callback container integrated fully

2026-08-09 13:17:44 +02:00
parent 639c2b68c8
commit 5594431749
12 changed files with 196 additions and 65 deletions
@@ -15,7 +15,7 @@ mkdir -p data/config data/uploads data/logs data/backups data/scripts data/postg
 Create a `.env` file. Use strong, unique values for all secrets:

 ```env
-ASSETMANAGER_VERSION=0.5.5.47
+ASSETMANAGER_VERSION=0.5.5.65
 APP_PORT=8088
 POSTGRES_DB=assetmanager
 POSTGRES_USER=assetmanager
@@ -27,6 +27,8 @@ MESHCENTRAL_PASSWORD=
 LDAP_BIND_PASSWORD=
 BACKUP_INTERVAL_HOURS=8
 BACKUP_RETENTION_DAYS=3
+CALLBACK_BIND_IP=127.0.0.1
+CALLBACK_PORT=8090
 ```

 Keep `.env` private. Do not commit it to a public repository.
@@ -56,7 +58,7 @@ services:
      retries: 10

  app:
-    image: git.jusaro.de/roland/assetmanager:${ASSETMANAGER_VERSION:-0.5.5.47}
+    image: git.jusaro.de/roland/assetmanager:${ASSETMANAGER_VERSION:-0.5.5.65}
    container_name: assetmanager-app
    restart: unless-stopped
    depends_on:
@@ -77,6 +79,8 @@ services:
      SESSION_SECRET: ${SESSION_SECRET:-}
      LOCAL_ADMIN_USERNAME: ${LOCAL_ADMIN_USERNAME:-}
      LOCAL_ADMIN_PASSWORD: ${LOCAL_ADMIN_PASSWORD:-}
+      CALLBACK_BIND_IP: ${CALLBACK_BIND_IP:-127.0.0.1}
+      CALLBACK_PORT: ${CALLBACK_PORT:-8090}
    ports:
      - "${APP_PORT:-8088}:8000"
    volumes:
@@ -85,6 +89,34 @@ services:
      - ./data/logs:/app/data/logs
      - ./data/backups:/data/backups
      - ./data/scripts:/scripts
+
+  callback:
+    image: git.jusaro.de/roland/assetmanager:${ASSETMANAGER_VERSION:-0.5.5.65}
+    container_name: assetmanager-callback
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-assetmanager}:${POSTGRES_PASSWORD:-change-me}@db:5432/${POSTGRES_DB:-assetmanager}
+      APP_TITLE: AssetManager
+      APP_CONFIG: /app/config/config.json
+      APPINFO_PATH: /app/config/APPINFO.json
+      MESHCENTRAL_PASSWORD: ${MESHCENTRAL_PASSWORD:-}
+      LDAP_BIND_PASSWORD: ${LDAP_BIND_PASSWORD:-}
+      SESSION_SECRET: ${SESSION_SECRET:-}
+    command: ["uvicorn", "app.main:callback_app", "--host", "0.0.0.0", "--port", "8001"]
+    ports:
+      - "${CALLBACK_BIND_IP:-127.0.0.1}:${CALLBACK_PORT:-8090}:8001"
+    volumes:
+      - ./data/config:/app/config
+      - ./data/logs:/app/data/logs
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8001/api/software-callback/health', timeout=3).read()"]
+      interval: 30s
+      timeout: 5s
+      start_period: 10s
+      retries: 3
 ```

 If the registry is private, sign in once on the Docker host:
@@ -186,7 +218,7 @@ Back up `.env` and the complete `data/` directory before significant updates.
 Set the desired fixed image version in `.env`, for example:

 ```env
-ASSETMANAGER_VERSION=0.5.5.47
+ASSETMANAGER_VERSION=0.5.5.65
 ```

 Then update:
@@ -280,39 +312,50 @@ docker compose pull
 docker compose up -d
 ```

-You can verify the active mount with:
-
-```bash
-```
-
 Images copied directly into `./data/uploads/library` are available in the AssetManager image library after reloading the page.


