fix(release): make deployment backup and rollback immutable

deploy/unraid/run-dockerman-container.sh

@@ -33,6 +33,7 @@ GEOINTEL_POSTGRES_USER="${GEOINTEL_POSTGRES_USER:-geointel}"
 GEOINTEL_POSTGRES_PASSWORD="${GEOINTEL_POSTGRES_PASSWORD:-}"
 GEOINTEL_CORS_ORIGINS="${GEOINTEL_CORS_ORIGINS:-http://localhost:${GEOINTEL_FRONTEND_PORT},http://127.0.0.1:${GEOINTEL_FRONTEND_PORT},http://192.168.10.150:${GEOINTEL_FRONTEND_PORT}}"
 GEOINTEL_MAX_UPLOAD_MB="${GEOINTEL_MAX_UPLOAD_MB:-500}"
+GEOINTEL_MAX_IN_MEMORY_VECTOR_MB="${GEOINTEL_MAX_IN_MEMORY_VECTOR_MB:-64}"
 GEOINTEL_AOI_WORKER_ENABLED="${GEOINTEL_AOI_WORKER_ENABLED:-true}"
 GEOINTEL_AOI_WORKER_POLL_SECONDS="${GEOINTEL_AOI_WORKER_POLL_SECONDS:-2}"
 GEOINTEL_AUTH_ENABLED="${GEOINTEL_AUTH_ENABLED:-false}"
@@ -40,6 +41,11 @@ GEOINTEL_AUTH_USERNAME="${GEOINTEL_AUTH_USERNAME:-}"
 GEOINTEL_AUTH_PASSWORD_HASH="${GEOINTEL_AUTH_PASSWORD_HASH:-}"
 GEOINTEL_AUTH_SESSION_SECRET="${GEOINTEL_AUTH_SESSION_SECRET:-}"
 GEOINTEL_AUTH_SESSION_TTL_SECONDS="${GEOINTEL_AUTH_SESSION_TTL_SECONDS:-43200}"
+GEOINTEL_PUBLIC_BASE_URL="${GEOINTEL_PUBLIC_BASE_URL:-http://localhost:${GEOINTEL_FRONTEND_PORT}}"
+GEOINTEL_AUTHENTIK_ISSUER="${GEOINTEL_AUTHENTIK_ISSUER:-}"
+GEOINTEL_AUTHENTIK_CLIENT_ID="${GEOINTEL_AUTHENTIK_CLIENT_ID:-}"
+GEOINTEL_AUTHENTIK_CLIENT_SECRET="${GEOINTEL_AUTHENTIK_CLIENT_SECRET:-}"
+GEOINTEL_AUTHENTIK_ALLOWED_EMAIL="${GEOINTEL_AUTHENTIK_ALLOWED_EMAIL:-}"
 GEOINTEL_GUEST_ACCESS_ENABLED="${GEOINTEL_GUEST_ACCESS_ENABLED:-true}"
 GEOINTEL_GUEST_DISPLAY_NAME="${GEOINTEL_GUEST_DISPLAY_NAME:-Gast}"
 GEOINTEL_GUEST_SESSION_TTL_SECONDS="${GEOINTEL_GUEST_SESSION_TTL_SECONDS:-7200}"
@@ -189,6 +195,17 @@ validate_runtime_config() {
     return 2
   fi
 
+  case "$GEOINTEL_MAX_IN_MEMORY_VECTOR_MB" in
+    ''|*[!0-9]*)
+      echo "GEOINTEL_MAX_IN_MEMORY_VECTOR_MB must be a whole number." >&2
+      return 2
+      ;;
+  esac
+  if [ "$GEOINTEL_MAX_IN_MEMORY_VECTOR_MB" -lt 1 ] || [ "$GEOINTEL_MAX_IN_MEMORY_VECTOR_MB" -gt 256 ]; then
+    echo "GEOINTEL_MAX_IN_MEMORY_VECTOR_MB must be between 1 and 256." >&2
+    return 2
+  fi
+
   case "$GEOINTEL_AUTH_ENABLED" in
     true|false) ;;
     *)
@@ -212,6 +229,36 @@ validate_runtime_config() {
     esac
   fi
 
