mirror of
https://github.com/community-scripts/ProxmoxVE.git
synced 2026-09-22 18:30:37 +00:00
CanbiZ (MickLesk)
76b839b04c
* Let uv see the project before syncing it uv refuses to run when a project pins a required-version it does not match, in either direction: RomM pins ==0.12.13, which fails against both the 0.10.3 a container was built with and the 0.12.17 latest installs. UV_PROJECT_DIR points setup_uv at the project so it reads that pin. It is a prefix like PYTHON_VERSION and UV_VERSION, and the call sits directly under fetch_and_deploy: the project is on disk by then, and the deploy has closed its message block, which setup_uv needs since it opens one of its own. That is also the only call needed - nothing between the old early call and the deploy uses uv or Python, so the two collapse into one. Two things found along the way: UV_PYTHON was set as a command prefix on setup_uv in 14 places. setup_uv reads PYTHON_VERSION, never UV_PYTHON, and a prefix assignment does not outlive the call, so those pins did nothing. They now use PYTHON_VERSION, which installs the interpreter they were asking for. Five update scripts had no setup_uv at all while their install counterpart pinned a Python version. They now carry the same pin. immich is left out: it runs uv through sudo -u inside a retry loop. * yubal: drop the uv 0.7.19 pin The pin came in with the script and was never explained. uv 0.7.19 is from 2025-07-02; yubal's uv.lock has carried revision 3 since at least 2025-12-27, and older uv refuses a newer lockfile revision. The script runs uv sync --frozen, so there is no fallback. yubal declares no required-version of its own, so latest is what it gets - and if it ever pins one, that pin is now honoured.
142 lines
3.6 KiB
Bash
142 lines
3.6 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Copyright (c) 2021-2025 community-scripts ORG
|
|
# Author: snazzybean
|
|
# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
|
|
# Source: https://github.com/TomBursch/kitchenowl
|
|
|
|
source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
|
|
color
|
|
verb_ip6
|
|
catch_errors
|
|
setting_up_container
|
|
network_check
|
|
update_os
|
|
|
|
msg_info "Installing Dependencies"
|
|
$STD apt install -y \
|
|
nginx \
|
|
build-essential \
|
|
gfortran \
|
|
pkg-config \
|
|
ninja-build \
|
|
autoconf \
|
|
automake \
|
|
libpq-dev \
|
|
libffi-dev \
|
|
libssl-dev \
|
|
libpcre2-dev \
|
|
libre2-dev \
|
|
libxml2-dev \
|
|
libxslt-dev \
|
|
libopenblas-dev \
|
|
liblapack-dev \
|
|
zlib1g-dev \
|
|
libjpeg62-turbo-dev \
|
|
libsqlite3-dev \
|
|
libexpat1-dev \
|
|
libicu-dev
|
|
msg_ok "Installed Dependencies"
|
|
|
|
fetch_and_deploy_gh_release "kitchenowl" "TomBursch/kitchenowl" "tarball" "latest" "/opt/kitchenowl"
|
|
rm -rf /opt/kitchenowl/web
|
|
fetch_and_deploy_gh_release "kitchenowl-web" "TomBursch/kitchenowl" "prebuild" "latest" "/opt/kitchenowl/web" "kitchenowl_Web.tar.gz"
|
|
PYTHON_VERSION="3.14" UV_PROJECT_DIR="/opt/kitchenowl/backend" setup_uv
|
|
|
|
msg_info "Setting up KitchenOwl"
|
|
cd /opt/kitchenowl/backend
|
|
$STD uv sync --no-dev
|
|
sed -i 's/default=True/default=False/' /opt/kitchenowl/backend/wsgi.py
|
|
setup_nltk "averaged_perceptron_tagger_eng" "/nltk_data"
|
|
JWT_SECRET=$(openssl rand -hex 32)
|
|
mkdir -p /opt/kitchenowl/data
|
|
cat <<EOF >/opt/kitchenowl/kitchenowl.env
|
|
STORAGE_PATH=/opt/kitchenowl/data
|
|
JWT_SECRET_KEY=${JWT_SECRET}
|
|
NLTK_DATA=/nltk_data
|
|
FRONT_URL=http://${LOCAL_IP}
|
|
FLASK_APP=wsgi.py
|
|
FLASK_ENV=production
|
|
EOF
|
|
set -a
|
|
source /opt/kitchenowl/kitchenowl.env
|
|
set +a
|
|
$STD uv run flask db upgrade
|
|
msg_ok "Set up KitchenOwl"
|
|
|
|
msg_info "Creating Systemd Service"
|
|
cat <<EOF >/etc/systemd/system/kitchenowl.service
|
|
[Unit]
|
|
Description=KitchenOwl Backend
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=root
|
|
WorkingDirectory=/opt/kitchenowl/backend
|
|
EnvironmentFile=/opt/kitchenowl/kitchenowl.env
|
|
ExecStart=/usr/local/bin/uv run wsgi.py
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
systemctl enable -q --now kitchenowl
|
|
msg_ok "Created and Started Service"
|
|
|
|
msg_info "Configuring Nginx"
|
|
cat <<'EOF' >/etc/nginx/sites-available/kitchenowl.conf
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
root /opt/kitchenowl/web;
|
|
index index.html;
|
|
|
|
client_max_body_size 100M;
|
|
|
|
# Security Headers
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
location /api {
|
|
proxy_pass http://127.0.0.1:5000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_connect_timeout 60s;
|
|
proxy_send_timeout 60s;
|
|
proxy_read_timeout 60s;
|
|
}
|
|
|
|
location /socket.io {
|
|
proxy_pass http://127.0.0.1:5000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
# WebSocket Timeouts - allow long-lived connections
|
|
proxy_read_timeout 86400s;
|
|
proxy_send_timeout 86400s;
|
|
}
|
|
}
|
|
EOF
|
|
nginx_enable_site kitchenowl.conf
|
|
msg_ok "Configured Nginx"
|
|
|
|
motd_ssh
|
|
customize
|
|
cleanup_lxc
|