From ff8412b565e34841d249842dfdd6777828effdf1 Mon Sep 17 00:00:00 2001 From: oskar Date: Wed, 26 Aug 2026 21:09:46 +0200 Subject: [PATCH] chore(vps): remove gokapi (operator decision 2026-08-26) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gokapi was VPS desired state (hosts/vps/services.yaml) with no matching runtime on the node — a real deployment gap left open at the end of the 2026-08-26 recon session ("redeploy-vps-gokapi pozostawiony — realna luka wdrożeniowa", docs/sessions/2026-08-26.md). Operator decision this session: drop it instead of deploying it. Verified zero footprint on VPS: no data, no container, no image, no /opt/homelab/config/gokapi. Removed the desired-state entry from hosts/vps/services.yaml and the services/gokapi/ compose stack. No hosts/vps/runtime/gokapi override existed to remove. Grepped the repo for dangling references: jobs/deploy-runner/tests and services/control-plane/tests use "gokapi" only as an arbitrary example service name in synthetic tmp_path fixtures (not reading the real services/gokapi/ directory) — unaffected, left as-is. Fixed one stale mention in services/control-plane/env.example's example-services comment. kb/ and docs/sessions/ mentions (service doc, cutover runbook, an open backlog item, prior session logs) are historical/ narrative record, not code or active config — left untouched, out of this task's scope; flagged as a follow-up below. Full control-plane (183), node-agent (70), and deploy-runner (44) test suites pass unchanged. Follow-up (not done here — kb/ editing is out of scope for this worktree task): kb/decisions/backlog-aktywne.md still has an open "gokapi: deploy-node VPS rzuca błąd — brakujący .env" entry that is now moot and should be closed/removed. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_017WDKj5LRY8vdQMx57dfNnu --- hosts/vps/services.yaml | 17 ----------- services/control-plane/env.example | 2 +- services/gokapi/README.md | 5 ---- services/gokapi/docker-compose.yml | 43 --------------------------- services/gokapi/env.example | 47 ------------------------------ services/gokapi/healthcheck.sh | 27 ----------------- services/gokapi/service.yaml | 34 --------------------- 7 files changed, 1 insertion(+), 174 deletions(-) delete mode 100644 services/gokapi/README.md delete mode 100644 services/gokapi/docker-compose.yml delete mode 100644 services/gokapi/env.example delete mode 100755 services/gokapi/healthcheck.sh delete mode 100644 services/gokapi/service.yaml diff --git a/hosts/vps/services.yaml b/hosts/vps/services.yaml index 3dd3f09..5fef7f1 100644 --- a/hosts/vps/services.yaml +++ b/hosts/vps/services.yaml @@ -60,23 +60,6 @@ services: data_path: /opt/homelab/data/fleet-prometheus logs_path: /opt/homelab/logs/fleet-prometheus - gokapi: - role: public-file-share - deployment_model: docker-compose - exposure: public - offline_required: false - depends_on: - local: [] - external: [] - ports: - - name: http - container_port: 53842 - protocol: tcp - runtime: - config_path: /opt/homelab/config/gokapi - data_path: /opt/homelab/data/gokapi - logs_path: /opt/homelab/logs/gokapi - stability-agent: role: node-watchdog # read-only docker.sock watchdog, emits filesystem events # Deploys via its own deploy-local.sh, outside the declarative pipeline diff --git a/services/control-plane/env.example b/services/control-plane/env.example index 53fe9c3..2437ed9 100644 --- a/services/control-plane/env.example +++ b/services/control-plane/env.example @@ -1,6 +1,6 @@ # Copy to .env next to docker-compose.yml (gitignored); docker compose picks # it up automatically. Same convention as services/fleet-prometheus, -# services/llm-gateway, services/gokapi, services/ollama. +# services/llm-gateway, services/ollama. # Tailscale IP of the VPS node. The operator-ui port (18180) is published as # ${TAILSCALE_BIND_IP}:18180:8080 so the mesh-facing bind is never 0.0.0.0. diff --git a/services/gokapi/README.md b/services/gokapi/README.md deleted file mode 100644 index 6b69b3e..0000000 --- a/services/gokapi/README.md +++ /dev/null @@ -1,5 +0,0 @@ -# gokapi - -Lekki self-hosted "Firefox Send" alternative — link do jednego pliku, na zewnątrz, z limitem pobrań/czasu. **Osobny serwis od Nextclouda, celowo.