ajnart
1b544f599c
Board scaling: no sideways scrolling - Revert the pannable narrow canvas. The canvas fits the viewport again and `.viewport` goes back to `overflow: clip`, so a board can never widen the document or scroll horizontally. - Fix the unreadable-narrow-board regression at the real cause instead: cap the inverse UI compensation at 2x (50% canvas scale). Down to 50% text and controls keep their physical size; below it the board zooms out as a whole, so a 200x200 logical tile hosts at most 28px logical text rather than 96px and content stops overlapping its neighbours. Touch editing - Add `touch-action: none` to `.board-grid-entry`, the dnd-kit draggable and its own drag handle. The 200ms touch activation delay is useless if the browser has already handed the gesture to page panning and emitted `pointercancel`. Only edit mode renders this element. Custom widgets - Memoize the merged `data`/`status`/`options` passed to `CustomJsxRenderer`. They were rebuilt every render, so the compiled-template memo never hit and the new reference-identity boundary key changed on every render, resetting the error boundary and forcing an extra reconciliation of the widget subtree. - Keep the cache key when the shared Redis cache is unavailable so the process-local cache still absorbs polling instead of sending every widget refresh upstream. - Reclaim the shared cache's LRU/size/byte bookkeeping for TTL-expired entries and touch the LRU in the same script, so expired ghosts stop consuming the 64 MiB budget and a read costs one round trip instead of two. Forwarded IP - Restore `ipAddressFromHeaders` to the full forwarding chain and add `trustedIpAddressFromHeaders` for the last hop. Repointing the shared helper had collapsed MCP failed-auth rate limiting into a single bucket for every client behind a reverse proxy and replaced the client IP with the proxy IP in API-key auth logs. Runtime and restore - Make the new /appdata ownership migration best-effort. Under `set -e` a mount that rejects chown (CIFS/SMB, fixed-uid NFS) turned into a container that refuses to start, and /appdata was never chowned before. - Report malformed metadata.json as such instead of blaming the archive.
68 lines
3.0 KiB
Bash
68 lines
3.0 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
export PUID=${PUID:-0}
|
|
export PGID=${PGID:-0}
|
|
|
|
echo "Starting with UID='$PUID', GID='$PGID'"
|
|
|
|
if [ "${PUID}" != "0" ] || [ "${PGID}" != "0" ]; then
|
|
# Only chown the paths the non-root user must actually write to at runtime.
|
|
# Recursively chowning the whole /app tree is extremely slow on network- or
|
|
# HDD-backed storage (e.g. TrueNAS Apps), because the Next.js standalone
|
|
# bundle and its node_modules contain tens of thousands of tiny files. This
|
|
# turned a ~10s step into 15+ minutes for some users (#2190). Application
|
|
# code, migrations and native modules are only read/executed, so they stay
|
|
# owned by root and do not need chowning.
|
|
echo "Changing owner to $PUID:$PGID..."
|
|
# Application data volume (db, redis dumps, trusted certificates).
|
|
# Ensure the known subdirectories exist and migrate ownership of any
|
|
# existing content, so a persistent volume with stale or root-owned
|
|
# entries stays writable after a PUID/PGID change. These trees are small
|
|
# (a single sqlite db, a redis dump, a few certs), unlike the /app tree.
|
|
#
|
|
# /appdata is user-supplied storage and was never chowned before, so it can
|
|
# be a CIFS/SMB or NFS mount that rejects chown outright. Those mounts
|
|
# already assign ownership themselves, so a failure here is informational:
|
|
# `set -e` must not turn it into a container that refuses to start.
|
|
mkdir -p /appdata/db /appdata/redis /appdata/trusted-certificates
|
|
appdata_chown_failed=0
|
|
chown "${PUID}:${PGID}" /appdata || appdata_chown_failed=1
|
|
chown -R "${PUID}:${PGID}" /appdata/db /appdata/redis /appdata/trusted-certificates || appdata_chown_failed=1
|
|
if [ "${appdata_chown_failed}" = "1" ]; then
|
|
echo "Warning: could not change ownership of /appdata. This is expected on mounts that assign ownership themselves (CIFS/SMB, NFS with a fixed uid). Continuing."
|
|
fi
|
|
# Next.js runtime cache (image optimization, fetch cache, ...)
|
|
mkdir -p /app/apps/nextjs/.next/cache
|
|
chown -R "${PUID}:${PGID}" /app/apps/nextjs/.next/cache
|
|
# nginx runtime directories and the rendered configuration
|
|
chown -R "${PUID}:${PGID}" /var/cache/nginx
|
|
chown -R "${PUID}:${PGID}" /var/log/nginx
|
|
chown -R "${PUID}:${PGID}" /var/lib/nginx
|
|
mkdir -p /run/nginx
|
|
touch /run/nginx/nginx.pid
|
|
chown -R "${PUID}:${PGID}" /run/nginx
|
|
touch /etc/nginx/nginx.conf
|
|
chown "${PUID}:${PGID}" /etc/nginx/nginx.conf
|
|
echo "Changing owner to $PUID:$PGID, done."
|
|
fi
|
|
|
|
# support _FILE Suffix for environment variables
|
|
for file_var in $(env | cut -d '=' -f 1 | grep "_FILE$"); do
|
|
target_var=$(echo "$file_var" | cut -d'=' -f1 | sed 's/_FILE//')
|
|
file_path=$(printenv "$file_var")
|
|
|
|
if [ -f "$file_path" ]; then
|
|
export "$target_var"=$(cat "$file_path" | tr -d '\n\r')
|
|
echo "Info: Loaded secret for $target_var from $file_path"
|
|
else
|
|
echo "Warning: Secret file $file_path not found for $target_var"
|
|
fi
|
|
done
|
|
|
|
if [ "${PUID}" != "0" ]; then
|
|
exec su-exec $PUID:$PGID "$@"
|
|
else
|
|
exec "$@"
|
|
fi
|