Oskar Kapala e5c6bfe830 fix(vikunja): align compose with known-good live instance (review fixes)

Addresses review findings — all reverting to the live config that worked:

- config.yml mounts at /app/vikunja/config.yml (live path), not /etc/vikunja.
- Remove the vikunja container healthcheck: the image ships no wget/curl, so
  an in-container HTTP check is always unhealthy. Health stays on db
  (pg_isready) + host-side healthcheck.sh (curl). Live had no app healthcheck.
- Secrets injected exclusively via env_file (.env) on BOTH services; dropped
  the ${VAR:?} parse-time interpolation that depended on a .env in cwd. db now
  also has env_file. Non-secret env stays inline.
- Rename .env.example -> env.example to match repo convention (forgejo).

Verified: `docker compose -f services/vikunja/docker-compose.yml config` passes;
services/vikunja/.env is gitignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-17 15:25:25 +02:00

1.8 KiB

Raw Blame History

Vikunja

Self-hosted task management. Runs on the PIHA node with a dedicated PostgreSQL backend, exposed publicly at https://vikunja.okit.pl via the npm reverse proxy on PIHA. Login is via Forgejo OIDC.

Stack

Container	Image	Purpose
`vikunja`	`vikunja/vikunja:latest`	App + API (port 3456)
`vikunja-db`	`postgres:16-alpine`	PostgreSQL (service alias `db`)

Data (do not move)

Persistent state lives in pre-existing Docker named volumes — these are pinned by name so the live data survives cutover:

vikunja_vikunja_db → /var/lib/postgresql/data
vikunja_vikunja_files → /app/vikunja/files

Configuration

config.yml — committed, secret-free. Holds OIDC provider metadata.
.env — gitignored. Copy from env.example and fill with the real live values (must be identical to the running instance):
- POSTGRES_PASSWORD / VIKUNJA_DATABASE_PASSWORD (same value)
- VIKUNJA_SERVICE_JWTSECRET
- VIKUNJA_AUTH_OPENID_PROVIDERS_FORGEJO_CLIENTSECRET

Notes

forgejo.okit.pl is pinned via extra_hosts to 192.168.31.5 (npm on PIHA) so OIDC discovery resolves over the LAN, avoiding flaky public DNS.
Both redirecturl and the provider authurl MUST keep their trailing slash — the authurl must match the OIDC issuer exactly or discovery fails.

Cutover checklist

git pull on PIHA.
Create services/vikunja/.env from env.example with the real values.
Confirm the named volumes exist: docker volume ls | grep vikunja_vikunja.
docker compose -f services/vikunja/docker-compose.yml up -d.
Verify: ./healthcheck.sh and a test OIDC login.

1.8 KiB Raw Blame History