chore(vps): remove gokapi (operator decision 2026-08-26)
gokapi was VPS desired state (hosts/vps/services.yaml) with no matching
runtime on the node — a real deployment gap left open at the end of the
2026-08-26 recon session ("redeploy-vps-gokapi pozostawiony — realna
luka wdrożeniowa", docs/sessions/2026-08-26.md). Operator decision this
session: drop it instead of deploying it. Verified zero footprint on
VPS: no data, no container, no image, no /opt/homelab/config/gokapi.
Removed the desired-state entry from hosts/vps/services.yaml and the
services/gokapi/ compose stack. No hosts/vps/runtime/gokapi override
existed to remove.
Grepped the repo for dangling references: jobs/deploy-runner/tests and
services/control-plane/tests use "gokapi" only as an arbitrary example
service name in synthetic tmp_path fixtures (not reading the real
services/gokapi/ directory) — unaffected, left as-is. Fixed one stale
mention in services/control-plane/env.example's example-services
comment. kb/ and docs/sessions/ mentions (service doc, cutover
runbook, an open backlog item, prior session logs) are historical/
narrative record, not code or active config — left untouched, out of
this task's scope; flagged as a follow-up below.
Full control-plane (183), node-agent (70), and deploy-runner (44) test
suites pass unchanged.
Follow-up (not done here — kb/ editing is out of scope for this
worktree task): kb/decisions/backlog-aktywne.md still has an open
"gokapi: deploy-node VPS rzuca błąd — brakujący .env" entry that is now
moot and should be closed/removed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017WDKj5LRY8vdQMx57dfNnu
This commit is contained in:
oskar
parent
91db6829f4
commit
74ff3ee1e2
|
|
@ -60,23 +60,6 @@ services:
|
||||||
data_path: /opt/homelab/data/fleet-prometheus
|
data_path: /opt/homelab/data/fleet-prometheus
|
||||||
logs_path: /opt/homelab/logs/fleet-prometheus
|
logs_path: /opt/homelab/logs/fleet-prometheus
|
||||||
|
|
||||||
gokapi:
|
|
||||||
role: public-file-share
|
|
||||||
deployment_model: docker-compose
|
|
||||||
exposure: public
|
|
||||||
offline_required: false
|
|
||||||
depends_on:
|
|
||||||
local: []
|
|
||||||
external: []
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
container_port: 53842
|
|
||||||
protocol: tcp
|
|
||||||
runtime:
|
|
||||||
config_path: /opt/homelab/config/gokapi
|
|
||||||
data_path: /opt/homelab/data/gokapi
|
|
||||||
logs_path: /opt/homelab/logs/gokapi
|
|
||||||
|
|
||||||
stability-agent:
|
stability-agent:
|
||||||
role: node-watchdog # read-only docker.sock watchdog, emits filesystem events
|
role: node-watchdog # read-only docker.sock watchdog, emits filesystem events
|
||||||
# Deploys via its own deploy-local.sh, outside the declarative pipeline
|
# Deploys via its own deploy-local.sh, outside the declarative pipeline
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
# Copy to .env next to docker-compose.yml (gitignored); docker compose picks
|
# Copy to .env next to docker-compose.yml (gitignored); docker compose picks
|
||||||
# it up automatically. Same convention as services/fleet-prometheus,
|
# it up automatically. Same convention as services/fleet-prometheus,
|
||||||
# services/llm-gateway, services/gokapi, services/ollama.
|
# services/llm-gateway, services/ollama.
|
||||||
|
|
||||||
# Tailscale IP of the VPS node. The operator-ui port (18180) is published as
|
# Tailscale IP of the VPS node. The operator-ui port (18180) is published as
|
||||||
# ${TAILSCALE_BIND_IP}:18180:8080 so the mesh-facing bind is never 0.0.0.0.
|
# ${TAILSCALE_BIND_IP}:18180:8080 so the mesh-facing bind is never 0.0.0.0.
|
||||||
|
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
# gokapi
|
|
||||||
|
|
||||||
Lekki self-hosted "Firefox Send" alternative — link do jednego pliku, na zewnątrz, z limitem pobrań/czasu. **Osobny serwis od Nextclouda, celowo.**.