**. - -Dokumentacja: [kb/services/gokapi.md](../../kb/services/gokapi.md) diff --git a/services/gokapi/docker-compose.yml b/services/gokapi/docker-compose.yml deleted file mode 100644 index 1d63b5e..0000000 --- a/services/gokapi/docker-compose.yml +++ /dev/null @@ -1,43 +0,0 @@ -# Gokapi — public file-share (Firefox Send-style), separate from Nextcloud. -# -# Nextcloud stays the private "twierdza" (mesh/kapala.org only). Gokapi is -# the OPPOSITE end of the spectrum on purpose: a small, single-container, -# genuinely public link-share for sending someone outside the mesh a file. -# Runs on VPS (Hetzner, public host) — home nodes stay untouched. -services: - gokapi: - # Pinned to the current stable release (v2.2.4, verified against - # github.com/Forceu/Gokapi releases + Docker Hub f0rc3/gokapi tags on - # 2026-07-09) — never :latest, so upgrades are a deliberate git diff, - # same convention as nextcloud. - image: f0rc3/gokapi:v2.2.4 - container_name: gokapi - restart: unless-stopped - env_file: - - .env - volumes: - # /opt/homelab/data convention. `data` holds uploaded files (churns - # constantly — links expire and get deleted); `config` holds - # config.json + the E2E encryption master key. See README backup note: - # config is the part that actually needs backing up. - - /opt/homelab/data/gokapi/data:/app/data - - /opt/homelab/data/gokapi/config:/app/config - ports: - # PUBLIC reachability is via npm@VPS + share.okit.pl, NOT this bind. - # Bound ONLY to the VPS Tailscale interface (TAILSCALE_BIND_IP), never - # 0.0.0.0 — same defense-in-depth convention as fleet-prometheus: the - # raw port does not exist on the public Hetzner IP (135.181.153.108) - # at all. npm, running as its own container on the same host, reaches - # gokapi via Docker hairpin NAT through this real interface IP - # (loopback would NOT work for that trick — see fleet-prometheus / - # nextcloud for the same pattern). Requires .env (from env.example) - # next to this file at deploy. - - "${TAILSCALE_BIND_IP}:53842:53842" - # Image ships curl (alpine-based), so an in-container check works here — - # unlike vikunja's image, which has neither curl nor wget. - healthcheck: - test: ["CMD", "curl", "-fs", "--max-time", "5", "http://127.0.0.1:53842/"] - interval: 30s - timeout: 10s - retries: 5 - start_period: 15s diff --git a/services/gokapi/env.example b/services/gokapi/env.example deleted file mode 100644 index bd13fe7..0000000 --- a/services/gokapi/env.example +++ /dev/null @@ -1,47 +0,0 @@ -# Gokapi host-local binds + disk-protection tuning — copy to .env (gitignored) -# next to docker-compose.yml and fill in real values. Never commit .env. -# No auth secrets here: Gokapi has no headless admin env vars — the admin -# account is created in the one-time /setup web wizard (see README). - -# Tailscale IP of the VPS node (ubuntu-4gb-hel1-1). Bind the gokapi port -# ONLY to this interface — never 0.0.0.0. The public internet never reaches -# port 53842 directly; share.okit.pl reaches gokapi only through npm@VPS -# (which runs on the same host and connects to this IP via Docker hairpin -# NAT — see docker-compose.yml). Verify when rebuilding the host: -# tailscale ip -4. -TAILSCALE_BIND_IP=100.95.58.48 - -TZ=Europe/Warsaw - -# --- Disk protection ------------------------------------------------------- -# VPS has an 80 GB disk shared with npm, outline, joplin, ai-cluster, -# fleet-prometheus's TSDB, etc. — gokapi is NOT the only tenant, and it has -# no S3 backend (local disk only, by design). Keep uploads small and leave -# headroom so expiring links actually reclaim space before the disk fills. - -# Per-file upload cap in MB. 5120 = 5 GB. Upstream default is 102400 -# (100 GB), which would let a single upload fill the whole disk. -GOKAPI_MAX_FILESIZE=5120 - -# Refuse new uploads once free disk space