-## Optional dedicated callback port / DMZ listener
+## Dedicated callback port / DMZ listener

-AssetManager can expose software-job callbacks through a separate, callback-only Docker service. This is useful when remote devices must send callbacks through an Internet-facing FQDN while the normal AssetManager web interface remains internal.
+AssetManager starts a separate callback-only Docker service together with the normal application. This is intended for remote devices that must return job results through an Internet-facing FQDN while the AssetManager web interface remains internal.

-The optional service exposes only:
+The callback service exposes only:

 - `GET /api/software-callback/health`
 - `POST /api/software-jobs/{job_id}/callback`

 It does not expose the AssetManager UI, login, assets, settings, static files, or administration routes.

-Set the desired host port in `.env`:
+Configure the host-side listener in `.env`:

 ```env
+CALLBACK_BIND_IP=127.0.0.1
 CALLBACK_PORT=8090
 ```

-Start the additional service:
+`127.0.0.1` is a good default when the reverse proxy runs on the same Docker host. If a reverse proxy or firewall on another system must reach the listener, bind it to the appropriate host interface or, when explicitly required, `0.0.0.0`.
+
+The normal stack is started with the usual command; no Compose profile is required:

 ```bash
-docker compose --profile callback up -d callback
+docker compose up -d
 ```

-The internal callback container listens on port `8001`; Docker maps the configured host port to it. A reverse proxy or firewall can therefore publish only this port/service. For example, a public `https://callback.example.org` can proxy to the Docker host on port `8090`. Configure that public URL under **Software and Jobs → Settings → Callback base URL**.
+The internal callback container listens on port `8001`. Docker maps `CALLBACK_BIND_IP:CALLBACK_PORT` to that internal port. A public `https://callback.example.org` can therefore proxy only to the callback listener, while the normal AssetManager web interface remains on `APP_PORT` (default `8088`).

-The standard AssetManager application continues to run on `APP_PORT` (default `8088`). The dedicated callback service is optional; installations that do not enable the `callback` profile behave as before.
+Configure the public URL under **Software and Jobs → Settings → Callback base URL**:

-For image-based installations, use the same AssetManager image for both the `app` and `callback` services instead of `build: .`. The callback service must always run the same version as the main application.
+```text
+https://callback.example.org
+```
+
+### Health checks from the GUI
+
+The callback settings page provides two separate tests:
+
+- **Internal health check** tests `http://callback:8001/api/software-callback/health` from the main AssetManager container. This verifies Docker networking and the callback-only service.
+- **Public health check** tests the configured callback base URL through DNS/TLS/reverse proxy. This verifies the route that remote clients are expected to use.
+
+The GUI displays reachability, HTTP status, response time, and the tested URL. The detailed callback diagnostic log remains available on the same settings page.
+
+For image-based installations, use the same fixed AssetManager image version for both the `app` and `callback` services.
@@ -5,12 +5,14 @@

 Release notes are stored outside the project root to keep the repository overview compact.

-The current release is **0.5.5.47**.
+The current release is **0.5.5.65**.

 Older notes are concise English summaries migrated from the original release documents. Git history remains authoritative for exact implementation details.

 ## Releases

+- [0.5.5.65](UPDATE-0.5.5.65.md)
+
 - [0.5.5.47](UPDATE-0.5.5.47.md)
 - [0.5.5.46](UPDATE-0.5.5.46.md)
 - [0.5.5.45](UPDATE-0.5.5.45.md)
@@ -0,0 +1,10 @@
+# Update 0.5.5.65
+
+## Callback service lifecycle, health tests, and documentation
+
+- The callback-only Docker service now starts with the normal Compose stack; the callback profile is no longer required.
+- Added `CALLBACK_BIND_IP` so deployments can bind the callback listener to loopback, a selected host interface, or explicitly all interfaces.
+- Added separate internal and public callback health checks in the GUI with tested URL, HTTP status, response time, and reachability result.
+- The internal test validates Docker service networking; the public test validates the configured FQDN/reverse-proxy path.
+- Updated installation, security, README, environment example, and callback deployment documentation.
+- Reworded the repository warning about `.env` and runtime data as normal deployment/security guidance rather than a development note.