|
|
||||||
|
|
||||||
Dokumentacja: [kb/services/gokapi.md](../../kb/services/gokapi.md)
|
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
# Gokapi — public file-share (Firefox Send-style), separate from Nextcloud.
|
|
||||||
#
|
|
||||||
# Nextcloud stays the private "twierdza" (mesh/kapala.org only). Gokapi is
|
|
||||||
# the OPPOSITE end of the spectrum on purpose: a small, single-container,
|
|
||||||
# genuinely public link-share for sending someone outside the mesh a file.
|
|
||||||
# Runs on VPS (Hetzner, public host) — home nodes stay untouched.
|
|
||||||
services:
|
|
||||||
gokapi:
|
|
||||||
# Pinned to the current stable release (v2.2.4, verified against
|
|
||||||
# github.com/Forceu/Gokapi releases + Docker Hub f0rc3/gokapi tags on
|
|
||||||
# 2026-07-09) — never :latest, so upgrades are a deliberate git diff,
|
|
||||||
# same convention as nextcloud.
|
|
||||||
image: f0rc3/gokapi:v2.2.4
|
|
||||||
container_name: gokapi
|
|
||||||
restart: unless-stopped
|
|
||||||
env_file:
|
|
||||||
- .env
|
|
||||||
volumes:
|
|
||||||
# /opt/homelab/data convention. `data` holds uploaded files (churns
|
|
||||||
# constantly — links expire and get deleted); `config` holds
|
|
||||||
# config.json + the E2E encryption master key. See README backup note:
|
|
||||||
# config is the part that actually needs backing up.
|
|
||||||
- /opt/homelab/data/gokapi/data:/app/data
|
|
||||||
- /opt/homelab/data/gokapi/config:/app/config
|
|
||||||
ports:
|
|
||||||
# PUBLIC reachability is via npm@VPS + share.okit.pl, NOT this bind.
|
|
||||||
# Bound ONLY to the VPS Tailscale interface (TAILSCALE_BIND_IP), never
|
|
||||||
# 0.0.0.0 — same defense-in-depth convention as fleet-prometheus: the
|
|
||||||
# raw port does not exist on the public Hetzner IP (135.181.153.108)
|
|
||||||
# at all. npm, running as its own container on the same host, reaches
|
|
||||||
# gokapi via Docker hairpin NAT through this real interface IP
|
|
||||||
# (loopback would NOT work for that trick — see fleet-prometheus /
|
|
||||||
# nextcloud for the same pattern). Requires .env (from env.example)
|
|
||||||
# next to this file at deploy.
|
|
||||||
- "${TAILSCALE_BIND_IP}:53842:53842"
|
|
||||||
# Image ships curl (alpine-based), so an in-container check works here —
|
|
||||||
# unlike vikunja's image, which has neither curl nor wget.
|
|
||||||
healthcheck:
|
|
||||||
test: ["CMD", "curl", "-fs", "--max-time", "5", "http://127.0.0.1:53842/"]
