metastar/MetaAppStore
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

meta-core claims model: pin meta-core 2.0.1, meta-read 1.4.1, meta-watch 1.1.0, meta-search 1.3.2, meta-share 2.7.0, gateway 1.1.1, meta-sort 1.1.1, plugins 1.1.0; signing keys + db-cache backup exclude

Browse Source
This commit is contained in:
Worph
2026-10-27 19:08:14 +00:00
parent 26929835d3
commit fcd0a9703b
26 changed files with 415 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Apps/MetaWatch/docker-compose.yml
+41 -7
View File
@@ -29,7 +29,7 @@ services:
metawatch-core:
# 1.0.1 carries the identity API (commit 52f5b5c) required for MetaWatch
# sign-in / keypair generation; 1.0.0 predates it.
image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:1.0.24
image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-core:2.0.1
container_name: metawatch-core
# Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
# instead of swap. Mirrors the dev sub-stack limits.
@@ -44,6 +44,8 @@ services:
- 9000
volumes:
- ${DATA_ROOT:-/DATA}/AppData/metawatch/metacore:/meta-core:rw
# (meta-core 2.0.0 keeps its rebuildable index cache at
# /meta-core/db-cache/cache.db inside this bind — excluded from backups.)
# Subtitle store: player-uploaded subtitles land in /files/plugin/subtitles
# (WebDAV PUT + POST /api/files/register, needs meta-core with that route).
# Plugin output only — no /files/watch mount, watcher stays off.
@@ -72,7 +74,7 @@ services:
# RSA-keyed bootstrap.libp2p.io nodes) and therefore to DISCOVER remote
# gateways via the kad `metamesh-gateway` provider namespace. Without it
# this peer only ever sees same-host mDNS peers.
image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.2.10
image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-search:1.3.2
container_name: metawatch-search
# Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
# instead of swap. Mirrors the dev sub-stack limits.
@@ -96,6 +98,9 @@ services:
# swarm. Without this mount both are on the container's writable layer and
# every image bump loses the prefs and re-fetches every poster.
- ${DATA_ROOT:-/DATA}/AppData/metawatch/search-data:/data:rw
# Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
# service in this stack. Config — backed up, NOT in backup.exclude.
- ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
environment:
P2P_LISTEN: "/ip4/0.0.0.0/tcp/4001"
# Public IPFS DHT bootstraps by explicit /dns4/.../tcp/4001 (the nested
@@ -121,6 +126,8 @@ services:
SEARCH_TIMEOUT_SECS: "300"
META_CORE_URL: "http://metawatch-core:9000"
BASE_URL: "http://metawatch-search:3000"
# Own claim-signing key (relayed claims are forwarded verbatim, never re-signed); generated on first boot if missing.
METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-search.key"
# Renamed at the 1.1.0 bump (2026-08-26), as the old note here said to do:
# META_SHARE_PEER_API_URL was the pre-1.0.8 spelling and now only logs a
# deprecation warning. Do NOT set both.
@@ -157,7 +164,7 @@ services:
# MetaShare app's `metashare-<tier>` hostnames, which on a shared `pcs`
# would be ANOTHER hull's plugins writing to another /data).
# - 3000 HTTP API - 3001 plugin callback API (internal only)
image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.6.4
image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-share:2.7.0
container_name: metawatch-share
# The swarm and blockstore moved to the ipfs plugin, so the hull needs far
# less than the monolith did.
@@ -179,6 +186,9 @@ services:
# hull's; ipfs/blocks.redb is the ipfs plugin's corner of the SAME folder
# (layout unchanged from 1.0.x, so an existing cache carries over).
- ${DATA_ROOT:-/DATA}/AppData/metawatch/share-data:/data:rw
# Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
# service in this stack. Config — backed up, NOT in backup.exclude.
- ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
environment:
META_CORE_URL: "http://metawatch-core:9000"
BASE_URL: "http://metawatch-share:3000"
@@ -186,6 +196,8 @@ services:
META_SHARE_PLUGIN_IPFS_URL: "http://metawatch-share-ipfs:3000"
META_SHARE_PLUGIN_TORRENT_URL: "off"
META_SHARE_PLUGIN_NZB_URL: "off"
# Own claim-signing key; generated on first boot if missing.
METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-share.key"
TZ: "$TZ"
depends_on:
metawatch-core:
@@ -250,8 +262,12 @@ services:
# My List + Continue Watching persist in /DATA/AppData/metawatch/data.
# ---------------------------------------------------------------------------
metawatch-app:
image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch:1.0.93
image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/meta-watch:1.1.0
container_name: metawatch-app
# Run as the PUID that Maison creates the app folders with (as the Shared
# variant does). The image default user (uid 10001) cannot write them on a
# fresh install: "create ipfs dir … Permission denied".
user: "1000:1000"
hostname: metawatch-app
restart: unless-stopped
cpu_shares: 30
@@ -264,6 +280,9 @@ services:
- 3000
volumes:
- ${DATA_ROOT:-/DATA}/AppData/metawatch/data:/app/data
# Claim-signing keys (meta-core 2.0.0 claims model), one file per writer
# service in this stack. Config — backed up, NOT in backup.exclude.
- ${DATA_ROOT:-/DATA}/AppData/metawatch/keys:/keys:rw
environment:
META_SHARE_URL: "http://metawatch-share:3000"
META_SEARCH_URL: "http://metawatch-search:3000"
@@ -275,6 +294,8 @@ services:
META_WATCH_SYNC_PEERS: "http://metawatch-search:3000"
# This box's own core — subtitle store only (uploads + curated matches).
META_CORE_URL: "http://metawatch-core:9000"
# Own claim-signing key for the subtitle-store claims it writes; generated on first boot if missing.
METAMESH_SIGNING_KEY_FILE: "/keys/metawatch-app.key"
TZ: "$TZ"
depends_on:
metawatch-search:
@@ -310,7 +331,7 @@ services:
BACKEND_HOST: "metawatch-app"
BACKEND_PORT: "3000"
LISTEN_PORT: "80"
REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
depends_on:
- metawatch-app
labels:
@@ -359,7 +380,7 @@ services:
expose: ["80"]
environment:
OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
BACKEND_HOST: "metawatch-share"
BACKEND_PORT: "3000"
LISTEN_PORT: "80"
@@ -388,7 +409,7 @@ services:
expose: ["80"]
environment:
OIDC_REGISTRAR_URL: "http://auth-registrar:9092"
REDIRECT_HOST_SUFFIXES: "${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io"
REDIRECT_HOST_SUFFIXES: "${APP_HOST_SUFFIXES:-${APP_DOMAIN},${APP_PUBLIC_IP_DASH}.${APP_IP_ZONE},${APP_PUBLIC_IP_DASH}.sslip.io}"
BACKEND_HOST: "metawatch-search"
BACKEND_PORT: "3000"
LISTEN_PORT: "80"
@@ -526,6 +547,11 @@ x-compose-app:
- path: /DATA/AppData/metawatch/metacore
user: $PUID
group: $PGID
# meta-core 2.0.0 rebuildable index cache (default
# /meta-core/db-cache/cache.db). Excluded from backups below.
- path: /DATA/AppData/metawatch/metacore/db-cache
user: $PUID
group: $PGID
- path: /DATA/AppData/metawatch/search-data
user: $PUID
group: $PGID
@@ -541,6 +567,14 @@ x-compose-app:
- path: /DATA/AppData/metawatch/data
user: $PUID
group: $PGID
- path: /DATA/AppData/metawatch/keys
user: $PUID
group: $PGID
# Derived data only: meta-core rebuilds its index cache from the truth file
# (metacore/db/meta-core.db, which IS backed up). keys/ stays backed up.
backup:
exclude:
- metacore/db-cache/
# Same string as the caddy_0 label, so the tile link and the route agree.
webui-host: metawatch-${domain}
webui-path: "/"