From 6554256e8ee125e019fd0742ea492cf7d1121350 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 3 Aug 2026 18:46:23 +0000 Subject: [PATCH] traccar: drive database config from .env instead of a static XML file MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous fix still baked database.user/database.password directly into config/traccar.xml, duplicating the secret that .env already held and leaving a second, unmanaged copy of it on disk. Traccar supports reading its config from environment variables (CONFIG_USE_ENVIRONMENT_VARIABLES=true, confirmed against the official traccar/traccar docker/compose/traccar-mysql.yaml reference). Use that: DATABASE_DRIVER/URL/USER/PASSWORD are now set in the compose file via ${POSTGRES_*} interpolation from .env, so .env is the only place the credentials live — drop config/traccar.xml and its volume mount entirely, matching the official reference example. Also switched to the official reference healthcheck (wget against /api/health, 1h start_period) — a real endpoint on real hardware rather than a guessed /dev/tcp probe against an unverified image's toolset — and added the interval/start-period env vars to the autoheal container to match, while keeping the container scoped to just Traccar via the autoheal=true label instead of the reference's host-wide "all". Verified with `docker compose config` (both with and without a local Caddy directory present) that the ${POSTGRES_DB}/${POSTGRES_USER}/ ${POSTGRES_PASSWORD} references resolve correctly from .env with no warnings. --- services/traccar.sh | 48 ++++++++++++++++++++++----------------------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/services/traccar.sh b/services/traccar.sh index e74cf57..e2e8ff9 100644 --- a/services/traccar.sh +++ b/services/traccar.sh @@ -192,8 +192,9 @@ install_traccar() { if [ "$DRY_RUN" = true ]; then echo "[DRY-RUN] Traccar would:" - echo " - Create $TRACCAR_DIR with docker-compose.yml + config/traccar.xml" + echo " - Create $TRACCAR_DIR with docker-compose.yml + .env" echo " - Deploy a PostgreSQL database container (Traccar no longer ships H2)" + echo " - Point Traccar at it via env vars (CONFIG_USE_ENVIRONMENT_VARIABLES) — no secrets in a config file" echo " - Deploy an autoheal container that restarts Traccar if its healthcheck fails" echo " - Expose port 8082 (web) and 5000-5150 (device protocols)" echo " - Default login: admin@admin.com / admin (change immediately!)" @@ -263,21 +264,27 @@ ${_CADDY_NET_BLOCK} healthcheck: container_name: traccar hostname: traccar restart: unless-stopped + env_file: .env depends_on: db: condition: service_healthy labels: - "autoheal=true" + environment: + CONFIG_USE_ENVIRONMENT_VARIABLES: "true" + DATABASE_DRIVER: org.postgresql.Driver + DATABASE_URL: jdbc:postgresql://traccar-db:5432/\${POSTGRES_DB}?sslmode=disable + DATABASE_USER: \${POSTGRES_USER} + DATABASE_PASSWORD: \${POSTGRES_PASSWORD} healthcheck: - test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/127.0.0.1/8082' || exit 1"] - interval: 30s + test: ["CMD", "wget", "-q", "--spider", "http://localhost:8082/api/health"] + interval: 2m timeout: 5s + start_period: 1h retries: 3 - start_period: 60s volumes: - ./logs:/opt/traccar/logs:rw - ./data:/opt/traccar/data:rw - - ./config/traccar.xml:/opt/traccar/conf/traccar.xml:ro ports: - "8082:8082" - "5000-5150:5000-5150" @@ -288,7 +295,9 @@ ${_CADDY_NET_BLOCK} container_name: traccar-autoheal restart: unless-stopped environment: - - AUTOHEAL_CONTAINER_LABEL=autoheal + AUTOHEAL_CONTAINER_LABEL: autoheal + AUTOHEAL_INTERVAL: 60 + AUTOHEAL_START_PERIOD: 3600 volumes: - /var/run/docker.sock:/var/run/docker.sock ${_CADDY_NET_SECTION} @@ -299,28 +308,16 @@ TZ=$TZ_VAL CADDY_NET=$SITE_CADDY_NET # PostgreSQL — backs Traccar's database (Traccar's docker image no longer -# bundles the H2 driver, so a real database is required). +# bundles the H2 driver, so a real database is required). Traccar reads +# these directly (CONFIG_USE_ENVIRONMENT_VARIABLES in docker-compose.yml) +# instead of a config file, so this is the only place the credentials live. POSTGRES_DB=traccar POSTGRES_USER=traccar POSTGRES_PASSWORD=$DB_PASS TRACCAR_ENV chmod 600 .env - mkdir -p logs data config db - - cat > config/traccar.xml << TRACCAR_XML - - - - - - ./conf/default.xml - org.postgresql.Driver - jdbc:postgresql://traccar-db:5432/traccar?sslmode=disable - traccar - $DB_PASS - -TRACCAR_XML + mkdir -p logs data db chown -R "$ACTUAL_USER:$ACTUAL_USER" "$TRACCAR_DIR" log_success "Traccar configured at $TRACCAR_DIR" @@ -336,9 +333,12 @@ Android/iOS app, OwnTracks, or any of 200+ supported device protocols. - Web UI: http://localhost:8082 - Default login: admin@admin.com / admin (change immediately!) - Device protocols: ports 5000-5150 (TCP + UDP) -- Config: \`config/traccar.xml\` - App data: \`data/\` and \`logs/\` -- Database: PostgreSQL (\`traccar-db\` container, data in \`db/\`, credentials in \`.env\`) +- Database: PostgreSQL (\`traccar-db\` container, data in \`db/\`) +- All database settings (name, user, password) live in \`.env\` — Traccar + reads them directly via env vars, nothing is duplicated in a config file. + Change the password there (then recreate both containers) if you need to + rotate it. - Autoheal: \`traccar-autoheal\` restarts the \`traccar\` container if its healthcheck fails ## Manage