callback container integrated fully

docs/INSTALLATION.md

@@ -15,7 +15,7 @@ mkdir -p data/config data/uploads data/logs data/backups data/scripts data/postg
 Create a `.env` file. Use strong, unique values for all secrets:
 
 ```env
-ASSETMANAGER_VERSION=0.5.5.47
+ASSETMANAGER_VERSION=0.5.5.65
 APP_PORT=8088
 POSTGRES_DB=assetmanager
 POSTGRES_USER=assetmanager
@@ -27,6 +27,8 @@ MESHCENTRAL_PASSWORD=
 LDAP_BIND_PASSWORD=
 BACKUP_INTERVAL_HOURS=8
 BACKUP_RETENTION_DAYS=3
+CALLBACK_BIND_IP=127.0.0.1
+CALLBACK_PORT=8090
 ```
 
 Keep `.env` private. Do not commit it to a public repository.
@@ -56,7 +58,7 @@ services:
       retries: 10
 
   app:
-    image: git.jusaro.de/roland/assetmanager:${ASSETMANAGER_VERSION:-0.5.5.47}
+    image: git.jusaro.de/roland/assetmanager:${ASSETMANAGER_VERSION:-0.5.5.65}
     container_name: assetmanager-app
     restart: unless-stopped
     depends_on:
@@ -77,6 +79,8 @@ services:
       SESSION_SECRET: ${SESSION_SECRET:-}
       LOCAL_ADMIN_USERNAME: ${LOCAL_ADMIN_USERNAME:-}
       LOCAL_ADMIN_PASSWORD: ${LOCAL_ADMIN_PASSWORD:-}
+      CALLBACK_BIND_IP: ${CALLBACK_BIND_IP:-127.0.0.1}
+      CALLBACK_PORT: ${CALLBACK_PORT:-8090}
     ports:
       - "${APP_PORT:-8088}:8000"
     volumes:
@@ -85,6 +89,34 @@ services:
       - ./data/logs:/app/data/logs
       - ./data/backups:/data/backups
       - ./data/scripts:/scripts
+
+  callback:
+    image: git.jusaro.de/roland/assetmanager:${ASSETMANAGER_VERSION:-0.5.5.65}
+    container_name: assetmanager-callback
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-assetmanager}:${POSTGRES_PASSWORD:-change-me}@db:5432/${POSTGRES_DB:-assetmanager}
+      APP_TITLE: AssetManager
+      APP_CONFIG: /app/config/config.json
+      APPINFO_PATH: /app/config/APPINFO.json
+      MESHCENTRAL_PASSWORD: ${MESHCENTRAL_PASSWORD:-}
+      LDAP_BIND_PASSWORD: ${LDAP_BIND_PASSWORD:-}
+      SESSION_SECRET: ${SESSION_SECRET:-}
+    command: ["uvicorn", "app.main:callback_app", "--host", "0.0.0.0", "--port", "8001"]
+    ports:
+      - "${CALLBACK_BIND_IP:-127.0.0.1}:${CALLBACK_PORT:-8090}:8001"
+    volumes:
+      - ./data/config:/app/config
+      - ./data/logs:/app/data/logs
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8001/api/software-callback/health', timeout=3).read()"]
+      interval: 30s
+      timeout: 5s
+      start_period: 10s
+      retries: 3
 ```
 
 If the registry is private, sign in once on the Docker host:
@@ -186,7 +218,7 @@ Back up `.env` and the complete `data/` directory before significant updates.
 Set the desired fixed image version in `.env`, for example:
 
 ```env
-ASSETMANAGER_VERSION=0.5.5.47
+ASSETMANAGER_VERSION=0.5.5.65
 ```
 
 Then update:
@@ -280,39 +312,50 @@ docker compose pull
 docker compose up -d
 ```
 
-You can verify the active mount with:
-
-```bash
-```
-
 Images copied directly into `./data/uploads/library` are available in the AssetManager image library after reloading the page.
 
 
-## Optional dedicated callback port / DMZ listener
+## Dedicated callback port / DMZ listener
 
-AssetManager can expose software-job callbacks through a separate, callback-only Docker service. This is useful when remote devices must send callbacks through an Internet-facing FQDN while the normal AssetManager web interface remains internal.
+AssetManager starts a separate callback-only Docker service together with the normal application. This is intended for remote devices that must return job results through an Internet-facing FQDN while the AssetManager web interface remains internal.
 
-The optional service exposes only:
+The callback service exposes only:
 
 - `GET /api/software-callback/health`
 - `POST /api/software-jobs/{job_id}/callback`
 
 It does not expose the AssetManager UI, login, assets, settings, static files, or administration routes.
 
-Set the desired host port in `.env`:
+Configure the host-side listener in `.env`:
 
 ```env
+CALLBACK_BIND_IP=127.0.0.1
 CALLBACK_PORT=8090
 ```
 
-Start the additional service:
+`127.0.0.1` is a good default when the reverse proxy runs on the same Docker host. If a reverse proxy or firewall on another system must reach the listener, bind it to the appropriate host interface or, when explicitly required, `0.0.0.0`.
+
+The normal stack is started with the usual command; no Compose profile is required:
 
 ```bash
-docker compose --profile callback up -d callback
+docker compose up -d
 ```
 
-The internal callback container listens on port `8001`; Docker maps the configured host port to it. A reverse proxy or firewall can therefore publish only this port/service. For example, a public `https://callback.example.org` can proxy to the Docker host on port `8090`. Configure that public URL under **Software and Jobs → Settings → Callback base URL**.
+The internal callback container listens on port `8001`. Docker maps `CALLBACK_BIND_IP:CALLBACK_PORT` to that internal port. A public `https://callback.example.org` can therefore proxy only to the callback listener, while the normal AssetManager web interface remains on `APP_PORT` (default `8088`).
 
-The standard AssetManager application continues to run on `APP_PORT` (default `8088`). The dedicated callback service is optional; installations that do not enable the `callback` profile behave as before.
+Configure the public URL under **Software and Jobs → Settings → Callback base URL**:
 
-For image-based installations, use the same AssetManager image for both the `app` and `callback` services instead of `build: .`. The callback service must always run the same version as the main application.
+```text
+https://callback.example.org
+```
+
+### Health checks from the GUI
+
+The callback settings page provides two separate tests:
+
+- **Internal health check** tests `http://callback:8001/api/software-callback/health` from the main AssetManager container. This verifies Docker networking and the callback-only service.
+- **Public health check** tests the configured callback base URL through DNS/TLS/reverse proxy. This verifies the route that remote clients are expected to use.
+
+The GUI displays reachability, HTTP status, response time, and the tested URL. The detailed callback diagnostic log remains available on the same settings page.
+
+For image-based installations, use the same fixed AssetManager image version for both the `app` and `callback` services.