From 16ac177782f528e88a998e789541121fd0dc9016 Mon Sep 17 00:00:00 2001 From: Mikei386 <44135113+Mikei386@users.noreply.github.com> Date: Tue, 1 Sep 2026 10:54:22 +0200 Subject: [PATCH] Make gateway-bound UIs reproducible --- ATHENA.md | 3 ++- compose.yaml | 22 ++++++++++++++++++++++ docs/RECOVERY.md | 7 +++---- install.sh | 4 +++- manage.sh | 11 ++++++++++- restore.sh | 3 ++- 6 files changed, 42 insertions(+), 8 deletions(-) diff --git a/ATHENA.md b/ATHENA.md index 56eff27..b8e93e0 100644 --- a/ATHENA.md +++ b/ATHENA.md @@ -33,7 +33,8 @@ werden keine zweiten Instanzen dieser Dienste angelegt. Portainer läuft als separater, optionaler Verwaltungscontainer `mike-ai-portainer`, teilt den Netzwerk-Namespace des WireGuard-Gateways und ist unter `https://192.168.1.212:9443` erreichbar. Seine Einstellungen liegen -im Docker-Volume `portainer_data`. Portainer beobachtet beziehungsweise +im Docker-Volume `portainer_data`, das vom Athena-Backup mitgesichert wird. +Portainer beobachtet beziehungsweise verwaltet Docker, ist aber keine Abhängigkeit des Inferenz-Stacks. ## Standardbefehle diff --git a/compose.yaml b/compose.yaml index 1f27168..8f33ae1 100644 --- a/compose.yaml +++ b/compose.yaml @@ -50,6 +50,11 @@ services: - /tmp:size=16m,mode=1777 volumes: - "${WIREGUARD_CONFIG_FILE:-/etc/mike-ai/wireguard/fritz-athena.conf}:/run/secrets/fritz-athena.conf:ro" + # Namespace-sharing services cannot publish ports themselves. The owner + # must keep these bindings so a gateway recreation cannot hide their UIs. + ports: + - "8099:8099" + - "9443:9443" networks: frontend: ipv4_address: 172.30.10.254 @@ -750,6 +755,20 @@ services: retries: 12 start_period: 10s + portainer: + image: ${PORTAINER_IMAGE:-portainer/portainer-ce@sha256:511f3f06c96fe3b993ebeaafde311c1959cae73a7ef825dba6397d51b450dffa} + container_name: mike-ai-portainer + restart: unless-stopped + network_mode: "service:wireguard-gateway" + command: [--no-setup-token] + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - portainer-data:/data + depends_on: + wireguard-gateway: + condition: service_healthy + security_opt: ["no-new-privileges:true"] + backup: image: ${BACKUP_IMAGE:-offen/docker-volume-backup@sha256:19102d8e59eb1d598cf8c647c2b21100abaadc5a1c808ac643fa612e323c3013} container_name: mike-ai-backup @@ -768,6 +787,7 @@ services: - piper-data:/backup/volumes/piper-data:ro - router-state:/backup/volumes/router-state:ro - router-images:/backup/volumes/router-images:ro + - portainer-data:/backup/volumes/portainer-data:ro security_opt: ["no-new-privileges:true"] networks: @@ -794,3 +814,5 @@ volumes: piper-data: router-state: router-images: + portainer-data: + name: portainer_data diff --git a/docs/RECOVERY.md b/docs/RECOVERY.md index 97e716c..e8e2897 100644 --- a/docs/RECOVERY.md +++ b/docs/RECOVERY.md @@ -15,10 +15,9 @@ Sie bleiben auf der Daten-SSD oder werden anhand der gepinnten Angaben in `config/install.env.example` erneut geladen. Die Dashboard-Historie liegt dauerhaft unter `/data/llama-dashboard`. -Der optionale Portainer-Container gehört nicht zum Athena-Kern. Seine lokale -Konfiguration liegt im Docker-Volume `portainer_data`; ohne dessen Sicherung -kann Portainer jederzeit neu angelegt und einmalig eingerichtet werden, ohne -Router, Modelle oder Dashboard-Daten zu verlieren. +Portainers lokale Konfiguration liegt im Docker-Volume `portainer_data` und +wird zusammen mit den übrigen nicht reproduzierbaren Volumes gesichert und +wiederhergestellt. ### Neuaufbau diff --git a/install.sh b/install.sh index febb20b..1f8e47d 100755 --- a/install.sh +++ b/install.sh @@ -491,7 +491,9 @@ build_and_start() { llama-fast llama-medium llama-large llama-ultra llama-uncensored docker compose --env-file "$SECRETS_DIR/stack.env" --profile image create image-worker docker compose --env-file "$SECRETS_DIR/stack.env" up -d --build \ - wireguard-gateway xtts piper tts-gateway profile-controller router llama-dashboard backup + wireguard-gateway xtts piper tts-gateway profile-controller router llama-dashboard portainer backup + docker compose --env-file "$SECRETS_DIR/stack.env" up -d \ + --no-deps --force-recreate llama-dashboard portainer if [[ ${WIREGUARD_MODE:-container} == container ]]; then systemctl restart mike-ai-container-vpn-guard.service fi diff --git a/manage.sh b/manage.sh index 469fb9b..7a1ea39 100755 --- a/manage.sh +++ b/manage.sh @@ -49,9 +49,18 @@ case "$command" in [[ $# -eq 0 ]] || { echo "core akzeptiert keine weiteren Services" >&2; exit 2; } run "$ROOT_DIR/platform/mcp/install-tools.sh" run "${compose[@]}" up -d --build \ - wireguard-gateway piper xtts tts-gateway profile-controller router llama-dashboard backup + wireguard-gateway piper xtts tts-gateway profile-controller router llama-dashboard portainer backup + # network_mode: service:wireguard-gateway stores the gateway container + # ID. Rebind namespace consumers after every gateway replacement. + run "${compose[@]}" up -d --no-deps --force-recreate llama-dashboard portainer else run "${compose[@]}" up -d --build --no-deps "$@" + for service in "$@"; do + if [[ $service == wireguard-gateway ]]; then + run "${compose[@]}" up -d --no-deps --force-recreate llama-dashboard portainer + break + fi + done fi ;; purge-legacy) diff --git a/restore.sh b/restore.sh index f187292..87d0eb6 100755 --- a/restore.sh +++ b/restore.sh @@ -60,7 +60,7 @@ backup_root=$work/backup [[ -d $backup_root/volumes ]] || die "Backup enthält keine Docker-Volumes." # Stop only users of the restored volumes. WireGuard, SSH and networking stay up. -for container in mike-ai-router mike-ai-profile-controller mike-ai-piper; do +for container in mike-ai-router mike-ai-profile-controller mike-ai-piper mike-ai-portainer; do if [[ $(docker inspect -f '{{.State.Running}}' "$container" 2>/dev/null || true) == true ]]; then docker stop "$container" >/dev/null fi @@ -81,6 +81,7 @@ restore_volume() { restore_volume mike-ai_piper-data "$backup_root/volumes/piper-data" restore_volume mike-ai_router-state "$backup_root/volumes/router-state" restore_volume mike-ai_router-images "$backup_root/volumes/router-images" +restore_volume portainer_data "$backup_root/volumes/portainer-data" cd "$ROOT_DIR" ./manage.sh deploy core