Jens/geointel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: prepare repository for public release

Browse Source
This commit is contained in:
Jens
2026-08-31 07:23:03 +02:00
parent 03df2db8b6
commit e43d7aca68
164 changed files with 694 additions and 29691 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/unraid/MANUAL_DEPLOY.md
+5 -5
View File
@@ -2,7 +2,7 @@
Voor als de bestaande deploy stuk is en je de code met de hand kopieert
(zip/scp/SMB) in plaats van via `git clone`. Eindresultaat: **één** container
met de naam `geointel`, bereikbaar op `http://192.168.10.150:1202`.
met de naam `geointel`, bereikbaar op `http://192.0.2.10:1202`.
---
@@ -21,7 +21,7 @@ die staat niet in je Windows-map. Kopieer dus overschrijvend, niet met een
```powershell
# Vanaf Windows, veilig: kopieert en overschrijft, verwijdert niets aan de doelkant.
robocopy C:\Projects\geointel \\192.168.10.150\appdata\geointel /E
robocopy C:\Projects\geointel \\192.0.2.10\appdata\geointel /E
```
---
@@ -62,10 +62,10 @@ GEOINTEL_STORAGE_PATH=/mnt/user/appdata/geointel/storage
GEOINTEL_POSTGIS_DATA_PATH=/mnt/user/appdata/geointel/postgres-data
GEOINTEL_MODELS_PATH=/mnt/user/appdata/geointel/models
GEOINTEL_BACKUPS_PATH=/mnt/user/appdata/geointel/backups
GEOINTEL_CORS_ORIGINS=https://geointel.itworx.tech,http://geointel.itworx.tech,http://localhost:1202,http://127.0.0.1:1202,http://192.168.10.150:1202
GEOINTEL_CORS_ORIGINS=https://geointel.example.com,http://geointel.example.com,http://localhost:1202,http://127.0.0.1:1202,http://192.0.2.10:1202
```
Staat Nginx Proxy Manager voor poort 1202 op `geointel.itworx.tech`, dan moet
Staat Nginx Proxy Manager voor poort 1202 op `geointel.example.com`, dan moet
die hostname in `GEOINTEL_CORS_ORIGINS` staan — anders blokkeert de browser de
API-calls vanaf het publieke adres. De backend doet geen host-validatie, dus
verder is er niets nodig aan applicatiekant.
@@ -164,7 +164,7 @@ curl -fsS http://127.0.0.1:1202/health/ready
curl -fsS http://127.0.0.1:1202/api/v1/system/capabilities
```
Browser: `http://192.168.10.150:1202`
Browser: `http://192.0.2.10:1202`
Bij problemen:
deploy/unraid/README.md
+15 -12
View File
@@ -78,7 +78,7 @@ bash deploy/unraid/deploy-release.sh
Set `GEOINTEL_POSTGRES_PASSWORD` to a unique value before that first start.
For a browser login, set `GEOINTEL_AUTH_ENABLED=true`, configure one exact
Browser login is enabled by default for the packaged runtime. Configure one exact
`GEOINTEL_AUTH_USERNAME`, a `pbkdf2_sha256` password hash and an independent
random `GEOINTEL_AUTH_SESSION_SECRET` of at least 32 characters. The plaintext
password is never stored in the repository or container configuration. Browser
@@ -87,7 +87,11 @@ the backend remain available to trusted in-container operator scripts.
Production startup fails before replacing the active container when the
password is empty or one of the documented defaults.
Guest access is enabled by default when the operator login gate is active:
`GEOINTEL_AUTH_REQUIRE_HTTPS=true` is also the packaged default. Configure
`GEOINTEL_PUBLIC_BASE_URL` with the external HTTPS origin and terminate TLS at
the trusted reverse proxy; plaintext operator login is rejected.
Guest access is an explicit opt-in for dedicated public demo installations:
```env
GEOINTEL_GUEST_ACCESS_ENABLED=true
@@ -95,9 +99,8 @@ GEOINTEL_GUEST_DISPLAY_NAME=Gast
GEOINTEL_GUEST_SESSION_TTL_SECONDS=7200
```
No extra guest setting is required for a new authenticated deployment. Set
`GEOINTEL_GUEST_ACCESS_ENABLED=false` to disable the button and guest endpoint.
