From e08133dfc078113d6f0dd99014164f1271457f49 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 6 Nov 2026 10:30:41 +0000 Subject: [PATCH] library: BIND_ADDR for loopback-only mode, real readiness check - BIND_ADDR (default 0.0.0.0) on every published port; 127.0.0.1 keeps the stack reachable from the host only (Docker bypasses ufw, so this is the actual control the kiosk addon's 'this kiosk only' choice uses) - Koha serves its web-installer page with HTTP 200 before the database exists, so 'port answers' was not 'ready': the entrypoint now writes /run/koha-ready, the healthcheck requires it, and install.sh waits for healthy + the quick-add health endpoint Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_013wi3ZSot4XbUViwRFgLpRf --- library/docker-compose.yml | 6 +++--- library/install.sh | 11 ++++++++--- library/koha/Dockerfile | 4 ++-- library/koha/entrypoint.sh | 5 +++++ 4 files changed, 18 insertions(+), 8 deletions(-) diff --git a/library/docker-compose.yml b/library/docker-compose.yml index 0b6c1ec..df54865 100644 --- a/library/docker-compose.yml +++ b/library/docker-compose.yml @@ -38,8 +38,8 @@ services: KOHA_ADMIN_PASS: ${ADMIN_PASSWORD} KOHA_LIBRARY_NAME: ${LIBRARY_NAME:-My Library} ports: - - "${OPAC_PORT:-8080}:80" - - "${STAFF_PORT:-8081}:8081" + - "${BIND_ADDR:-0.0.0.0}:${OPAC_PORT:-8080}:80" + - "${BIND_ADDR:-0.0.0.0}:${STAFF_PORT:-8081}:8081" volumes: - koha-data:/var/lib/koha @@ -63,7 +63,7 @@ services: STAFF_PORT: ${STAFF_PORT:-8081} QUICKADD_SOURCES: ${QUICKADD_SOURCES:-z3950:lx2.loc.gov:210/LCDB,openlibrary} ports: - - "${QUICKADD_PORT:-8082}:8082" + - "${BIND_ADDR:-0.0.0.0}:${QUICKADD_PORT:-8082}:8082" volumes: - quickadd-data:/data diff --git a/library/install.sh b/library/install.sh index a2431b0..a12cc0e 100755 --- a/library/install.sh +++ b/library/install.sh @@ -100,6 +100,7 @@ TZ=${TZ_NOW} OPAC_PORT=$(free_port "${OPAC_PORT:-8080}") STAFF_PORT=$(free_port "${STAFF_PORT:-8081}") QUICKADD_PORT=$(free_port "${QUICKADD_PORT:-8082}") +BIND_ADDR=${BIND_ADDR:-0.0.0.0} ADMIN_USER=admin ADMIN_PASSWORD=$(rand 16) DB_ROOT_PASSWORD=$(rand 32) @@ -114,6 +115,9 @@ else if ! grep -q '^QUICKADD_PORT=' .env; then echo "QUICKADD_PORT=$(free_port 8082)" >> .env fi + if ! grep -q '^BIND_ADDR=' .env; then + echo "BIND_ADDR=${BIND_ADDR:-0.0.0.0}" >> .env + fi fi if [ -n "${EXTRA_CA:-}" ]; then @@ -131,9 +135,10 @@ with_retry dc up -d # --- Wait until the site answers --------------------------------------------------- # shellcheck disable=SC1091 . ./.env -c_info "First start installs the database - waiting for the staff interface..." -for i in $(seq 1 120); do - if curl -fsS -o /dev/null "http://127.0.0.1:$STAFF_PORT/" 2>/dev/null; then READY=1; break; fi +c_info "First start installs the database - waiting until Koha reports healthy..." +for i in $(seq 1 180); do + health="$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' library-koha 2>/dev/null || echo missing)" + if [ "$health" = healthy ] && curl -fsS -o /dev/null -m 5 "http://127.0.0.1:${QUICKADD_PORT:-8082}/healthz" 2>/dev/null; then READY=1; break; fi # One restart is tolerated (Docker's restart policy); a crash loop is not. if [ "$(docker inspect -f '{{.RestartCount}}' library-koha 2>/dev/null || echo 99)" -ge 3 ]; then c_err "library-koha keeps crashing - see: docker logs library-koha"; exit 1 diff --git a/library/koha/Dockerfile b/library/koha/Dockerfile index 50555b5..8a615f4 100644 --- a/library/koha/Dockerfile +++ b/library/koha/Dockerfile @@ -35,6 +35,6 @@ RUN chmod 0755 /opt/koha-init/entrypoint.sh && chmod -R a+rX /opt/koha-init EXPOSE 80 8081 VOLUME ["/var/lib/koha"] -HEALTHCHECK --interval=30s --timeout=10s --start-period=300s --retries=5 \ - CMD curl -fsS -o /dev/null http://127.0.0.1:80/ && curl -fsS -o /dev/null http://127.0.0.1:8081/ || exit 1 +HEALTHCHECK --interval=10s --timeout=10s --start-period=300s --retries=6 \ + CMD test -f /run/koha-ready && curl -fsS -o /dev/null http://127.0.0.1:80/ && curl -fsS -o /dev/null http://127.0.0.1:8081/ || exit 1 ENTRYPOINT ["/opt/koha-init/entrypoint.sh"] diff --git a/library/koha/entrypoint.sh b/library/koha/entrypoint.sh index 99dda5e..e318eab 100755 --- a/library/koha/entrypoint.sh +++ b/library/koha/entrypoint.sh @@ -15,6 +15,10 @@ export TZ="${TZ:-UTC}" log() { echo "[koha-init] $*"; } +# Marker the container healthcheck waits for. Before the database exists Koha +# serves its web-installer page with HTTP 200, so "port answers" is not "ready". +rm -f /run/koha-ready + # --- 1. memcached (Koha caches sysprefs and sessions in it) ----------------- memcached -u memcache -m 64 -d cron @@ -105,5 +109,6 @@ apache2ctl -k stop >/dev/null 2>&1 || true for i in 1 2 3 4 5; do pgrep -x apache2 >/dev/null || break; sleep 1; done rm -f /var/run/apache2/apache2.pid +touch /run/koha-ready log "ready - library catalogue on :80, staff interface on :$STAFF_PORT" exec apache2ctl -D FOREGROUND