616424b223
* fix(app): depend on @testing-library/dom directly jest-dom 7 moved @testing-library/dom from a bundled dependency to a peer dependency. Nothing else pulls the top-level copy in — @testing-library/react 13 carries its own nested v8 — so it was present only as a peer, and CI installs with --legacy-peer-deps, which skips peers. Every suite then failed to load setupTests.js with "Cannot find module '@testing-library/dom'". Declare it as a devDependency so it installs under either resolution mode. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(app): import mount from cypress/react Cypress 14 removed the cypress/react18 subpath; cypress/react mounts React 18 itself. The e2e support file loads commands.js, so the stale import broke bundling for every spec, not just component tests: Module not found: Package path ./react18 is not exported from package cypress Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci: install and cache Cypress the way the bump requires The Cypress binary lives in ~/.cache/Cypress, outside node_modules, but only node_modules was cached. A restored cache satisfied npm, so npm skipped the postinstall download and the 15.x binary was never fetched: The cypress npm package is installed, but the Cypress binary is missing. Cache both paths and install the binary explicitly. Also align the JS toolchain with what actually ships. Debian 13 devices run nodejs 20.19.2 and install with a plain `npm install`; the Docker app image does the same. CI pinned older Node and passed --legacy-peer-deps, which skips peer dependencies -- that is why jest-dom 7's peer requirement passed review and broke CI. Match the devices instead. Pin caddy to 2.11.4, the version Debian 13 devices run, rather than latest. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci: test on Python 3.13, the version that ships Debian 13 devices run Python 3.13.5 and the api/controller/help images are python:3.13-trixie, but CI ran 3.11 (and one job on 3.12), so the runtime under test was two minors behind the runtime in production. Verified on 3.13 before switching: backend 1712 passed, 5 skipped; controller 883 passed. The only new warning is SQLAlchemy 1.3.22 reaching Python's deprecated datetime.utcfromtimestamp(), which is noise rather than a break. Drop api-tests-3-12: no workflow referenced it, it duplicated api-tests, and its "Sanic does not yet support 3.12" note is stale now that devices run 3.13. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| api | ||
| app | ||
| archive | ||
| controller | ||
| help | ||
| samba | ||
| web | ||
| zim | ||
| README.md | ||
WROLPi Docker
Development and testing environment using Docker containers.
Quick Start
git clone https://github.com/lrnselfreliance/wrolpi.git
cd wrolpi
git submodule update --init
docker-compose build --parallel
docker volume create --name=openstreetmap-data
docker volume create --name=openstreetmap-rendered-tiles
docker-compose run --rm api db upgrade
docker-compose up
Browse to https://localhost:8443
Services
| Service | Port(s) | Description |
|---|---|---|
| web | 8443 (HTTPS), 8084-8086 | Caddy reverse proxy |
| api | 8081 | Sanic API server |
| app | (via web) | React frontend |
| controller | 8080 | System management (FastAPI) |
| archive | 8083 | SingleFile/Readability |
| zim | (via web:8085) | Kiwix |
| help | (via web:8086) | MkDocs documentation |
| map | (via web:8084) | OpenStreetMap tile server |
TLS Certificates
WROLPi uses a two-tier PKI for HTTPS. A root CA is generated once and persists in the media directory. A leaf certificate is regenerated on every container start to pick up hostname and IP changes.
How it works
- On first start, the
webcontainer generates a root CA at/opt/media/config/ssl/. - A leaf cert signed by the root CA is created at
/etc/ssl/caddy/inside the container. - Caddy serves HTTPS on ports 443, 8084, 8085, and 8086 using the leaf cert.
- The Controller serves on port 80 with a certificate trust banner when needed.
Trusting the certificate
- Browse to
http://<host-ip>to see the Controller. If the HTTPS certificate is not yet trusted, a banner will appear with the download link and platform-specific trust instructions. - Download and install the root CA on your device.
- All HTTPS ports will work without browser warnings.
The root CA only needs to be trusted once. Leaf certs can be regenerated (hostname change, container rebuild) without needing to re-trust.
Name Constraints
The root CA is restricted to local/private networks only via X.509 Name Constraints. Even if the CA key were compromised, it cannot sign certificates for public domains.
Permitted:
- DNS:
*.local,localhost - IPv4:
127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 - IPv6:
::1,fc00::/7(unique local),fe80::/10(link-local)
EXTRA_SANS
The Docker container cannot discover the host's real LAN IP. Set EXTRA_SANS in a
.env file so the leaf certificate includes your host's IP and hostname:
# .env
EXTRA_SANS=IP:10.0.0.5,DNS:myhost.local
Each entry must have a type prefix (IP: or DNS:). Multiple entries are
comma-separated. After changing EXTRA_SANS, restart the web container:
docker compose up -d --build web
Regenerating the root CA
If you need to regenerate the root CA (e.g. after updating the certificate generation script), delete the old CA files and rebuild:
rm test/config/ssl/ca.crt test/config/ssl/ca.key
docker compose up -d --build web
All devices will need to re-download and re-trust the new CA from
http://<host-ip>/ca.crt.
Volumes
The test/ directory is mounted to /opt/media inside containers, serving as the
media directory for development. Certificate files, configs, and downloaded content
are stored here.
Two external volumes are required for the map service:
docker volume create --name=openstreetmap-data
docker volume create --name=openstreetmap-rendered-tiles
Environment Variables
| Variable | Default | Description |
|---|---|---|
MEDIA_DIRECTORY |
/opt/media |
Media directory inside containers |
EXTRA_SANS |
(empty) | Additional SANs for the TLS leaf certificate |
WEB_HOST |
0.0.0.0 |
Host bind address for the web service |
WEB_HTTPS_PORT |
8443 |
HTTPS port |
REACT_APP_API |
0.0.0.0:8081 |
API bind address |
UID |
1000 |
User ID for api/app containers |
GID |
1000 |
Group ID for api/app containers |
Upgrading
See UPGRADE.md for upgrade instructions.