This adds **Als gast verkennen** to the landing page. The generated guest cookie
The packaged default is `false`. Setting it to `true` adds **Als gast
verkennen** to the landing page. The generated guest cookie
is short-lived, project-scoped and limited to the canonical demo workflow.
Operator mutations and access to another project are rejected by the backend,
and the frontend hides management and task-starting controls. The mechanism is
@@ -171,12 +174,12 @@ inference; it only updates the env file for the mounted local model.
Validate liveness, dependency readiness and the canonical API:
```bash
curl -fsS "http://192.168.10.150:${GEOINTEL_FRONTEND_PORT:-1202}/health/live"
curl -fsS "http://192.168.10.150:${GEOINTEL_FRONTEND_PORT:-1202}/health/ready"
curl -fsS "http://192.168.10.150:${GEOINTEL_FRONTEND_PORT:-1202}/api/v1/system/capabilities"
curl -fsS "http://192.168.10.150:${GEOINTEL_FRONTEND_PORT:-1202}/api/v1/projects"
curl -I "http://192.168.10.150:${GEOINTEL_FRONTEND_PORT:-1202}/geointel-icon.svg"
curl -I "http://192.168.10.150:${GEOINTEL_FRONTEND_PORT:-1202}/geointel-icon.png"
curl -fsS "http://192.0.2.10:${GEOINTEL_FRONTEND_PORT:-1202}/health/live"
curl -fsS "http://192.0.2.10:${GEOINTEL_FRONTEND_PORT:-1202}/health/ready"
curl -fsS "http://192.0.2.10:${GEOINTEL_FRONTEND_PORT:-1202}/api/v1/system/capabilities"
curl -fsS "http://192.0.2.10:${GEOINTEL_FRONTEND_PORT:-1202}/api/v1/projects"
curl -I "http://192.0.2.10:${GEOINTEL_FRONTEND_PORT:-1202}/geointel-icon.svg"
curl -I "http://192.0.2.10:${GEOINTEL_FRONTEND_PORT:-1202}/geointel-icon.png"
```
The live migration smoke also checks PostgreSQL database collation metadata.
@@ -201,7 +204,7 @@ Edit `.env`:
```env
GEOINTEL_FRONTEND_PORT=1203
GEOINTEL_CORS_ORIGINS=http://localhost:1203,http://127.0.0.1:1203,http://192.168.10.150:1203
GEOINTEL_CORS_ORIGINS=http://localhost:1203,http://127.0.0.1:1203,http://192.0.2.10:1203
```
Apply:
deploy/unraid/geointel-unraid-template.xml
+8 -7
View File
@@ -2,17 +2,17 @@
<Container version="2">
<Name>geointel</Name>
<Repository>geointel-all-in-one:latest</Repository>
<Registry>gitea-widefrog:NuklearRabbit/geointel.git</Registry>
<Registry>https://gitea.example.com/owner/geointel</Registry>
<Network>bridge</Network>
<Shell>bash</Shell>
<Privileged>false</Privileged>
<Support>http://192.168.10.150:1202</Support>
<Support>https://gitea.example.com/owner/geointel/issues</Support>
<Project>GeoIntel Belgium and North Sea</Project>
<Overview>GeoIntel all-in-one runs the Belgium and Belgian North Sea workbench in one Docker container: embedded PostGIS, FastAPI backend, nginx frontend and MapLibre UI. Use docker-compose.unraid.yml or this template so the web port, storage path and database path can be edited from Unraid.</Overview>
<Category>Productivity: Tools: GIS:</Category>
<WebUI>http://[IP]:[PORT:80]/</WebUI>
<TemplateURL>deploy/unraid/geointel-unraid-template.xml</TemplateURL>
<Icon>http://192.168.10.150:1202/geointel-icon.png</Icon>
<Icon>https://gitea.example.com/owner/geointel/raw/branch/main/frontend/public/geointel-icon.png</Icon>
<ExtraParams>--add-host=host.docker.internal:host-gateway</ExtraParams>
<PostArgs/>
<CPUset/>
@@ -30,20 +30,21 @@
<Config Name="Postgres Database" Target="GEOINTEL_POSTGRES_DB" Default="geointel" Mode="" Description="Embedded PostGIS database name." Type="Variable" Display="advanced" Required="true" Mask="false">geointel</Config>
<Config Name="Postgres User" Target="GEOINTEL_POSTGRES_USER" Default="geointel" Mode="" Description="Embedded PostGIS database user." Type="Variable" Display="advanced" Required="true" Mask="false">geointel</Config>
