From 582d47d8881cbda837ba48aaa9cc75133f458134 Mon Sep 17 00:00:00 2001 From: Jay Date: Fri, 6 Nov 2026 01:07:24 +0100 Subject: [PATCH 1/2] [MySpotify] refactor: Named Mongo volume with auth for Dokploy backups - Store MongoDB in the named volume myspotify-mongo-data instead of a host path (MYSPOTIFY_DATA is gone). - Create a MongoDB root user (MYSPOTIFY_MONGO_USER/PASSWORD) and use it in the backend connection string, so Dokploy can back up and restore the database. - Drop the cloudflare-exposed network and the unused homepage.* labels; the UI and API are published through Dokploy domains. Co-Authored-By: Claude Opus 5.5 --- myspotify/.env.example | 8 +++++--- myspotify/README.md | 35 ++++++++++++++++++++++++++--------- myspotify/docker-compose.yml | 22 ++++++---------------- 3 files changed, 37 insertions(+), 28 deletions(-) diff --git a/myspotify/.env.example b/myspotify/.env.example index 1a938bd..55a0d4b 100644 --- a/myspotify/.env.example +++ b/myspotify/.env.example @@ -1,6 +1,3 @@ -# Base path for persistent data -MYSPOTIFY_DATA=/path/to/myspotify/data - # Domains to access MySpotify / Backend MYSPOTIFY_DOMAIN=myspotify.domain MYSPOTIFY_BACKEND_DOMAIN=myspotify-backend.domain @@ -8,3 +5,8 @@ MYSPOTIFY_BACKEND_DOMAIN=myspotify-backend.domain # Spotify app public and secret keys MYSPOTIFY_APP_PUBLIC=myspotify_app_public MYSPOTIFY_APP_SECRET=myspotify_app_secret + +# MongoDB root user, created on first start (empty volume only). +# Use URL-safe characters: they are embedded in the connection string. +MYSPOTIFY_MONGO_USER=myspotify +MYSPOTIFY_MONGO_PASSWORD=change_me_url_safe diff --git a/myspotify/README.md b/myspotify/README.md index c493a01..7f09e14 100644 --- a/myspotify/README.md +++ b/myspotify/README.md @@ -7,18 +7,35 @@ and frontend client. ## Environment Variables -| Variable | Description | -|----------------------------|-----------------------------------| -| `MYSPOTIFY_DATA` | Local path for database storage | -| `MYSPOTIFY_DOMAIN` | Domain to access the web interface| -| `MYSPOTIFY_BACKEND_DOMAIN` | Domain for the backend API | -| `MYSPOTIFY_APP_PUBLIC` | Spotify application public key | -| `MYSPOTIFY_APP_SECRET` | Spotify application secret key | +| Variable | Description | +|----------------------------|------------------------------------| +| `MYSPOTIFY_DOMAIN` | Domain to access the web interface | +| `MYSPOTIFY_BACKEND_DOMAIN` | Domain for the backend API | +| `MYSPOTIFY_APP_PUBLIC` | Spotify application public key | +| `MYSPOTIFY_APP_SECRET` | Spotify application secret key | +| `MYSPOTIFY_MONGO_USER` | MongoDB root user | +| `MYSPOTIFY_MONGO_PASSWORD` | MongoDB root password (URL-safe) | + +MongoDB creates the root user only on its first start, with an +empty volume. Changing these variables later does not change the +user; update it inside MongoDB as well. + +## Volumes + +| Volume | Mount | Contents | Backup | +|------------------------|------------|------------------|--------| +| `myspotify-mongo-data` | `/data/db` | MongoDB database | Yes | + +The database is backed up with a Dokploy database backup +(`mongodump` of `your_spotify`), which needs the root +credentials above. ## Networks -Connects to `cloudflare-exposed` -(must be created by the `cloudflared` service first). +No network is declared in the compose file — Dokploy +attaches its own network automatically on deploy. +The web interface (port 3000) and the API (port 8080) are +published through Dokploy domains. ## Kernel 7.0 workaround (MongoDB) diff --git a/myspotify/docker-compose.yml b/myspotify/docker-compose.yml index c8fe239..a4acdc3 100644 --- a/myspotify/docker-compose.yml +++ b/myspotify/docker-compose.yml @@ -15,12 +15,10 @@ services: timeout: 10s retries: 3 start_period: 30s - networks: - - cloudflare-exposed environment: API_ENDPOINT: https://${MYSPOTIFY_BACKEND_DOMAIN} CLIENT_ENDPOINT: https://${MYSPOTIFY_DOMAIN} - MONGO_ENDPOINT: mongodb://myspotify-mongo:27017/your_spotify + MONGO_ENDPOINT: mongodb://${MYSPOTIFY_MONGO_USER}:${MYSPOTIFY_MONGO_PASSWORD}@myspotify-mongo:27017/your_spotify?authSource=admin SPOTIFY_PUBLIC: ${MYSPOTIFY_APP_PUBLIC} SPOTIFY_SECRET: ${MYSPOTIFY_APP_SECRET} logging: @@ -44,11 +42,11 @@ services: timeout: 10s retries: 3 start_period: 30s - networks: - - cloudflare-exposed volumes: - - ${MYSPOTIFY_DATA}/mongo:/data/db + - myspotify-mongo-data:/data/db environment: + MONGO_INITDB_ROOT_USERNAME: ${MYSPOTIFY_MONGO_USER} + MONGO_INITDB_ROOT_PASSWORD: ${MYSPOTIFY_MONGO_PASSWORD} # MongoDB 8 refuses to start on kernel >= 6.19 unless it is 7.0.14+; # Ubuntu HWE reports 7.0.0-N, so it is rejected. See README. GLIBC_TUNABLES: glibc.pthread.rseq=1 @@ -73,8 +71,6 @@ services: timeout: 10s retries: 3 start_period: 30s - networks: - - cloudflare-exposed environment: API_ENDPOINT: https://${MYSPOTIFY_BACKEND_DOMAIN} logging: @@ -84,12 +80,6 @@ services: max-file: "3" labels: - com.centurylinklabs.watchtower.enable=true - - homepage.group=Media - - homepage.name=My Spotify - - homepage.icon=spotify.png - - homepage.href=https://${MYSPOTIFY_DOMAIN} - - homepage.description=Spotify listening history and stats -networks: - cloudflare-exposed: - external: true +volumes: + myspotify-mongo-data: From 29f7c4d842053071f62e983ee78d1dbd70d3c124 Mon Sep 17 00:00:00 2001 From: Jay Date: Fri, 6 Nov 2026 01:16:51 +0100 Subject: [PATCH 2/2] [MySpotify] fix: Require Mongo credentials and document migration - Fail fast with a clear message when MYSPOTIFY_MONGO_USER or MYSPOTIFY_MONGO_PASSWORD is unset or empty. - State that backups must be configured in Dokploy and document the upgrade path from the host-path version. Co-Authored-By: Claude Opus 5.5 --- myspotify/README.md | 26 ++++++++++++++++++++------ myspotify/docker-compose.yml | 6 +++--- 2 files changed, 23 insertions(+), 9 deletions(-) diff --git a/myspotify/README.md b/myspotify/README.md index 7f09e14..71b5bbd 100644 --- a/myspotify/README.md +++ b/myspotify/README.md @@ -22,13 +22,27 @@ user; update it inside MongoDB as well. ## Volumes -| Volume | Mount | Contents | Backup | -|------------------------|------------|------------------|--------| -| `myspotify-mongo-data` | `/data/db` | MongoDB database | Yes | +| Volume | Mount | Contents | Backup | +|------------------------|------------|------------------|---------| +| `myspotify-mongo-data` | `/data/db` | MongoDB database | Dokploy | -The database is backed up with a Dokploy database backup -(`mongodump` of `your_spotify`), which needs the root -credentials above. +The stack does not back itself up. Configure a Dokploy compose +backup for the `myspotify-mongo` service (database `your_spotify`, +type MongoDB, with the root credentials above) and test a restore. + +## Migrating from the host-path version + +Earlier versions stored MongoDB in `${MYSPOTIFY_DATA}/mongo` +without authentication. The new volume starts empty; nothing is +migrated automatically. + +1. Stop the old stack and dump the old database: + `docker exec myspotify-mongo mongodump -d your_spotify --archive --gzip > your_spotify.archive.gz` +2. Deploy this version, so MongoDB creates the root user in the + new volume. +3. Restore the dump into the new database (Dokploy restore, or + `mongorestore --archive --gzip --drop` with the root + credentials) before using the app. ## Networks diff --git a/myspotify/docker-compose.yml b/myspotify/docker-compose.yml index a4acdc3..3186e0d 100644 --- a/myspotify/docker-compose.yml +++ b/myspotify/docker-compose.yml @@ -18,7 +18,7 @@ services: environment: API_ENDPOINT: https://${MYSPOTIFY_BACKEND_DOMAIN} CLIENT_ENDPOINT: https://${MYSPOTIFY_DOMAIN} - MONGO_ENDPOINT: mongodb://${MYSPOTIFY_MONGO_USER}:${MYSPOTIFY_MONGO_PASSWORD}@myspotify-mongo:27017/your_spotify?authSource=admin + MONGO_ENDPOINT: mongodb://${MYSPOTIFY_MONGO_USER:?MYSPOTIFY_MONGO_USER is required}:${MYSPOTIFY_MONGO_PASSWORD:?MYSPOTIFY_MONGO_PASSWORD is required}@myspotify-mongo:27017/your_spotify?authSource=admin SPOTIFY_PUBLIC: ${MYSPOTIFY_APP_PUBLIC} SPOTIFY_SECRET: ${MYSPOTIFY_APP_SECRET} logging: @@ -45,8 +45,8 @@ services: volumes: - myspotify-mongo-data:/data/db environment: - MONGO_INITDB_ROOT_USERNAME: ${MYSPOTIFY_MONGO_USER} - MONGO_INITDB_ROOT_PASSWORD: ${MYSPOTIFY_MONGO_PASSWORD} + MONGO_INITDB_ROOT_USERNAME: ${MYSPOTIFY_MONGO_USER:?MYSPOTIFY_MONGO_USER is required} + MONGO_INITDB_ROOT_PASSWORD: ${MYSPOTIFY_MONGO_PASSWORD:?MYSPOTIFY_MONGO_PASSWORD is required} # MongoDB 8 refuses to start on kernel >= 6.19 unless it is 7.0.14+; # Ubuntu HWE reports 7.0.0-N, so it is rejected. See README. GLIBC_TUNABLES: glibc.pthread.rseq=1