add app for each plugin

2026-09-13 19:47:17 +02:00
parent 39f82e1f96
commit cb067ee50f
84 changed files with 7072 additions and 3 deletions
@@ -0,0 +1,180 @@
+name: metafeedermusicbrainz
+
+# =============================================================================
+# MetaFeeder · MusicBrainz — the MUSIC IDENTITY tier for MetaMesh.
+#
+# MusicBrainz names the *work*: album, artist, release group, cover art (via the
+# Cover Art Archive) and the ids the audio tiers anchor on. Keyless, no config.
+# It serves no audio and must not — pair it with a bytes tier
+# (Internet Archive, Jamendo) or the delegated YouTube tier.
+#
+# ⚠ MusicBrainz publishes a hard 1 request/second ceiling, enforced per source
+# IP — one misbehaving feeder blocks every peer behind the same NAT. The rate
+# limiter is in the image; there is no knob here and there should not be.
+#
+# It needs, over the shared `pcs` network:
+#   - the **MetaGateway** app — which must list this feeder's URL
+#     (`http://metafeedermusicbrainz-feeder:8080`) in its feeders config so it gets discovered.
+#     Discovery is startup-only, so restart the gateway afterwards.
+#
+# Everything is scoped under the `metafeedermusicbrainz-*` prefix + the per-stack `metafeedermusicbrainz` network +
+# /DATA/AppData/metafeedermusicbrainz/ data root, so it installs beside the other Meta* apps with
+# zero collisions.
+# =============================================================================
+
+services:
+  # ---------------------------------------------------------------------------
+  # metafeedermusicbrainz-feeder — the feeder itself. The gateway reaches it directly on
+  # `pcs` for discovery/query/compute; the human sees it through the AppShield
+  # gate below.
+  # ---------------------------------------------------------------------------
+  metafeedermusicbrainz-feeder:
+    image: ghcr.io/worph/meta-feeder-musicbrainz:1.1.2
+    cpu_shares: 30
+    container_name: metafeedermusicbrainz-feeder
+        # Identity tier: JSON in, cards out, nothing buffered. Swap disabled
+        # (memswap_limit == mem_limit) → OOM instead of thrash.
+    mem_limit: 256m
+    memswap_limit: 256m
+    hostname: metafeedermusicbrainz-feeder
+    restart: unless-stopped
+    user: "0:0"
+    expose:
+      - 8080
+    environment:
+      RUST_LOG: "info,meta_feeder=info,musicbrainz_feeder=info"
+      META_FEEDER_STATE_DIR: "/data/meta-feeder"
+      TZ: "$TZ"
+    volumes:
+      # Persist feeder config.json + redb cache so it survives recreate.
+      - ${DATA_ROOT:-/DATA}/AppData/metafeedermusicbrainz/state:/data/meta-feeder:rw
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:8080/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+      start_period: 5s
+    networks:
+      - metafeedermusicbrainz
+      - pcs
+
+  # ---------------------------------------------------------------------------
+  # AppShield gate — the feeder's config page behind Yundera OIDC SSO.
+  # container_name == subdomain prefix (the auth-registrar derives the client_id
+  # from it). The gateway still reaches the feeder directly on `pcs`; index → /config.
+  # ---------------------------------------------------------------------------
+  metafeedermusicbrainz:
+    image: ghcr.io/yundera/appshield:2.0.9
+    cpu_shares: 80
+    container_name: metafeedermusicbrainz
+    hostname: metafeedermusicbrainz
+    restart: unless-stopped
+    user: "0:0"
+    expose:
+      - 80
+    environment:
+      OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
+      REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.nip.io,${APP_PUBLIC_IP_DASH}.sslip.io"
+      BACKEND_HOST: "metafeedermusicbrainz-feeder"
+      BACKEND_PORT: "8080"
+      LISTEN_PORT: "80"
+    labels:
+      caddy_0: metafeedermusicbrainz-${APP_DOMAIN}
+      caddy_0.import: gateway_tls
+      caddy_0.reverse_proxy: "{{upstreams 80}}"
+      caddy_1: metafeedermusicbrainz-${APP_PUBLIC_IP_DASH}.nip.io
+      caddy_1.import: gateway_tls
+      caddy_1.reverse_proxy: "{{upstreams 80}}"
+      caddy_2: metafeedermusicbrainz-${APP_PUBLIC_IP_DASH}.sslip.io
+      caddy_2.reverse_proxy: "{{upstreams 80}}"
+    depends_on:
+      - metafeedermusicbrainz-feeder
+    networks:
+      - metafeedermusicbrainz
+      - pcs
+
+networks:
+  metafeedermusicbrainz:
+    name: metafeedermusicbrainz
+    driver: bridge
+  pcs:
+    name: ${APP_NET:-pcs}
+    external: true
+
+x-casaos:
+  architectures:
+    - amd64
+    - arm64
+  author: Worph Team
+  category: Media
+  developer: Aptero Team
+  main: metafeedermusicbrainz
+  webui_port: 80
+  index: /config
+
+  description:
+    en_us: |
+      **The music identity tier for MetaMesh.**
+
+      MetaFeeder · MusicBrainz names the *work* — album, artist, release group,
+      cover art from the Cover Art Archive, and the ids every audio tier anchors
+      on. Keyless and cheap.