<Config Name="Postgres Password" Target="GEOINTEL_POSTGRES_PASSWORD" Default="change-me-before-shared-use" Mode="" Description="Embedded PostGIS database password. Change before shared use." Type="Variable" Display="advanced" Required="true" Mask="true">change-me-before-shared-use</Config>
<Config Name="CORS Origins" Target="GEOINTEL_CORS_ORIGINS" Default="http://localhost:1202,http://127.0.0.1:1202,http://192.168.10.150:1202" Mode="" Description="Comma-separated browser origins allowed to call the backend directly." Type="Variable" Display="advanced" Required="false" Mask="false">http://localhost:1202,http://127.0.0.1:1202,http://192.168.10.150:1202</Config>
<Config Name="CORS Origins" Target="GEOINTEL_CORS_ORIGINS" Default="https://geointel.example.com,http://localhost:1202,http://127.0.0.1:1202" Mode="" Description="Comma-separated browser origins allowed to call the backend directly; replace the example HTTPS host." Type="Variable" Display="advanced" Required="false" Mask="false">https://geointel.example.com,http://localhost:1202,http://127.0.0.1:1202</Config>
<Config Name="Max Upload MB" Target="GEOINTEL_MAX_UPLOAD_MB" Default="500" Mode="" Description="Maximum upload size in MiB enforced consistently by nginx and the backend (1-2048)." Type="Variable" Display="advanced" Required="true" Mask="false">500</Config>
<Config Name="Max In-memory Vector MB" Target="GEOINTEL_MAX_IN_MEMORY_VECTOR_MB" Default="64" Mode="" Description="Maximum decompressed vector payload processed fully in memory by the backend (1-256 MiB)." Type="Variable" Display="advanced" Required="true" Mask="false">64</Config>
<Config Name="Operator Login Enabled" Target="GEOINTEL_AUTH_ENABLED" Default="false" Mode="" Description="Require the single configured operator login before the browser may access workbench APIs." Type="Variable" Display="advanced" Required="true" Mask="false">false</Config>
<Config Name="Operator Login Enabled" Target="GEOINTEL_AUTH_ENABLED" Default="true" Mode="" Description="Require the single configured operator login before the browser may access workbench APIs." Type="Variable" Display="advanced" Required="true" Mask="false">true</Config>
<Config Name="Require HTTPS Login" Target="GEOINTEL_AUTH_REQUIRE_HTTPS" Default="true" Mode="" Description="Reject operator password login unless the trusted proxy reports HTTPS." Type="Variable" Display="advanced" Required="true" Mask="false">true</Config>
<Config Name="Operator Username" Target="GEOINTEL_AUTH_USERNAME" Default="" Mode="" Description="Exact username for the single operator account." Type="Variable" Display="advanced" Required="false" Mask="false"></Config>
<Config Name="Operator Password Hash" Target="GEOINTEL_AUTH_PASSWORD_HASH" Default="" Mode="" Description="PBKDF2-SHA256 password hash. Never enter a plaintext password." Type="Variable" Display="advanced" Required="false" Mask="true"></Config>
<Config Name="Operator Session Secret" Target="GEOINTEL_AUTH_SESSION_SECRET" Default="" Mode="" Description="Random secret of at least 32 characters used only to sign browser sessions." Type="Variable" Display="advanced" Required="false" Mask="true"></Config>
<Config Name="Operator Session TTL" Target="GEOINTEL_AUTH_SESSION_TTL_SECONDS" Default="43200" Mode="" Description="Session lifetime in seconds (900-604800)." Type="Variable" Display="advanced" Required="true" Mask="false">43200</Config>
<Config Name="Public Base URL" Target="GEOINTEL_PUBLIC_BASE_URL" Default="http://localhost:1202" Mode="" Description="Public browser origin. Must be HTTPS when Authentik is configured." Type="Variable" Display="advanced" Required="true" Mask="false">http://localhost:1202</Config>
