kami
04c8dd1406
Compose stack replacing start-maven.sh's bare `&`-backgrounded processes. Single multi-stage image builds all six daemons (CGO + prebuilt native libs from deps/); compose runs one container each with a different command. Only mavend mounts the encryption key (env_file, gitignored) and the db volume; the modules mount just the shared unix-socket dir and read-only models — so the "key-free modules" boundary is OS-enforced (separate namespaces), not just a code convention. IPC stays unix-domain over a shared volume: zero code change, paths move to /run/maven. Encrypted db at rest on a named volume, decrypted working copy in tmpfs (RAM) per the at-rest encryption landed earlier. Validated: `docker compose config` clean, mavend.json parses, all daemon flags confirmed. NOT build-tested (no docker/GPU in authoring env) — deploy/README.md lists the host-dependent tweak points (GPU passthrough, onnxruntime path, cross-container voice bind, netdata host). Chosen Docker over interim systemd units per the "dockerize soon" call — no throwaway supervisor built. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
29 lines
665 B
Plaintext
29 lines
665 B
Plaintext
# keep the build context small — the repo carries a full Go toolchain, the
|
|
# whisper.cpp source tree, and ~1GB of models that must NOT ship in the image.
|
|
.git
|
|
models
|
|
*.db
|
|
certs
|
|
|
|
# built binaries (rebuilt inside the image)
|
|
/mavend
|
|
/mavsttd
|
|
/mavttsd
|
|
/mavweb
|
|
/mavpoll
|
|
/mavcaldav
|
|
/mavenclient
|
|
|
|
# heavy deps we don't need in context. We keep only the prebuilt runtime libs
|
|
# (deps/lib, deps/piper) and the headers the CGO build needs.
|
|
deps/go
|
|
deps/onnxruntime-linux-x64-*
|
|
deps/whisper.cpp/**
|
|
!deps/whisper.cpp
|
|
!deps/whisper.cpp/ggml
|
|
!deps/whisper.cpp/ggml/include
|
|
!deps/whisper.cpp/ggml/include/**
|
|
|
|
# local secrets — never bake into an image layer
|
|
deploy/db_key.env
|