Stop containers explicitly before pulling + restarting to prevent the
'No such container' race condition where Docker Compose tries to start
a new container while simultaneously removing the old one.
Also remove --no-deps flag which caused stale hash-prefixed container
names (e.g. 41cb964156c0_libnovel-ui-1) that trigger the race.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Issue: Two sequential 'docker compose up' commands caused race condition:
- First command (--no-deps) starts removing containers
- Second command (--remove-orphans) tries to remove same containers
- Result: 'removal of container is already in progress' error
Fix: Combine into single command with both flags:
docker compose up -d --no-deps --remove-orphans <services>
This ensures atomic operation without race conditions.
Previously: 'docker compose up -d' recreated all services with changed images,
causing dependent services (pocketbase, minio, redis, etc.) to restart and
wait for healthchecks, leading to longer downtime.
Now: Use '--no-deps' flag to restart ONLY the services with updated images
(backend, runner, ui, caddy, pocketbase) without touching their dependencies.
Benefits:
- Faster deployments (~15-20s vs ~60s)
- No unnecessary restarts of infrastructure services
- Reduced downtime for the application
The final 'docker compose up -d --remove-orphans' ensures any orphaned
containers are cleaned up and all services are in the desired state.
Homelab is on private network (192.168.0.109), so we can safely disable
strict host key checking. This avoids the complexity of managing known_hosts
entries in Gitea secrets.
Changes:
- Remove HOMELAB_SSH_KNOWN_HOSTS requirement
- Add -o StrictHostKeyChecking=no to scp/ssh commands
- Add -o UserKnownHostsFile=/dev/null to avoid host key persistence
CRITICAL FIX: The homelab server runs the full stack (runner + GlitchTip +
observability tools), not just the runner. Copying homelab/runner/docker-compose.yml
would have destroyed all other services.
Changed: homelab/runner/docker-compose.yml → homelab/docker-compose.yml
- Add deploy-homelab job to sync homelab/runner/docker-compose.yml
- Rename deploy → deploy-prod for clarity
- Both deployments run in parallel after Docker images are pushed
- Homelab runner pulls only the runner image and restarts
Required secrets (to be added in Gitea):
- HOMELAB_HOST (192.168.0.109)
- HOMELAB_USER (root)
- HOMELAB_SSH_KEY (same as PROD_SSH_KEY or separate)
- HOMELAB_SSH_KNOWN_HOSTS (ssh-keyscan -H 192.168.0.109)
- Remove UI build artifact upload/download steps (18 lines removed)
- Remove .dockerignore manipulation workaround
- Always build UI from source inside Docker (more reliable)
- Remove PREBUILT arg from ui/Dockerfile and docker-bake.hcl
This fixes the '/app/build not found' error in CI by eliminating the fragile
artifact-passing mechanism. UI now builds fresh in Docker using build cache,
same as local development.
The Gitea runner's docker buildx doesn't support HCL locals{} or function{}
blocks (added in buildx 0.12+). Replace with plain variables: VERSION and
MAJOR_MINOR are pre-computed in a CI step and passed as env vars to bake.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docker-bake.hcl now owns semver tag generation via HCL locals + a reusable
img_tags() function: GIT_TAG="v4.1.5" → :4.1.5, :4.1, :latest on all images.
The Docker job shrinks from 13 steps to 6 — no docker/metadata-action needed.
CI simply passes GIT_TAG, COMMIT, BUILD_TIME as env vars to bake-action.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docker compose pull without arguments pulls ALL services including
getmeili/meilisearch:latest — a recent Meilisearch version bump broke
compatibility with existing data on the server, causing meilisearch to
crash immediately on restart.
CI deploy now only pulls the 5 custom app images (backend, runner, ui,
caddy, pocketbase). Infrastructure images (meilisearch, valkey, minio,
redis, crowdsec) are updated deliberately via `just pull-infra`.
