mirror of
https://github.com/migatu/conjurer.git
synced 2026-07-14 21:38:38 +00:00
Michal Tuszowski
f17cf7fdd8
- Liquidsoap refuses to start as root (init: security exit). Instead of the settings.init.allow_root override, the image now has a dedicated 'radio' user (audio + pulse-access groups) and the entrypoint drops privileges via setpriv after doing its root-only work (volume seeding, icecast config render/start, pulse start, chown of the data volume). The icecast secret is made group-readable (640 root:radio) because the script parses it directly. - The opam root moved from /root/.opam to /opt/opam so the liquidsoap binary AND its stdlib .liq files are readable by the radio user. NOTE: this invalidates the cached opam build layer - next build recompiles liquidsoap (~15-20 min). - pulseaudio (PULSE_MODE=internal) now starts with --disallow-module-loading: system.pa startup modules still load, only later client-requested loads are blocked, and the system-mode warning goes away. The 'forcibly disabling SHM mode' notice is inherent to system mode and harmless (documented). Keeps the user's libcurl4-gnutls-dev build-dep fix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>