Worph
39f82e1f96
23 apps (MetaCore, the library/network/client tiers and 13 MetaFeeder*) move out of the general-purpose Worph/AppStore into their own store so the MetaMesh family releases on its own cadence. - asset URLs repointed to cdn.jsdelivr.net/gh/Worph/MetaAppStore@main - store scaffolding added (category/recommend/featured lists, licence, contributing, gitattributes) - psd-source/meta-icons-v2 icon generator follows the apps MetaMCP stays in Worph/AppStore: it is third-party metatool-ai software, not part of MetaMesh.
56 lines
2.9 KiB
Markdown
56 lines
2.9 KiB
Markdown
# MetaFeeder · Tribler — Rationale
|
|
|
|
## What deviation / exception is being requested
|
|
|
|
1. `metafeedertribler-feeder` runs `user: 0:0`.
|
|
2. `tribler-instance` is seeded with a Tribler core API key of `changeme`.
|
|
3. `tribler-instance` runs the upstream Tribler image, which writes its state as root
|
|
inside `/root/.Tribler`.
|
|
|
|
## Why it is necessary
|
|
|
|
1. The feeder publishes resolved records to the shared MetaCore and writes plugin artwork
|
|
through its WebDAV endpoint; those targets are created and owned by MetaCore's
|
|
root-running container.
|
|
2. Tribler's core exposes a localhost-style REST API and requires *some* key. The seeded
|
|
value is a placeholder that matches the one baked into the feeder's own config, so the
|
|
two agree out of the box and the app works immediately after installation — the
|
|
functionality requirement in the guidelines. It is not a user credential and grants no
|
|
access to anything beyond this Tribler core.
|
|
3. Upstream image behaviour; the state directory is bind-mounted so it survives container
|
|
recreation.
|
|
|
|
## Security mitigations in place
|
|
|
|
- **`tribler-instance` is not on the shared `pcs` network.** It is attached to the
|
|
app-private `metafeedertribler` bridge only, so the API on `:8085` is reachable by this
|
|
app's own feeder and by nothing else on the box — not by another store app, and not from
|
|
the internet. The `changeme` key never crosses a network boundary a stranger can reach.
|
|
- The feeder's configuration UI is behind AppShield + Authelia SSO
|
|
(`ghcr.io/yundera/appshield:2.0.9`); the feeder itself carries no Caddy labels and
|
|
publishes no host port.
|
|
- No user directories are mounted — no `/DATA/Documents`, `/DATA/Downloads`, `/DATA/Media`
|
|
or `/DATA/Gallery`. All binds are under `/DATA/AppData/metafeedertribler/`, declared in
|
|
`x-compose-app.folders`.
|
|
- Both config seeds in `pre-install-cmd` are guarded by `[ ! -f … ]`, so a reinstall or
|
|
version upgrade never overwrites operator edits.
|
|
- Image tags pinned. `ghcr.io/tribler/tribler` is pinned to `v8.4.2`, the digest `:latest`
|
|
resolved to at the time of pinning.
|
|
|
|
## Alternatives considered and rejected
|
|
|
|
- **Generate a random API key in the hook.** The Maison hook toolbox has no `openssl`;
|
|
`od -An -N32 -tx1 /dev/urandom` would work, but the key has to be written into *two*
|
|
files that must agree, and a partially-applied seed leaves the feeder unable to talk to
|
|
its own core. Given the API is unreachable off the app-private network, the added
|
|
failure mode buys nothing.
|
|
- **Put Tribler's API behind AppShield.** The feeder is a machine client; it cannot
|
|
complete an interactive OIDC redirect.
|
|
- **Run the feeder as `$PUID:$PGID`.** Writes into MetaCore's root-owned tree fail.
|
|
|
|
## Data protection
|
|
|
|
No user media is mounted. Tribler's own state (`/root/.Tribler`), its seed config, the
|
|
feeder's cursor and the TMDB cache all live under `/DATA/AppData/metafeedertribler/`, the
|
|
unit Maison archives on uninstall and restores from backup.
|