Also add pocketbase to `just pull-images` now that it's a custom image.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace 5 sequential build-push-action steps with a single docker/bake-action
call backed by docker-bake.hcl. BuildKit now builds all images in parallel:
backend/runner/pocketbase share one Go builder stage (compiled once), while
caddy and ui build concurrently alongside the Go targets.
Workflow YAML goes from ~130 lines of build steps to ~35. Adding a new image
now only requires a new target block in docker-bake.hcl.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
release.yaml:
- Build and push kalekber/libnovel-pocketbase image on every release tag
- Add deploy job (runs after docker): copies docker-compose.yml from the
tagged commit to /opt/libnovel on prod, pulls new images, restarts
changed services with --remove-orphans (cleans up removed pb-init)
ci.yaml:
- Validate cmd/pocketbase builds on every branch push
Required new Gitea secrets: PROD_HOST, PROD_USER, PROD_SSH_KEY,
PROD_SSH_KNOWN_HOSTS (see deploy job comments for instructions).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Merged docker-backend, docker-runner, docker-ui, docker-caddy into a
single 'docker' job. Docker Hub is now authenticated once; the credential
in ~/.docker/config.json is reused by all four build-push-action steps.
Eliminates 3 redundant login, checkout, setup-buildx, and scheduler
round-trips. Builds still run sequentially within the job so inline layer
cache pushes don't race each other.
- docker-ui now downloads the plain ui-build artifact from check-ui directly
(previously it depended on upload-sourcemaps which produced ui-build-injected).
- release job now only needs: [docker] instead of the previous 5-job list.
- Entire upload-sourcemaps job commented out as requested. Re-enable by
uncommenting the job block and adding 'upload-sourcemaps' back to the
docker job's needs list (also swap ui-build → ui-build-injected artifact).
When PREBUILT=1 the pre-built artifact is downloaded into ui/build/ but
.dockerignore excludes 'build', so Docker never sees it and /app/build
doesn't exist in the builder stage — causing the runtime COPY to fail.
Fix: rewrite ui/.dockerignore on the CI runner (grep -v '^build$') so the
pre-built directory is included in the Docker context.
Also in this commit:
- book page: gate EPUB download on isPro (UI upsell + server 403 guard)
- book page: chapter names default pattern changed to '{scene}'
The docker-ui job was rebuilding the UI from scratch inside Docker, producing
chunk hashes and JS files that didn't match the source maps uploaded to
GlitchTip, causing all stack traces to appear minified.
Fix:
- ui/Dockerfile: add PREBUILT=1 ARG; skip npm run build when set
- release.yaml upload-sourcemaps: re-upload artifact after sentry-cli inject
- release.yaml docker-ui: download injected artifact into ui/build/ and pass
PREBUILT=1 so Docker reuses the exact same JS files whose debug IDs are in
GlitchTip
Pass build output from check-ui to upload-sourcemaps via artifact
instead of rebuilding from scratch. Saves ~4-5 min (npm ci + npm run build)
from the upload-sourcemaps job.
glitchtip-cli v0.1.0 uploads chunks but never calls the assemble endpoint,
leaving releases with 0 files. sentry-cli correctly calls assemble after
chunk upload — confirmed working in manual test (2.5.84-test3 = 211 files).
- Add homelab/glitchtip/files_api.py with GzipChunk fallback for sentry-cli 3.x
raw zip uploads; bind-mount into both glitchtip-web and glitchtip-worker
- Add release.yaml prune step to delete all but the 10 newest GlitchTip releases
- Reader page: remove dead code and simplify layout
Add 'releases new' and 'releases finalize' steps around sourcemaps
upload in release.yaml — without an explicit 'releases new' call,
GlitchTip creates the release entry but associates 0 files.
Add root AGENTS.md (picked up by Claude, Cursor, Copilot, etc.) with
full project context: stack, repo layout, Gitea CI conventions,
GlitchTip DSN/upload flow, infra, and iOS notes.