drops below this many MB. Upstream -# default is 400; raised here for the same reason as above. -GOKAPI_MIN_FREE_SPACE=2048 - -# npm@VPS and gokapi run on the same host; npm reaches gokapi's Tailscale- -# bound port via Docker hairpin NAT, so the connection arrives from the -# docker bridge gateway, not the real client IP. Trust that range so -# X-Forwarded-For / IP logging work correctly — same lesson as nextcloud's -# TRUSTED_PROXIES. Narrow to the exact /24 once the stack is up on the live -# host: docker network inspect gokapi_default. -GOKAPI_TRUSTED_PROXIES=172.16.0.0/12 - -# --- NOT env vars — Gokapi has no headless config for these. Set them in -# the one-time /setup wizard on first boot (see README Cutover checklist): -# - Admin username/password (Authentication step) -# - Storage backend: Local (Storage step — NOT S3, -# per Oskar's decision) -# - Encryption level: End-to-End (Level 3) (Encryption step — -# Oskar wants E2E ON) -# - Default expiry / max downloads: there is NO global default in Gokapi — -# it's chosen per-upload in the web form. Use conservative values (e.g. -# 7 days / 10 downloads) each time to keep the disk from filling. diff --git a/services/gokapi/healthcheck.sh b/services/gokapi/healthcheck.sh deleted file mode 100755 index f4bffd4..0000000 --- a/services/gokapi/healthcheck.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash -# Healthcheck for gokapi (public file-share, https://share.okit.pl via npm@VPS) - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" - -# The port is bound to the Tailscale interface only, so localhost won't answer. -# Read the bind IP from .env (same file compose uses for the port mapping). -if [ -f "$SCRIPT_DIR/.env" ]; then - # shellcheck disable=SC1091 - source "$SCRIPT_DIR/.env" -fi -BIND_IP="${TAILSCALE_BIND_IP:-127.0.0.1}" - -# Container must be running -if ! docker ps --filter "name=gokapi" --filter "status=running" | grep -qw "gokapi"; then - echo "[FAIL] gokapi container is not running" - exit 1 -fi - -# Web server must answer (setup wizard or login page, either is fine) -if ! curl -sf --max-time 5 "http://${BIND_IP}:53842/" > /dev/null; then - echo "[FAIL] gokapi is not responding on ${BIND_IP}:53842" - exit 1 -fi - -echo "[OK] gokapi is healthy" -exit 0 diff --git a/services/gokapi/service.yaml b/services/gokapi/service.yaml deleted file mode 100644 index 1116228..0000000 --- a/services/gokapi/service.yaml +++ /dev/null @@ -1,34 +0,0 @@ -service: - name: gokapi - owner_node: vps - role: public-file-share # Firefox Send-style link sharing, deliberately separate from Nextcloud - exposure: public # public via npm@VPS (share.okit.pl). The container's own port binds - # to TAILSCALE_BIND_IP only, never 0.0.0.0 — npm is the sole public - # entry point (see docker-compose.yml). Same pattern as vikunja. - dependencies: [] # standalone; npm@VPS proxies to it but gokapi has no upstream deps - ports: - - container: 53842 - host: 53842 - protocol: tcp - healthcheck: - type: http - endpoint: http://localhost:53842/ # setup wizard until first admin login, then the login page - interval: 30s - timeout: 10s - retries: 5 - restart_policy: unless-stopped - persistence: - paths: - - /opt/homelab/data/gokapi/data # uploaded files — ephemeral by design, links expire - - /opt/homelab/data/gokapi/config # config.json + E2E encryption master key — BACK THIS UP - runtime: - config_files: - - .env # host-local binds + disk-protection tuning (gitignored, from env.example) - env_vars: - - TAILSCALE_BIND_IP # required — mesh-only port bind; npm@VPS reaches it via hairpin NAT - - GOKAPI_MAX_FILESIZE # per-file cap in MB — keeps the shared VPS disk from filling - - GOKAPI_MIN_FREE_SPACE # MB headroom before uploads are refused - - GOKAPI_TRUSTED_PROXIES # npm@VPS as seen through Docker hairpin NAT (docker bridge subnet) - # No admin/auth env vars: Gokapi has no headless setup — admin account, - # storage backend, encryption level are all set in the /setup web - # wizard on first boot (deploy-time step, see README).