kami
04c8dd1406
Compose stack replacing start-maven.sh's bare `&`-backgrounded processes. Single multi-stage image builds all six daemons (CGO + prebuilt native libs from deps/); compose runs one container each with a different command. Only mavend mounts the encryption key (env_file, gitignored) and the db volume; the modules mount just the shared unix-socket dir and read-only models — so the "key-free modules" boundary is OS-enforced (separate namespaces), not just a code convention. IPC stays unix-domain over a shared volume: zero code change, paths move to /run/maven. Encrypted db at rest on a named volume, decrypted working copy in tmpfs (RAM) per the at-rest encryption landed earlier. Validated: `docker compose config` clean, mavend.json parses, all daemon flags confirmed. NOT build-tested (no docker/GPU in authoring env) — deploy/README.md lists the host-dependent tweak points (GPU passthrough, onnxruntime path, cross-container voice bind, netdata host). Chosen Docker over interim systemd units per the "dockerize soon" call — no throwaway supervisor built. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
30 lines
421 B
Plaintext
30 lines
421 B
Plaintext
# Built binaries (root only)
|
|
/mavend
|
|
/mavenclient
|
|
/mavsttd
|
|
/mavttsd
|
|
/mavweb
|
|
/mavpoll
|
|
/mavcaldav
|
|
|
|
# Certs (private keys, don't commit)
|
|
certs/
|
|
|
|
# Dependencies (fetch/build, not vendored)
|
|
deps/
|
|
|
|
# ML models (large, downloaded separately)
|
|
models/
|
|
|
|
# Runtime data
|
|
*.db
|
|
|
|
# Deploy secret (the at-rest db key) — never commit
|
|
deploy/db_key.env
|
|
|
|
# Temp files
|
|
/tmp/
|
|
|
|
# opencode config (per-project, not for sharing)
|
|
opencode.json
|