- Admin changelog page now fetches releases live from the public Gitea
API (https://gitea.kalekber.cc) instead of a baked releases.json file
- Remove /static/releases.json from ui/.gitignore (no longer generated)
- Add Gitea to admin sidebar external tools (admin_nav_gitea i18n key,
all 5 locales, compiled paraglide JS force-added)
- release.yaml: remove 'Fetch releases from Gitea API' step; extract
release title and body from the tagged commit message for Gitea releases
Bare `actions/` references resolve to github.com by default in act_runner.
gitea-release-action lives on gitea.com so must use the full https:// URL.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
curl -sf without -L silently wrote '301 Moved Permanently' to releases.json
instead of following the http→https redirect. Added -L to follow redirects,
set -euo pipefail, and jq type validation so the step fails hard on bad JSON.
Replace runtime Gitea API fetch with fs.readFileSync of releases.json,
which CI writes to ui/static/ before the Docker build context is sent.
Eliminates prod→homelab network dependency for the changelog page.
PUBLIC_BUILD_VERSION and PUBLIC_BUILD_COMMIT were set only in the builder
stage ENV — they were never re-declared in the runtime stage, so the Node
server started with them undefined and the badge always showed 'dev'.
Fix: re-declare all three ARGs after the second FROM and set runtime ENVs.
Add PUBLIC_BUILD_TIME (ISO timestamp from gitea.event.head_commit.timestamp)
injected via build-arg in release.yaml. Badge now shows e.g.:
v2.3.9+abc1234 · 28 Mar 2026 14:30 UTC
Docker image builds belong to the release workflow (tag-triggered).
CI now runs: go vet, go build (backend/runner/healthcheck), go test,
svelte-check, and UI vite build — fast feedback without Docker overhead.
Also triggers on all branches, not just main/master.
- scraper.go: ScrapeCatalogue now uses retryGet (9 attempts, 10s base) +
500–1500ms inter-page jitter instead of bare GetContent. ScrapeMetadata
also switched to retryGet so a single 429 on a book page is retried rather
than aborting the whole refresh.
- catalogue_refresh.go: per-book delay is now configurable
(RUNNER_CATALOGUE_REQUEST_DELAY, default 2s) + up to 50% random jitter
applied before every metadata fetch. Only metadata is scraped here —
chapters are fetched on-demand, not during catalogue refresh. Progress
logged every 50 books instead of 100.
- config.go / runner.go / main.go: add CatalogueRequestDelay field wired
from RUNNER_CATALOGUE_REQUEST_DELAY env var.
- release.yaml: comment out upload-sourcemaps job and remove it from the
release needs; GlitchTip auth token needs refreshing after DB wipe.
@sentry/vite-plugin uses sentry-cli which creates release entries but
doesn't upload files to GlitchTip's API correctly. Switch to the native
glitchtip-cli which uses the debug ID inject+upload approach that
GlitchTip actually supports.
- Enable sourcemap:true in vite.config.ts
- Add sentryVitePlugin: uploads maps to errors.libnovel.cc, deletes them post-upload so they never ship in the Docker image
- Wire release: PUBLIC_BUILD_VERSION in both hooks.client.ts and hooks.server.ts so events correlate to the correct artifact
- Add upload-sourcemaps CI job in release.yaml (parallel to docker-ui, uses GLITCHTIP_AUTH_TOKEN secret)
- backend/: Go API server and runner binaries with PocketBase + MinIO storage
- ui-v2/: SvelteKit frontend rewrite
- docker-compose-new.yml: compose file for the v2 stack
- .gitea/workflows/release-v2.yaml: CI/CD for backend, runner, and ui-v2 Docker Hub images
- scripts/pb-init.sh: migrate from wget to curl, add superuser bootstrap for fresh installs
- .env.example: document DOCKER_BUILDKIT=1 for Colima users
All four workflows (ci-scraper, ci-ui, release-scraper, release-ui) now pass
build-args to docker/build-push-action. Release workflows use the semver tag
from docker/metadata-action outputs.version; CI workflows use the git SHA.