<Config Name="Public Base URL" Target="GEOINTEL_PUBLIC_BASE_URL" Default="https://geointel.example.com" Mode="" Description="Public HTTPS browser origin used for secure login and optional Authentik." Type="Variable" Display="advanced" Required="true" Mask="false">https://geointel.example.com</Config>
<Config Name="Authentik Issuer" Target="GEOINTEL_AUTHENTIK_ISSUER" Default="" Mode="" Description="Optional HTTPS OIDC issuer. Configure all Authentik values together." Type="Variable" Display="advanced" Required="false" Mask="false"></Config>
<Config Name="Authentik Client ID" Target="GEOINTEL_AUTHENTIK_CLIENT_ID" Default="" Mode="" Description="OIDC client identifier for GeoIntel." Type="Variable" Display="advanced" Required="false" Mask="false"></Config>
<Config Name="Authentik Client Secret" Target="GEOINTEL_AUTHENTIK_CLIENT_SECRET" Default="" Mode="" Description="OIDC client secret; never commit this value." Type="Variable" Display="advanced" Required="false" Mask="true"></Config>
<Config Name="Authentik Allowed Email" Target="GEOINTEL_AUTHENTIK_ALLOWED_EMAIL" Default="" Mode="" Description="Exact verified operator e-mail address allowed to create an operator session." Type="Variable" Display="advanced" Required="false" Mask="false"></Config>
<Config Name="Guest Demo Enabled" Target="GEOINTEL_GUEST_ACCESS_ENABLED" Default="true" Mode="" Description="Show a guest button that opens only the seeded, restricted demo workspace. Enabled by default when operator login is active; set false on non-demo instances." Type="Variable" Display="advanced" Required="true" Mask="false">true</Config>
<Config Name="Guest Demo Enabled" Target="GEOINTEL_GUEST_ACCESS_ENABLED" Default="false" Mode="" Description="Opt in to a guest button only on a dedicated demo installation with public data." Type="Variable" Display="advanced" Required="true" Mask="false">false</Config>
<Config Name="Guest Display Name" Target="GEOINTEL_GUEST_DISPLAY_NAME" Default="Gast" Mode="" Description="Label shown for the temporary guest session." Type="Variable" Display="advanced" Required="true" Mask="false">Gast</Config>
<Config Name="Guest Session TTL" Target="GEOINTEL_GUEST_SESSION_TTL_SECONDS" Default="7200" Mode="" Description="Temporary guest session lifetime in seconds (900-86400)." Type="Variable" Display="advanced" Required="true" Mask="false">7200</Config>
<Config Name="Official Orthophoto Acquisition" Target="ORTHOPHOTO_ENABLED" Default="true" Mode="" Description="Allow explicit bounded map selections to request the official Digitaal Vlaanderen orthophoto WMS." Type="Variable" Display="advanced" Required="true" Mask="false">true</Config>
deploy/unraid/geointel.env.example
+8 -8
View File
@@ -6,7 +6,7 @@
# development stack in docker-compose.yml.
COMPOSE_FILE=docker-compose.unraid.yml
# Browser URL: http://<unraid-ip>:<GEOINTEL_FRONTEND_PORT>
# Browser URL: configure the HTTPS reverse-proxy origin below.
GEOINTEL_FRONTEND_PORT=1202
# Persisted application artifacts: uploads, tiles, masks, reports and exports.
@@ -30,7 +30,7 @@ GEOINTEL_POSTGRES_PASSWORD=change-me-before-shared-use
# Browser origins allowed when directly calling the backend API.
# Neem hier ook de publieke hostname op zodra Nginx Proxy Manager ervoor staat.
GEOINTEL_CORS_ORIGINS=https://geointel.itworx.tech,http://geointel.itworx.tech,http://localhost:1202,http://127.0.0.1:1202,http://192.168.10.150:1202
GEOINTEL_CORS_ORIGINS=https://geointel.example.com,http://localhost:1202,http://127.0.0.1:1202