+
+      It serves **no audio**. Pair it with a bytes tier — **MetaFeeder · Internet
+      Archive** or **MetaFeeder · Jamendo** — or with the delegated **MetaFeeder ·
+      YouTube**: recordings matched to one MusicBrainz work converge on a single
+      album page instead of fragmenting into one tile per spelling.
+      **Requires:** **MetaGateway** — its meta-core stores the resolved records and
+      announces them to the swarm. The gateway must list this feeder in its config.
+    fr_fr: |
+      **La couche d'identité musicale de MetaMesh.**
+
+      MetaFeeder · MusicBrainz nomme l'*œuvre* — album, artiste, groupe de sortie,
+      pochette (Cover Art Archive) et les identifiants sur lesquels s'ancrent les
+      couches audio. Sans clé.
+
+      Il ne sert **aucun audio** : à associer à **MetaFeeder · Internet Archive**,
+      **MetaFeeder · Jamendo** ou **MetaFeeder · YouTube**. **Nécessite** l'app
+      **MetaGateway**.
+  tagline:
+    en_us: MusicBrainz — the music identity tier for MetaMesh
+    fr_fr: MusicBrainz — la couche d'identité musicale de MetaMesh
+
+  title:
+    en_us: MetaFeeder · MusicBrainz
+
+  icon: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederMusicBrainz/icon.png
+  thumbnail: https://cdn.jsdelivr.net/gh/Worph/MetaAppStore@main/Apps/MetaFeederMusicBrainz/thumbnail.png
+
+  store_app_id: metafeedermusicbrainz
+  is_uncontrolled: false
+
+  tips:
+    before_install:
+      en_us: |
+        **Install order:** install **MetaGateway** first (its meta-core stores and
+        announces what this feeder finds).
+
+        **After installing this app:** in **MetaGateway**, add this feeder from the
+        dashboard's *Add a feeder* box — name `musicbrainz-feeder`, URL `http://metafeedermusicbrainz-feeder:8080`.
+        The gateway restarts itself: feeder discovery is startup-only.
+        No API key. For anything playable, also install a bytes tier
+        (**MetaFeeder · Internet Archive**, **MetaFeeder · Jamendo**) or
+        **MetaFeeder · YouTube**. Pairs with **MetaListen**.
+        **Authentication:** the config UI is protected by Yundera's Authelia (OIDC).
+
+# Maison (Yundera dashboard) configuration. Read in preference to x-casaos.
+# schema_version 2 is required for `folders`: an older Maison refuses the app
+# outright rather than starting it without its directories.
+x-compose-app:
+  schema_version: 2
+  # Created and chowned by Maison before any image is pulled, before any hook
+  # runs and before the containers start — on the first boot and every one after.
+  # Compose would otherwise create a missing bind source as a root-owned dir.
+  folders:
+    - path: /DATA/AppData/metafeedermusicbrainz/state
+      user: $PUID
+      group: $PGID
+  # Same string as the caddy_0 label, so the tile link and the route agree.
+  webui-host: metafeedermusicbrainz-${domain}
+  webui-path: "/config"
@@ -0,0 +1,35 @@
+# MetaFeeder · MusicBrainz — Rationale
+
+## What deviation / exception is being requested
+
+`metafeedermusicbrainz-feeder` runs `user: 0:0`.
+
+## Why it is necessary
+
+Carried over unchanged from the MetaFeeder listings this app is a sibling of, so the
+feeder behaves exactly as they do. The MetaFeeder images write their state and redb
+cache as the container user and some reach MetaCore's root-owned tree; a uid-1000
+process is refused.
+
+## Security mitigations in place
+
+- Public ingress terminates at the AppShield sidecar (`ghcr.io/yundera/appshield:2.0.9`),
+  which gates every path behind the PCS's Authelia SSO over OIDC. The feeder carries no
+  Caddy labels and publishes no host port, so it is reachable only from the `pcs` Docker
+  network.
+- The container mounts **no user directories** — not `/DATA/Documents`, `/DATA/Downloads`,
+  `/DATA/Media` or `/DATA/Gallery`. Its only bind is its own state under
+  `/DATA/AppData/metafeedermusicbrainz/`, declared in `x-compose-app.folders` and owned `$PUID:$PGID`.
+- `cpu_shares` and a hard `mem_limit` (swap disabled) set on every service; image tags
+  pinned; no `:latest`.
+
+## Alternatives considered and rejected
+
+- **Run as `$PUID:$PGID`.** Not validated for this image; the sibling MetaFeeder apps all
+  run `0:0`, and changing the runtime user here would make this listing the odd one out
+  for no measured benefit.
+
+## Data protection
+
+The feeder holds no user media. Its entire state lives under `/DATA/AppData/metafeedermusicbrainz/`, which
+is the unit Maison archives on uninstall and restores from backup.