Lukas
c4ede71fa6
Addresses: Backend session cache not cluster-safe (multi-worker issue) Problem: - Session cache is process-local (InMemorySessionCache) - Multi-worker deployments (uvicorn --workers N) create separate processes - Each process has its own independent session cache - Sessions cached in Worker A are invisible to Workers B, C, D - Users randomly logged out when requests land on different workers - Also affects RuntimeState, rate limiter, and background jobs Solution (Option A - Strict single-worker enforcement): - Enhance startup validation with clearer error messages - Update error messages to explain the problem and how to fix it - Document single-worker requirement prominently in Docker configs - Update module docstrings to clarify constraints Changes: 1. app/startup.py: - Enhanced _check_single_worker_mode() error message with troubleshooting - Enhanced _stage_check_worker_mode_and_acquire_lock() error message - Removed unused import 2. app/utils/session_cache.py: - Updated module docstring to explain constraints more clearly - Added references to deployment documentation - Clarified multi-worker solution for future implementation 3. app/utils/runtime_state.py: - Updated module docstring with deployment constraint references - Aligned messaging with session_cache.py 4. Docker/Dockerfile.backend: - Added comprehensive comments about single-worker requirement - Explained impact in multi-worker deployments - Referenced deployment constraints documentation 5. Docker/docker-compose.yml, compose.prod.yml, compose.debug.yml: - Added documentation comments about BANGUI_WORKERS constraint - Explained why single-worker is required 6. backend/tests/test_startup_integration.py: - Fixed test unpacking to match function return signature (3 values, not 2) This ensures multi-worker deployments fail loudly at startup with clear guidance on what went wrong and how to fix it. The database-backed scheduler lock provides defense-in-depth for container orchestration scenarios. For future multi-worker support, implement: - Redis or database-backed session cache - Shared RuntimeState coordination - Distributed APScheduler backend Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
75 lines
2.4 KiB
YAML
75 lines
2.4 KiB
YAML
version: '3.8'
|
|
services:
|
|
fail2ban:
|
|
image: lscr.io/linuxserver/fail2ban:latest
|
|
container_name: fail2ban
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
network_mode: host
|
|
environment:
|
|
- PUID=1011
|
|
- PGID=1001
|
|
- TZ=Etc/UTC
|
|
- VERBOSITY=-vv #optional
|
|
|
|
volumes:
|
|
- /server/server_fail2ban/config:/config
|
|
- /server/server_fail2ban/fail2ban-run:/var/run/fail2ban
|
|
- /var/log:/var/log
|
|
- /server/server_nextcloud/config/nextcloud.log:/remotelogs/nextcloud/nextcloud.log:ro #optional
|
|
- /server/server_nginx/data/logs:/remotelogs/nginx:ro #optional
|
|
- /server/server_gitea/log/gitea.log:/remotelogs/gitea/gitea.log:ro #optional
|
|
|
|
|
|
#- /path/to/homeassistant/log:/remotelogs/homeassistant:ro #optional
|
|
#- /path/to/unificontroller/log:/remotelogs/unificontroller:ro #optional
|
|
#- /path/to/vaultwarden/log:/remotelogs/vaultwarden:ro #optional
|
|
restart: unless-stopped
|
|
|
|
backend:
|
|
image: git.lpl-mind.de/lukas.pupkalipinski/bangui/backend:latest
|
|
container_name: bangui-backend
|
|
restart: unless-stopped
|
|
depends_on:
|
|
fail2ban:
|
|
condition: service_started
|
|
environment:
|
|
- PUID=1011
|
|
- PGID=1001
|
|
- BANGUI_DATABASE_PATH=/data/bangui.db
|
|
- BANGUI_FAIL2BAN_SOCKET=/var/run/fail2ban/fail2ban.sock
|
|
- BANGUI_FAIL2BAN_CONFIG_DIR=/config/fail2ban
|
|
- BANGUI_LOG_LEVEL=info
|
|
# ⚠️ BANGUI_WORKERS MUST be 1 — the session cache is process-local
|
|
# Multiple workers would cause random logouts and duplicate background jobs
|
|
- BANGUI_SESSION_SECRET=${BANGUI_SESSION_SECRET:?Set BANGUI_SESSION_SECRET}
|
|
- BANGUI_TIMEZONE=${BANGUI_TIMEZONE:-UTC}
|
|
volumes:
|
|
- /server/server_fail2ban/bangui-data:/data
|
|
- /server/server_fail2ban/fail2ban-run:/var/run/fail2ban:ro
|
|
- /server/server_fail2ban/config:/config:rw
|
|
expose:
|
|
- "8000"
|
|
networks:
|
|
- bangui-net
|
|
|
|
# ── Frontend (nginx serving built SPA + API proxy) ──────────
|
|
frontend:
|
|
image: git.lpl-mind.de/lukas.pupkalipinski/bangui/frontend:latest
|
|
container_name: bangui-frontend
|
|
restart: unless-stopped
|
|
environment:
|
|
- PUID=1011
|
|
- PGID=1001
|
|
ports:
|
|
- "${BANGUI_PORT:-8080}:80"
|
|
depends_on:
|
|
backend:
|
|
condition: service_started
|
|
networks:
|
|
- bangui-net
|
|
|
|
networks:
|
|
bangui-net:
|
|
name: bangui-net |