# Upload guard in MiB. The same 1-2048 limit is applied by nginx and FastAPI.
GEOINTEL_MAX_UPLOAD_MB=500
@@ -42,7 +42,8 @@ GEOINTEL_AOI_WORKER_POLL_SECONDS=2
# Optional single-operator access gate. Never store a plaintext password here.
# Generate the password hash with AuthService.hash_password and use a unique,
# random session secret of at least 32 characters.
GEOINTEL_AUTH_ENABLED=false
GEOINTEL_AUTH_ENABLED=true
GEOINTEL_AUTH_REQUIRE_HTTPS=true
GEOINTEL_AUTH_USERNAME=
GEOINTEL_AUTH_PASSWORD_HASH=
GEOINTEL_AUTH_SESSION_SECRET=
@@ -50,18 +51,17 @@ GEOINTEL_AUTH_SESSION_TTL_SECONDS=43200
# Optional additive Authentik OIDC login. Configure all fields together. The
# local operator credentials above remain the recovery login.
GEOINTEL_PUBLIC_BASE_URL=http://localhost:1202
GEOINTEL_PUBLIC_BASE_URL=https://geointel.example.com
GEOINTEL_AUTHENTIK_ISSUER=
GEOINTEL_AUTHENTIK_CLIENT_ID=
GEOINTEL_AUTHENTIK_CLIENT_SECRET=
GEOINTEL_AUTHENTIK_ALLOWED_EMAIL=
# Guest access is enabled by default whenever operator authentication is active.
# It opens the seeded GeoIntel demo in a temporary, API-enforced restricted
# session. Set this to false on installations containing private project data.
# Guest access is opt-in. It opens the seeded GeoIntel demo in a temporary,
# API-enforced restricted session and belongs only on a dedicated demo install.
# LET OP: scripts/configure_operator_login.sh zet dit op false tenzij je
# expliciet --guest-access true meegeeft.
GEOINTEL_GUEST_ACCESS_ENABLED=true
GEOINTEL_GUEST_ACCESS_ENABLED=false
GEOINTEL_GUEST_DISPLAY_NAME=Gast
GEOINTEL_GUEST_SESSION_TTL_SECONDS=7200
deploy/unraid/run-dockerman-container.sh
+23 -4
View File
@@ -31,22 +31,23 @@ GEOINTEL_POSTGIS_DATA_PATH="${GEOINTEL_POSTGIS_DATA_PATH:-/mnt/user/appdata/geoi
GEOINTEL_POSTGRES_DB="${GEOINTEL_POSTGRES_DB:-geointel}"
GEOINTEL_POSTGRES_USER="${GEOINTEL_POSTGRES_USER:-geointel}"
GEOINTEL_POSTGRES_PASSWORD="${GEOINTEL_POSTGRES_PASSWORD:-}"
GEOINTEL_CORS_ORIGINS="${GEOINTEL_CORS_ORIGINS:-http://localhost:${GEOINTEL_FRONTEND_PORT},http://127.0.0.1:${GEOINTEL_FRONTEND_PORT},http://192.168.10.150:${GEOINTEL_FRONTEND_PORT}}"
GEOINTEL_CORS_ORIGINS="${GEOINTEL_CORS_ORIGINS:-http://localhost:${GEOINTEL_FRONTEND_PORT},http://127.0.0.1:${GEOINTEL_FRONTEND_PORT}}"
GEOINTEL_MAX_UPLOAD_MB="${GEOINTEL_MAX_UPLOAD_MB:-500}"
GEOINTEL_MAX_IN_MEMORY_VECTOR_MB="${GEOINTEL_MAX_IN_MEMORY_VECTOR_MB:-64}"
GEOINTEL_AOI_WORKER_ENABLED="${GEOINTEL_AOI_WORKER_ENABLED:-true}"
