homeio

1#!/bin/sh
2set -e
3
4APP_USER=homeio
5DOCKER_SOCKET="${DOCKER_SOCKET_PATH:-/var/run/docker.sock}"
6
7# The app talks to the Docker socket to list containers and to run
8# `docker compose` for every install. The socket is owned by a group whose id
9# differs per host (docker on Debian, root under Docker Desktop), so the id is
10# read at start-up rather than baked into the image. Without this the app runs
11# but every Docker call fails with EACCES, and it fails quietly.
12if [ -S "$DOCKER_SOCKET" ] && [ "$(id -u)" = "0" ]; then
13  SOCKET_GID="$(stat -c '%g' "$DOCKER_SOCKET")"
14
15  if [ "$SOCKET_GID" = "0" ]; then
16    # Docker Desktop exposes it as root:root; only the root group can reach it.
17    addgroup "$APP_USER" root 2>/dev/null || true
18  else
19    EXISTING_GROUP="$(getent group "$SOCKET_GID" | cut -d: -f1)"
20    if [ -z "$EXISTING_GROUP" ]; then
21      EXISTING_GROUP=dockerhost
22      addgroup -g "$SOCKET_GID" "$EXISTING_GROUP" 2>/dev/null || true
23    fi
24    addgroup "$APP_USER" "$EXISTING_GROUP" 2>/dev/null || true
25  fi
26
27  echo "Docker socket group: ${SOCKET_GID}"
28elif [ ! -S "$DOCKER_SOCKET" ]; then
29  echo "WARNING: ${DOCKER_SOCKET} is not mounted — app management will not work."
30fi
31
32# The compose file ships a placeholder secret, and production refuses it — so
33# `git clone && docker compose up -d`, the quickstart in the README, crash-looped
34# on the instrumentation hook with a 500 on /api/health. The Linux installer has
35# always generated one; do the same here, and persist it so sessions survive a
36# restart. Without a writable state directory the secret is per-boot, which
37# signs everyone out on restart but still beats refusing to start.
38SECRET_STATE_DIR="${HOMEIO_STATE_DIR:-/stacks}"
39SECRET_FILE="${SECRET_STATE_DIR}/.session-secret"
40PLACEHOLDER_SECRET="change-me-to-a-random-32-char-secret"
41
42if [ -z "${AUTH_SESSION_SECRET:-}" ] || [ "${AUTH_SESSION_SECRET}" = "${PLACEHOLDER_SECRET}" ]; then
43  if [ -s "$SECRET_FILE" ]; then
44    AUTH_SESSION_SECRET="$(cat "$SECRET_FILE")"
45  else
46    AUTH_SESSION_SECRET="$(od -An -tx1 -N32 /dev/urandom | tr -d ' \n')"
47    if mkdir -p "$SECRET_STATE_DIR" 2>/dev/null &&
48       printf '%s' "$AUTH_SESSION_SECRET" > "$SECRET_FILE" 2>/dev/null; then
49      chmod 600 "$SECRET_FILE" 2>/dev/null || true
50      [ "$(id -u)" = "0" ] && chown "$APP_USER" "$SECRET_FILE" 2>/dev/null
51      echo "Generated a session secret and stored it at ${SECRET_FILE}."
52    else
53      echo "WARNING: could not persist a session secret to ${SECRET_FILE};" \
54           "a new one is generated on every start, so sessions will not survive a restart."
55    fi
56  fi
57fi
58export AUTH_SESSION_SECRET
59
60# Default V8 heap cap is generous for amd64 (1.5 GB) but exceeds the
61# total RAM of a Pi 3 (1 GB). Apply a Pi-friendly default unless the
62# operator overrides via NODE_OPTIONS.
63if [ -z "${NODE_OPTIONS:-}" ]; then
64  NODE_OPTIONS="--max-old-space-size=768"
65fi
66export NODE_OPTIONS
67
68if [ -f "dist-server/server.js" ]; then
69  SERVER_ENTRY=dist-server/server.js
70else
71  SERVER_ENTRY=server.js
72fi
73
74echo "Running database migrations..."
75
76if [ "$(id -u)" = "0" ]; then
77  su-exec "$APP_USER" node_modules/.bin/drizzle-kit push --config drizzle.config.ts
78  exec su-exec "$APP_USER" node "$SERVER_ENTRY"
79fi
80
81node_modules/.bin/drizzle-kit push --config drizzle.config.ts
82exec node "$SERVER_ENTRY"
83