|
|
||||||
interval: 30s
|
|
||||||
timeout: 10s
|
|
||||||
retries: 5
|
|
||||||
start_period: 15s
|
|
||||||
|
|
@ -1,47 +0,0 @@
|
||||||
# Gokapi host-local binds + disk-protection tuning — copy to .env (gitignored)
|
|
||||||
# next to docker-compose.yml and fill in real values. Never commit .env.
|
|
||||||
# No auth secrets here: Gokapi has no headless admin env vars — the admin
|
|
||||||
# account is created in the one-time /setup web wizard (see README).
|
|
||||||
|
|
||||||
# Tailscale IP of the VPS node (ubuntu-4gb-hel1-1). Bind the gokapi port
|
|
||||||
# ONLY to this interface — never 0.0.0.0. The public internet never reaches
|
|
||||||
# port 53842 directly; share.okit.pl reaches gokapi only through npm@VPS
|
|
||||||
# (which runs on the same host and connects to this IP via Docker hairpin
|
|
||||||
# NAT — see docker-compose.yml). Verify when rebuilding the host:
|
|
||||||
# tailscale ip -4.
|
|
||||||
TAILSCALE_BIND_IP=100.95.58.48
|
|
||||||
|
|
||||||
TZ=Europe/Warsaw
|
|
||||||
|
|
||||||
# --- Disk protection -------------------------------------------------------
|
|
||||||
# VPS has an 80 GB disk shared with npm, outline, joplin, ai-cluster,
|
|
||||||
# fleet-prometheus's TSDB, etc. — gokapi is NOT the only tenant, and it has
|
|
||||||
# no S3 backend (local disk only, by design). Keep uploads small and leave
|
|
||||||
# headroom so expiring links actually reclaim space before the disk fills.
|
|
||||||
|
|
||||||
# Per-file upload cap in MB. 5120 = 5 GB. Upstream default is 102400
|
|
||||||
# (100 GB), which would let a single upload fill the whole disk.
|
|
||||||
GOKAPI_MAX_FILESIZE=5120
|
|
||||||
|
|
||||||
# Refuse new uploads once free disk space drops below this many MB. Upstream
|
|
||||||
# default is 400; raised here for the same reason as above.
|
|
||||||
GOKAPI_MIN_FREE_SPACE=2048
|
|
||||||
|
|
||||||
# npm@VPS and gokapi run on the same host; npm reaches gokapi's Tailscale-
|
|
||||||
# bound port via Docker hairpin NAT, so the connection arrives from the
|
|
||||||
# docker bridge gateway, not the real client IP. Trust that range so
|
|
||||||
# X-Forwarded-For / IP logging work correctly — same lesson as nextcloud's
|
|
||||||
# TRUSTED_PROXIES. Narrow to the exact /24 once the stack is up on the live
|
|
||||||
# host: docker network inspect gokapi_default.
|
|
||||||
GOKAPI_TRUSTED_PROXIES=172.16.0.0/12
|
|
||||||
|
|
||||||
# --- NOT env vars — Gokapi has no headless config for these. Set them in
|
|
||||||
# the one-time /setup wizard on first boot (see README Cutover checklist):
|
|
||||||
# - Admin username/password (Authentication step)
|
|
||||||
# - Storage backend: Local (Storage step — NOT S3,
|
|
||||||
# per Oskar's decision)
|
|
||||||
# - Encryption level: End-to-End (Level 3) (Encryption step —
|
|
||||||
# Oskar wants E2E ON)
|
|
||||||
# - Default expiry / max downloads: there is NO global default in Gokapi —
|
|
||||||
# it's chosen per-upload in the web form. Use conservative values (e.g.
|
|
||||||
# 7 days / 10 downloads) each time to keep the disk from filling.
|
|
||||||
|
|
@ -1,27 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
# Healthcheck for gokapi (public file-share, https://share.okit.pl via npm@VPS)
|
|
||||||
|
|
||||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
||||||
|
|
||||||
# The port is bound to the Tailscale interface only, so localhost won't answer.
|
|
||||||
# Read the bind IP from .env (same file compose uses for the port mapping).
|
|
||||||
if [ -f "$SCRIPT_DIR/.env" ]; then
|
|
||||||
# shellcheck disable=SC1091
|
|
||||||
source "$SCRIPT_DIR/.env"
|
|
||||||
fi
|
|
||||||
BIND_IP="${TAILSCALE_BIND_IP:-127.0.0.1}"
|
|
||||||
|
|
||||||
# Container must be running
|
|
||||||
if ! docker ps --filter "name=gokapi" --filter "status=running" | grep -qw "gokapi"; then
|
|
||||||
echo "[FAIL] gokapi container is not running"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Web server must answer (setup wizard or login page, either is fine)
|
|
||||||
if ! curl -sf --max-time 5 "http://${BIND_IP}:53842/" > /dev/null; then
|
|
||||||
echo "[FAIL] gokapi is not responding on ${BIND_IP}:53842"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "[OK] gokapi is healthy"
|
|
||||||
exit 0
|
|
||||||
|
|
@ -1,34 +0,0 @@
|
||||||
service:
|
|
||||||
name: gokapi
|
|
||||||
owner_node: vps
|
|
||||||
role: public-file-share # Firefox Send-style link sharing, deliberately separate from Nextcloud
|
|
||||||
exposure: public # public via npm@VPS (share.okit.pl). The container's own port binds
|
|
||||||
# to TAILSCALE_BIND_IP only, never 0.0.0.0 — npm is the sole public
|
|
||||||
# entry point (see docker-compose.yml). Same pattern as vikunja.
|
|
||||||
dependencies: [] # standalone; npm@VPS proxies to it but gokapi has no upstream deps
|
|
||||||
ports:
|
|
||||||
- container: 53842
|
|
||||||
host: 53842
|
|
||||||
protocol: tcp
|
|
||||||
healthcheck:
|
|
||||||
type: http
|
|
||||||
endpoint: http://localhost:53842/ # setup wizard until first admin login, then the login page
|
|
||||||
interval: 30s
|
|
||||||
timeout: 10s
|
|
||||||
retries: 5
|
|
||||||
restart_policy: unless-stopped
|
|
||||||
persistence:
|
|
||||||
paths:
|
|
||||||
- /opt/homelab/data/gokapi/data # uploaded files — ephemeral by design, links expire
|
|
||||||
- /opt/homelab/data/gokapi/config # config.json + E2E encryption master key — BACK THIS UP
|
|
||||||
runtime:
|
|
||||||
config_files:
|
|
||||||
- .env # host-local binds + disk-protection tuning (gitignored, from env.example)
|
|
||||||
env_vars:
|
|
||||||
- TAILSCALE_BIND_IP # required — mesh-only port bind; npm@VPS reaches it via hairpin NAT
|
|
||||||
- GOKAPI_MAX_FILESIZE # per-file cap in MB — keeps the shared VPS disk from filling
|
|
||||||
- GOKAPI_MIN_FREE_SPACE # MB headroom before uploads are refused
|
|
||||||
- GOKAPI_TRUSTED_PROXIES # npm@VPS as seen through Docker hairpin NAT (docker bridge subnet)
|
|
||||||
# No admin/auth env vars: Gokapi has no headless setup — admin account,
|
|
||||||
# storage backend, encryption level are all set in the /setup web
|
|
||||||
# wizard on first boot (deploy-time step, see README).
|
|
||||||
Loading…
Reference in a new issue