refactor(backup): inline backupbot hooks, drop mysql_backup.sh

Move the mysqldump/gunzip commands directly into the
backupbot.backup.pre-hook / backupbot.restore.post-hook label values
on the db service and delete the external mysql_backup.sh + its
config mount + MYSQL_BACKUP_VERSION. Matches the inline pattern used
by akaunting / engelsystem / forgejo and removes one file from the
recipe surface area.

.env.sample

@@ -9,14 +9,29 @@ DOMAIN=ghost.example.com
 #EXTRA_DOMAINS=', `www.ghost.example.com`'
 LETS_ENCRYPT_ENV=production
 
-## Mail settings
+SECRET_DB_PASSWORD_VERSION=v1
-#MAIL_TRANSPORT=smtp
+
-#MAIL_FROM=admin@example.com
+SECRET_SMTP_PASSWORD_VERSION=v1
-#MAIL_OPTIONS_HOST=mail.example.com
+
-#MAIL_OPTIONS_PORT=587
+## Mail settings (mandatory)
+MAIL_TRANSPORT=smtp
+MAIL_FROM=admin@example.com
+MAIL_OPTIONS_HOST=mail.example.com
+MAIL_OPTIONS_PORT=587
+MAIL_OPTIONS_AUTH_USER=smtpuser@example.com
 #MAIL_OPTIONS_SECURE=false
-#MAIL_OPTIONS_AUTH_USER=smtpuser@example.com
+
+## Advanced options
+# see here: https://docs.ghost.org/config#number-of-connections
+#DATABASE_POOL_MIN=2
+#DATABASE_POOL_MAX=15
+
+COMPOSE_FILE="compose.yml"
 
 ## Matrix-Synapse-Redirection
 # COMPOSE_FILE="$COMPOSE_FILE:compose.matrix.yml"
-# MATRIX_DOMAIN=matrix-synapse.example.com
+# MATRIX_DOMAIN=matrix-synapse.example.com
+
+## Custom Image Version
+# COMPOSE_FILE="$COMPOSE_FILE:compose.customversion.yml"
+# IMAGE_VERSION=6.3.1

abra.sh

@@ -1 +1 @@
-export GHOST_ENTRYPOINT_VERSION=v1
+export GHOST_ENTRYPOINT_VERSION=v1

compose.customversion.yml

@@ -0,0 +1,3 @@
+services:
+  app:
+    image: ghost:${IMAGE_VERSION}-alpine

compose.yml

@@ -1,6 +1,6 @@
 services:
   app:
-    image: ghost:5-alpine
+    image: ghost:6.42.0-alpine
     environment:
       # see https://ghost.org/docs/config/#configuration-options
       database__client: mysql
@@ -8,6 +8,8 @@ services:
       database__connection__user: root
       database__connection__database: ghost
       database__connection__password_FILE: /run/secrets/db_password
+      database__pool__min: ${DATABASE_POOL_MIN:-0}
+      database__pool__max: ${DATABASE_POOL_MAX:-10}
       url: https://$DOMAIN
       mail__transport: ${MAIL_TRANSPORT}
       mail__from: ${MAIL_FROM}
@@ -45,17 +47,17 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         # Redirect from EXTRA_DOMAINS to DOMAIN
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
+        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.scheme=https"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
+        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.permanent=true"
         - "backupbot.backup=true"
         - "backupbot.backup.path=/var/lib/ghost/content"
-        - "coop-cloud.${STACK_NAME}.version=0.1.0+5-alpine"
+        - "coop-cloud.${STACK_NAME}.version=1.3.0+6.42.0-alpine"
     healthcheck:
       test: ["CMD", "wget", "--header=X-Forwarded-Proto: https", "--spider", "-q", "http://localhost:2368/ghost/api/admin/site"]
       interval: 30s
       timeout: 10s
       retries: 10
-      start_period: 1m
+      start_period: 15m
  
   db:
     image: mysql:8.0
@@ -70,9 +72,9 @@ services:
     deploy:
       labels:
         - "backupbot.backup=true"
-        - "backupbot.backup.pre-hook=mysqldump -u root -p\"$$(cat /run/secrets/db_password)\" ghost --tab /var/lib/mysql-files/"
+        - 'backupbot.backup.pre-hook=mysqldump -u root -p"$$(cat /run/secrets/db_password)" --single-transaction --routines --triggers --databases ghost | gzip > /var/lib/mysql/backup.sql.gz'
-        - "backupbot.backup.post-hook=rm -rf /var/lib/mysql-files/*"
+        - "backupbot.backup.volumes.mysql.path=backup.sql.gz"
-        - "backupbot.backup.path=/var/lib/mysql-files/"
+        - 'backupbot.restore.post-hook=gunzip -c /var/lib/mysql/backup.sql.gz | mysql -u root -p"$$(cat /run/secrets/db_password)"'
 
     healthcheck:
       test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p\"$$(cat /run/secrets/db_password)\""]
@@ -101,4 +103,4 @@ secrets:
 configs:
   ghost_entrypoint:
     name: ${STACK_NAME}_ghost_entrypoint_${GHOST_ENTRYPOINT_VERSION}
-    file: entrypoint.sh
+    file: entrypoint.sh

release/1.0.0+5-alpine

@@ -0,0 +1 @@
+breaking change due to mysql-upgrade and secrets, checkout release-notes in release/1.0.0+5-alpine

release/1.1.0+6-alpine

@@ -0,0 +1 @@
+when deploying, healthchecks may fail once, it seems to be caused by a database update/migration needing more time. Just wait some time and deploy again

release/1.1.1+6-alpine

@@ -0,0 +1 @@
+set mysql-pooling default to 0, added option to set it via env

release/1.2.0+6.21.2-alpine

@@ -0,0 +1 @@
+move IMAGE_VERSION in extra compose file to make sure, main is always a knowingly working version

renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}