GEOINTEL_AOI_WORKER_POLL_SECONDS="${GEOINTEL_AOI_WORKER_POLL_SECONDS:-2}"
GEOINTEL_AUTH_ENABLED="${GEOINTEL_AUTH_ENABLED:-false}"
GEOINTEL_AUTH_ENABLED="${GEOINTEL_AUTH_ENABLED:-true}"
GEOINTEL_AUTH_REQUIRE_HTTPS="${GEOINTEL_AUTH_REQUIRE_HTTPS:-true}"
GEOINTEL_AUTH_USERNAME="${GEOINTEL_AUTH_USERNAME:-}"
GEOINTEL_AUTH_PASSWORD_HASH="${GEOINTEL_AUTH_PASSWORD_HASH:-}"
GEOINTEL_AUTH_SESSION_SECRET="${GEOINTEL_AUTH_SESSION_SECRET:-}"
GEOINTEL_AUTH_SESSION_TTL_SECONDS="${GEOINTEL_AUTH_SESSION_TTL_SECONDS:-43200}"
GEOINTEL_PUBLIC_BASE_URL="${GEOINTEL_PUBLIC_BASE_URL:-http://localhost:${GEOINTEL_FRONTEND_PORT}}"
GEOINTEL_PUBLIC_BASE_URL="${GEOINTEL_PUBLIC_BASE_URL:-https://geointel.example.com}"
GEOINTEL_AUTHENTIK_ISSUER="${GEOINTEL_AUTHENTIK_ISSUER:-}"
GEOINTEL_AUTHENTIK_CLIENT_ID="${GEOINTEL_AUTHENTIK_CLIENT_ID:-}"
GEOINTEL_AUTHENTIK_CLIENT_SECRET="${GEOINTEL_AUTHENTIK_CLIENT_SECRET:-}"
GEOINTEL_AUTHENTIK_ALLOWED_EMAIL="${GEOINTEL_AUTHENTIK_ALLOWED_EMAIL:-}"
GEOINTEL_GUEST_ACCESS_ENABLED="${GEOINTEL_GUEST_ACCESS_ENABLED:-true}"
GEOINTEL_GUEST_ACCESS_ENABLED="${GEOINTEL_GUEST_ACCESS_ENABLED:-false}"
GEOINTEL_GUEST_DISPLAY_NAME="${GEOINTEL_GUEST_DISPLAY_NAME:-Gast}"
GEOINTEL_GUEST_SESSION_TTL_SECONDS="${GEOINTEL_GUEST_SESSION_TTL_SECONDS:-7200}"
ORTHOPHOTO_ENABLED="${ORTHOPHOTO_ENABLED:-true}"
@@ -213,6 +214,14 @@ validate_runtime_config() {
return 2
;;
esac
case "$GEOINTEL_AUTH_REQUIRE_HTTPS" in
true|false) ;;
*)
echo "GEOINTEL_AUTH_REQUIRE_HTTPS must be true or false." >&2
return 2
;;
esac
if [ "$GEOINTEL_AUTH_ENABLED" = "true" ]; then
if [ -z "$GEOINTEL_AUTH_USERNAME" ] \
|| [ -z "$GEOINTEL_AUTH_PASSWORD_HASH" ] \
@@ -227,6 +236,15 @@ validate_runtime_config() {
return 2
;;
esac
if [ "$GEOINTEL_AUTH_REQUIRE_HTTPS" = "true" ]; then
case "$GEOINTEL_PUBLIC_BASE_URL" in
https://*) ;;
*)
echo "GEOINTEL_PUBLIC_BASE_URL must use HTTPS when operator login requires HTTPS." >&2
return 2
;;
esac
fi
fi
local authentik_count=0
@@ -365,6 +383,7 @@ docker run -d \
-e GEOINTEL_AOI_WORKER_ENABLED="$GEOINTEL_AOI_WORKER_ENABLED" \
-e GEOINTEL_AOI_WORKER_POLL_SECONDS="$GEOINTEL_AOI_WORKER_POLL_SECONDS" \
-e GEOINTEL_AUTH_ENABLED="$GEOINTEL_AUTH_ENABLED" \
-e GEOINTEL_AUTH_REQUIRE_HTTPS="$GEOINTEL_AUTH_REQUIRE_HTTPS" \
-e GEOINTEL_AUTH_USERNAME="$GEOINTEL_AUTH_USERNAME" \
-e GEOINTEL_AUTH_PASSWORD_HASH="$GEOINTEL_AUTH_PASSWORD_HASH" \
-e GEOINTEL_AUTH_SESSION_SECRET="$GEOINTEL_AUTH_SESSION_SECRET" \