Buildfix

Dockerfile

@@ -18,8 +18,9 @@ ENV RAILS_ENV="production" \
 
 RUN \
   apk add --no-cache \
-    assimp \
+    assimp-dev \
     file \
+    gcompat \
     glfw \
     imagemagick \
     imagemagick-heic \
@@ -72,6 +73,7 @@ RUN \
   touch db/schema.rb && \
   DATABASE_URL="nulldb://user:pass@localhost/db" \
   SECRET_KEY_BASE="placeholder" \
+  APP_VERSION=${MANYFOLD_VERSION} \
   bundle exec rake assets:precompile && \
   rm db/schema.rb && \
   printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \

Dockerfile.aarch64

@@ -18,8 +18,9 @@ ENV RAILS_ENV="production" \
 
 RUN \
   apk add --no-cache \
-    assimp \
+    assimp-dev \
     file \
+    gcompat \
     glfw \
     imagemagick \
     imagemagick-heic \
@@ -72,6 +73,7 @@ RUN \
   touch db/schema.rb && \
   DATABASE_URL="nulldb://user:pass@localhost/db" \
   SECRET_KEY_BASE="placeholder" \
+  APP_VERSION=${MANYFOLD_VERSION} \
   bundle exec rake assets:precompile && \
   rm db/schema.rb && \
   printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \

README.md

@@ -124,7 +124,7 @@ Containers are configured using parameters passed at runtime (such as those abov
 | `-e TZ=Etc/UTC` | specify a timezone to use, see this [list](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List). |
 | `-e DATABASE_URL=` | Database connection URL. For sqlite use `sqlite3:/config/manyfold.sqlite3`. For postgres or mariadb use `<scheme>://<username>:<password>@<hostname>:<port>/<db name>` where `<scheme>` is `postgresql` or `mysql2`. Special characters in username/password must be [URL encoded](https://en.wikipedia.org/wiki/Percent-encoding). |
 | `-e REDIS_URL=` | Redis/Valkey database URL in `redis://<hostname>:<port>/<db number>` format. |
-| `-e SECRET_KEY_BASE=` | Browser session secret. Changing it will terminate all active browser sessions. |
+| `-e SECRET_KEY_BASE=` | Browser session and database encryption key. If unset a random one will be generated on init, the database is locked to this key. |
 | `-v /config` | Persistent storage for application configuration data. |
 | `-v /libraries` | Location of your 3D model libraries. |
 
@@ -290,6 +290,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **08.10.25:** - Change key init to auto generate and persist.
 * **27.07.25:** - Rebase to Alpine 3.22.
 * **12.01.25:** - Rebase to Alpine 3.21.
 * **23.07.24:** - Initial Release.

readme-vars.yml

@@ -22,7 +22,7 @@ param_usage_include_env: true
 param_env_vars:
   - {env_var: "DATABASE_URL", env_value: "", desc: "Database connection URL. For sqlite use `sqlite3:/config/manyfold.sqlite3`. For postgres or mariadb use `<scheme>://<username>:<password>@<hostname>:<port>/<db name>` where `<scheme>` is `postgresql` or `mysql2`. Special characters in username/password must be [URL encoded](https://en.wikipedia.org/wiki/Percent-encoding)."}
   - {env_var: "REDIS_URL", env_value: "", desc: "Redis/Valkey database URL in `redis://<hostname>:<port>/<db number>` format."}
-  - {env_var: "SECRET_KEY_BASE", env_value: "", desc: "Browser session secret. Changing it will terminate all active browser sessions."}
+  - {env_var: "SECRET_KEY_BASE", env_value: "", desc: "Browser session and database encryption key. If unset a random one will be generated on init, the database is locked to this key."}
 param_usage_include_ports: true
 param_ports:
   - {external_port: "3214", internal_port: "3214", port_desc: "Port for web frontend"}
@@ -84,6 +84,7 @@ init_diagram: |
   "manyfold:latest" <- Base Images
 # changelog
 changelogs:
+  - {date: "08.10.25:", desc: "Change key init to auto generate and persist."}
   - {date: "27.07.25:", desc: "Rebase to Alpine 3.22."}
   - {date: "12.01.25:", desc: "Rebase to Alpine 3.21."}
   - {date: "23.07.24:", desc: "Initial Release."}

root/etc/s6-overlay/s6-rc.d/init-manyfold-config/run

@@ -1,6 +1,20 @@
 #!/usr/bin/with-contenv bash
 # shellcheck shell=bash
 
+# set secret key if unset
+SECRET_FILE="/config/secret_key_base.txt"
+if [ -n "${SECRET_KEY_BASE}" ]; then
+  echo "**** SECRET_KEY_BASE set in environment. ****"
+elif [ -f "${SECRET_FILE}" ] && [ -s "${SECRET_FILE}" ]; then
+  export SECRET_KEY_BASE=$(cat "${SECRET_FILE}" | tr -d '[:space:]')
+else
+  echo "**** SECRET_KEY_BASE not set, generating. ****"
+  KEY=$(ruby -r "securerandom" -e "puts SecureRandom.hex(64)")
+  echo "${KEY}" > "${SECRET_FILE}"
+  export SECRET_KEY_BASE="${KEY}"
+fi
+printf "%s" "${SECRET_KEY_BASE}" > /var/run/s6/container_environment/SECRET_KEY_BASE
+
 mkdir -p \
     /app/www/log \
     /app/www/tmp