetched only when someone opens it.
+      **Requires:** **MetaGateway** — its meta-core stores the resolved records and
+      announces them to the swarm. The gateway must list this feeder in its config.
+      **Pairs with: MetaRead**, the reading client.
+    fr_fr: |
+      **La couche chapitres BD et manga de MetaMesh — ce qui donne à MetaRead
+      quelque chose à lire.**
+
+      MetaFeeder · Suwayomi fournit les *chapitres*, depuis les extensions de sources
+      installées dans l'app **Suwayomi**, et crée ses propres fiches d'œuvres pour que
+      la recherche fonctionne seule. Ajoutez **MetaFeeder · AniList** pour nommer les
+      œuvres entre sources.
+
+      **Vous possédez les sources.** Suwayomi n'embarque que *Local source* ; tout le
+      reste est une extension que **vous** installez via l'interface Suwayomi.
+
+      **Paresseux par défaut.** Lister les chapitres coûte un appel ; les pages d'un
+      chapitre ne sont récupérées qu'à l'ouverture.
+
+      **Nécessite :** les apps **MetaGateway** et **Suwayomi**. **Va avec : MetaRead.**
+  tagline:
+    en_us: Suwayomi — the comics and manga chapter tier for MetaMesh
+    fr_fr: Suwayomi — la couche chapitres BD et manga de MetaMesh
+
+  title:
+    en_us: MetaFeeder · Suwayomi
+
+  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederSuwayomi/icon.png
+  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederSuwayomi/thumbnail.png
+
+  store_app_id: metafeedersuwayomi
+  is_uncontrolled: false
+
+  tips:
+    before_install:
+      en_us: |
+        **Install order:** **MetaGateway** first, then **Suwayomi** — the separate
+        store app this feeder reads. This app arrives pointed at `suwayomi:4567`; without
+        that app installed it stays healthy and simply finds no chapters.
+
+        **After installing this app:**
+        1. In **MetaGateway**, add this feeder from the dashboard's *Add a feeder* box —
+           name `suwayomi-feeder`, URL `http://metafeedersuwayomi-feeder:8080`. The
+           gateway restarts itself: feeder discovery is **startup-only**.
+        2. Open the **Suwayomi** app and install the source extensions you want, under
+           *Extensions*. Nothing is installed by default.
+        3. Optionally drop `.cbz` / `.cbr` files into
+           `/DATA/AppData/suwayomi/data/local/<Series Name>/` — the built-in *Local
+           source* picks them up with no extension at all.
+        4. Optionally install **MetaFeeder · AniList** so chapters from several sources
+           converge on one work page.
+
+        This app's own dashboard link opens the **feeder's config page** (Suwayomi URL,
+        chapters per work, chapters pre-loaded) — not Suwayomi.
+
+        **⚠ Querying Suwayomi writes to it.** Rows will appear in its library that you
+        did not add by hand. That is inherent to how the aggregator works.
+
+        **Suwayomi's own login must stay off** — the reader fetches chapter pages from it
+        unauthenticated, so enabling it gives a library that lists every chapter and can
+        open none.
+        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+
+# Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
+# schema_version 2 is required for `folders`: an older Maison refuses the app
+# outright rather than starting it without its directories.
+x-compose-app:
+  schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metafeedersuwayomi/state
+      user: $PUID
+      group: $PGID
+  # Same string as the caddy_0 label, so the tile link and the route agree.
+  webui-host: metafeedersuwayomi-${domain}
+  webui-path: "/config"
@@ -0,0 +1,33 @@
+# MetaFeeder · Suwayomi — Rationale
+
+## What deviation / exception is being requested
+
+`metafeedersuwayomi-feeder` runs `user: 0:0`.
+
+## Why it is necessary
+
+Carried over unchanged from the listing this app was split out of (MetaFeeder · Comic), so the
+feeder behaves exactly as it did there. The MetaFeeder images write their state and
+redb cache as the container user and some reach MetaCore's root-owned tree; a uid-1000
+process is refused.
+
+## Security mitigations in place
+
+- Public ingress terminates at the AppShield sidecar (`ghcr.io/yundera/appshield:2.0.9`),
+  which gates every path behind the PCS's Authelia SSO over OIDC. The feeder carries no
+  Caddy labels and publishes no host port, so it is reachable only from the `pcs` Docker
+  network.
+- The container mounts **no user directories** — not `/DATA/Documents`, `/DATA/Downloads`,
+  `/DATA/Media` or `/DATA/Gallery`. Its only bind is its own state under
+  `/DATA/AppData/metafeedersuwayomi/`, declared in `x-compose-app.folders` and owned `$PUID:$PGID`.
+- `cpu_shares` set on every service; image tags pinned; no `:latest`.
+
+## Alternatives considered and rejected
+
+- **Run as `$PUID:$PGID`.** Not validated for this image; switching the runtime user in
+  the same change as the split would mix a behaviour change into a packaging change.
+
+## Data protection
+
+The feeder holds no user media. Its entire state lives under `/DATA/AppData/metafeedersuwayomi/`, which
+is the unit Maison archives on uninstall and restores from backup.