Claude
770a6a1dfb
- the public catalogue is bound to the machine itself by default (OPAC_BIND) and, if ever exposed, requires a library-card login (OpacPublic=0) - a read-only guest login (VIEWER_USER/VIEWER_PASSWORD) in Quick Add: it may load the page, read state and search; every other endpoint is admin-only (403); the page shows only Find a book - the guest deliberately has NO Koha account: Koha's 'catalogue' permission, the only one that allows searching, also allows creating/editing label layouts and templates (tested: a guest created a layout), so it cannot be read-only - koha/ensure.pl (every start): staff-home 'Library tools' block, and removal of a guest account an earlier version created - kiosk add-on shows Find a book signed in as the guest; the admin login never goes into the kiosk config (tested, incl. a mutation check); old public-catalogue tabs are cleaned up - existing installs keep their current public-catalogue behaviour on update Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013wi3ZSot4XbUViwRFgLpRf
51 lines
2.4 KiB
Docker
51 lines
2.4 KiB
Docker
# Koha (open-source library system) built from the Koha project's own Debian
|
|
# packages - no third-party Koha images involved.
|
|
#
|
|
# KOHA_SUITE stable (default) | oldstable | unstable
|
|
# KEEP_TRANSLATIONS no (default) trims ~650 MB of non-English .po files;
|
|
# set "yes" if you want to install other languages later
|
|
FROM debian:bookworm-slim
|
|
|
|
ARG KOHA_SUITE=stable
|
|
ARG KEEP_TRANSLATIONS=no
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
LANG=C.UTF-8
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates curl gnupg tzdata
|
|
|
|
# Optional: drop extra CA certificates (*.crt) into ./certs/ before building if
|
|
# you are behind a TLS-inspecting proxy. Empty by default.
|
|
COPY certs/ /usr/local/share/ca-certificates/extra/
|
|
RUN update-ca-certificates
|
|
|
|
# Each step stands alone and fails the build on error: a swallowed failure here once produced a
|
|
# "successful" image with no Koha in it. memcached and cron are named explicitly rather than
|
|
# trusted to arrive as dependencies of koha-common.
|
|
RUN curl -fsSL https://debian.koha-community.org/koha/gpg.asc | gpg --dearmor -o /usr/share/keyrings/koha.gpg \
|
|
&& echo "deb [signed-by=/usr/share/keyrings/koha.gpg] https://debian.koha-community.org/koha ${KOHA_SUITE} main bookworm" \
|
|
> /etc/apt/sources.list.d/koha.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends koha-common mariadb-client memcached cron
|
|
|
|
RUN a2enmod rewrite headers proxy_http cgi deflate >/dev/null \
|
|
&& (a2dissite 000-default >/dev/null 2>&1 || true)
|
|
|
|
RUN if [ "$KEEP_TRANSLATIONS" != "yes" ]; then rm -rf /usr/share/koha/misc/translator/po; fi \
|
|
&& rm -rf /var/lib/apt/lists/* /usr/share/doc/*
|
|
|
|
# Refuse to produce an image that cannot run.
|
|
RUN for c in koha-create koha-plack koha-zebra koha-rebuild-zebra koha-upgrade-schema apache2ctl memcached cron mariadb zebrasrv; do \
|
|
command -v "$c" >/dev/null || { echo "BUILD ERROR: $c is missing from the image" >&2; exit 1; }; \
|
|
done
|
|
|
|
COPY bootstrap.pl ensure.pl entrypoint.sh /opt/koha-init/
|
|
COPY seed/ /opt/koha-init/seed/
|
|
RUN chmod 0755 /opt/koha-init/entrypoint.sh && chmod -R a+rX /opt/koha-init
|
|
|
|
EXPOSE 80 8081
|
|
VOLUME ["/var/lib/koha"]
|
|
HEALTHCHECK --interval=10s --timeout=10s --start-period=300s --retries=6 \
|
|
CMD test -f /run/koha-ready && curl -fsS -o /dev/null http://127.0.0.1:80/ && curl -fsS -o /dev/null http://127.0.0.1:8081/ || exit 1
|
|
ENTRYPOINT ["/opt/koha-init/entrypoint.sh"]
|