mirror of
https://github.com/migatu/conjurer.git
synced 2026-07-14 13:34:40 +00:00
Michal Tuszowski
2a21fc9e8c
Permissions post-mortem that motivated this: the musician wrote radio playlists AS ROOT onto a ROOT-OWNED network share which liquidsoap then read AS USER 'radio' - chown fails on such shares by design (root squash / uid mapping), so the radio came up and died on the playlists. The fix is structural: the playlist WRITER now lives in the same container as the READER, as the same user, on a local volume. No shared partition, no chown, no uid mapping. New: conjurer_betoniarka/betoniarka.py - runs inside the radio container (started by the entrypoint as user 'radio', port 5005): - library scan -> all_playlist/hit playlists with LOCAL container paths (start + every 24h + authenticated GET /rescan) - bot-facing radio API moved from the musician: /add_to_priority, /create_priority_playlist, /request_radio_file, /clear_pr_pls, plus GET /ping (health) and /stream (web page) - radio_log/persistence tailer forwarding play events to the bot's /prepped_tracks with the shared API key (bot-unreachable = logged, not fatal) Musician: pure Discord music player now - keeps /mp3, /update_mp3, /get_music and the file-share endpoints; all radio playlist writing, radio paths/env and the tailer removed. Bot: new CONJURER_RADIO_SERVICE (defaults to CONJURER_FILE_SERVICE so un-split deployments keep working); radio_commands targets it; separate 'radio' health-gate group on betoniarka /ping (musician group now covers music_commands + file_search_commands only). Docker: betoniarka baked into the radio image (python3 + flask/waitress/ requests from Debian debs), port 5005 exposed, entrypoint starts it via setpriv as 'radio'; data-volume chown is now best-effort with a loud warning (keep the volume local); docs get the post-mortem + wiring. Verified: py_compile everything; functional stub tests - rescan writes local-path playlists, wyszukaj scores and appends to priority, auth 401/ok, tailer forward carries the API key. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
1.6 KiB
Bash
43 lines
1.6 KiB
Bash
# Copy to docker/env/bot.env and fill in. Do NOT commit the real file.
|
|
|
|
# --- Secrets ------------------------------------------------------------
|
|
# Option A: mount a netrc (recommended — covers discord/openai/spotipy/youtube).
|
|
CONJURER_NETRC_FILE=/secrets/.netrc
|
|
# Option B: pass tokens directly (these take precedence over netrc).
|
|
# DISCORD_TOKEN=
|
|
# OPENAI_API_KEY=
|
|
# ASSEMBLYAI_API_KEY= # voice recognition; netrc machine 'assemblyai' works too
|
|
# YOUTUBE_USERNAME=
|
|
# YOUTUBE_PASSWORD=
|
|
|
|
# --- Data ---------------------------------------------------------------
|
|
# Single mounted volume; all writable state is rooted here.
|
|
CONJURER_DATA_DIR=/data
|
|
|
|
# --- Flask comm layer (inbound from musician/librarian) -----------------
|
|
CONJURER_DISCORD_HOST=0.0.0.0
|
|
CONJURER_DISCORD_PORT=5000
|
|
|
|
# --- Internal service auth ----------------------------------------------
|
|
# Set the SAME value on bot + musician + librarian. Empty = auth disabled.
|
|
CONJURER_API_KEY=
|
|
|
|
# --- Where the bot reaches the other services (other Proxmox VMs) --------
|
|
CONJURER_FILE_SERVICE=http://MUSICIAN_VM_IP:5000
|
|
# Betoniarka (radio-operator API, runs in the radio container):
|
|
CONJURER_RADIO_SERVICE=http://RADIO_VM_IP:5005
|
|
# Liquidsoap harbor /skip (same radio container):
|
|
CONJURER_RADIO_HARBOR=http://RADIO_VM_IP:54321
|
|
CONJURER_LIBRARIAN_SERVICE=http://LIBRARIAN_VM_IP:5001
|
|
|
|
# --- Conan Exiles bridge (optional; empty/0 = disabled) -----------------
|
|
# CONAN_GM_ROLE_ID=0
|
|
# CONAN_RCON_HOST=
|
|
# CONAN_RCON_PORT=25575
|
|
# CONAN_RCON_PASSWORD=
|
|
# CONAN_CHAT_CHANNEL_ID=0
|
|
# CONAN_EVENTS_CHANNEL_ID=0
|
|
# CONAN_JOIN_CHANNEL_ID=0
|
|
# CONAN_LOG_MODE=local
|
|
# CONAN_LOG_PATH=
|