+  local authentik_count=0
+  local authentik_value
+  for authentik_value in \
+    "$GEOINTEL_AUTHENTIK_ISSUER" \
+    "$GEOINTEL_AUTHENTIK_CLIENT_ID" \
+    "$GEOINTEL_AUTHENTIK_CLIENT_SECRET" \
+    "$GEOINTEL_AUTHENTIK_ALLOWED_EMAIL"; do
+    if [ -n "$authentik_value" ]; then
+      authentik_count=$((authentik_count + 1))
+    fi
+  done
+  if [ "$authentik_count" -ne 0 ] && [ "$authentik_count" -ne 4 ]; then
+    echo "All GEOINTEL_AUTHENTIK_* values must be configured together." >&2
+    return 2
+  fi
+  if [ "$authentik_count" -eq 4 ]; then
+    if [ "$GEOINTEL_AUTH_ENABLED" != "true" ]; then
+      echo "GEOINTEL_AUTH_ENABLED must be true when Authentik is configured." >&2
+      return 2
+    fi
+    case "$GEOINTEL_AUTHENTIK_ISSUER" in
+      https://*) ;;
+      *) echo "GEOINTEL_AUTHENTIK_ISSUER must use HTTPS." >&2; return 2 ;;
+    esac
+    case "$GEOINTEL_PUBLIC_BASE_URL" in
+      https://*) ;;
+      *) echo "GEOINTEL_PUBLIC_BASE_URL must use HTTPS for Authentik." >&2; return 2 ;;
+    esac
+  fi
+
   case "$GEOINTEL_GUEST_ACCESS_ENABLED" in
     true|false) ;;
     *)
@@ -314,6 +361,7 @@ docker run -d \
   -e GEOINTEL_STORAGE_ROOT=/app/storage \
   -e GEOINTEL_CORS_ORIGINS="$GEOINTEL_CORS_ORIGINS" \
   -e GEOINTEL_MAX_UPLOAD_MB="$GEOINTEL_MAX_UPLOAD_MB" \
+  -e GEOINTEL_MAX_IN_MEMORY_VECTOR_MB="$GEOINTEL_MAX_IN_MEMORY_VECTOR_MB" \
   -e GEOINTEL_AOI_WORKER_ENABLED="$GEOINTEL_AOI_WORKER_ENABLED" \
   -e GEOINTEL_AOI_WORKER_POLL_SECONDS="$GEOINTEL_AOI_WORKER_POLL_SECONDS" \
   -e GEOINTEL_AUTH_ENABLED="$GEOINTEL_AUTH_ENABLED" \
@@ -321,6 +369,11 @@ docker run -d \
   -e GEOINTEL_AUTH_PASSWORD_HASH="$GEOINTEL_AUTH_PASSWORD_HASH" \
   -e GEOINTEL_AUTH_SESSION_SECRET="$GEOINTEL_AUTH_SESSION_SECRET" \
   -e GEOINTEL_AUTH_SESSION_TTL_SECONDS="$GEOINTEL_AUTH_SESSION_TTL_SECONDS" \
+  -e GEOINTEL_PUBLIC_BASE_URL="$GEOINTEL_PUBLIC_BASE_URL" \
+  -e GEOINTEL_AUTHENTIK_ISSUER="$GEOINTEL_AUTHENTIK_ISSUER" \
+  -e GEOINTEL_AUTHENTIK_CLIENT_ID="$GEOINTEL_AUTHENTIK_CLIENT_ID" \
+  -e GEOINTEL_AUTHENTIK_CLIENT_SECRET="$GEOINTEL_AUTHENTIK_CLIENT_SECRET" \
+  -e GEOINTEL_AUTHENTIK_ALLOWED_EMAIL="$GEOINTEL_AUTHENTIK_ALLOWED_EMAIL" \
   -e GEOINTEL_GUEST_ACCESS_ENABLED="$GEOINTEL_GUEST_ACCESS_ENABLED" \
   -e GEOINTEL_GUEST_DISPLAY_NAME="$GEOINTEL_GUEST_DISPLAY_NAME" \
   -e GEOINTEL_GUEST_SESSION_TTL_SECONDS="$GEOINTEL_GUEST_SESSION_TTL_SECONDS" \