tom/HealthLog

0 Fork 0

mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-08 04:32:42 +00:00

Files

T

Marc-André Bombeck 69bae8bdb4 Add ENCRYPTION_KEY_CHECK=warn as an escape hatch for the boot key check

At a first start there is no recorded key yet, so an operator facing a
refusal they are certain is false has no row to delete. With
ENCRYPTION_KEY_CHECK=warn (default enforce) the check still runs and logs
its full outcome, /api/health names a mismatch as a warning field without
failing, requests are served, and no key is recorded unless every key id
passes.

The variable is on the compose whitelist, in both example files, the env
manifest, the Unraid and Portainer templates and the published-env guard.
The log block, the mismatch page and the self-hosting pages offer it as the
last resort after the three real fixes, and say that it disables a safety
check.

2026-10-03 23:46:40 +02:00

README.md

docs(self-hosting): add Unraid CA and Portainer templates, harden compose quick-start

2026-06-21 10:32:40 +02:00

templates.json

Add ENCRYPTION_KEY_CHECK=warn as an escape hatch for the boot key check

2026-10-03 23:46:40 +02:00

README.md

HealthLog on Portainer

HealthLog ships a Portainer app template that deploys the app and its PostgreSQL 16 database as one stack from the project docker-compose.yml.

Add the template

In Portainer, go to Settings → App Templates.

Set the URL to the raw template file:

https://raw.githubusercontent.com/MBombeck/HealthLog/main/docs/self-hosting/portainer/templates.json

Save. HealthLog now appears under App Templates.

Deploy

Open App Templates → HealthLog.
Fill in the variables. Generate each secret with openssl rand -hex 32 (a 64-character hex string):
- POSTGRES_PASSWORD
- ENCRYPTION_KEY — back this up; losing it makes encrypted data unrecoverable
- API_TOKEN_HMAC_KEY
- SESSION_COOKIE_SECURE — set to false for plain-HTTP / LAN access, or login silently fails. Set to true only behind an HTTPS reverse proxy.
- NEXT_PUBLIC_APP_URL and APP_URL — how you reach the app, e.g. http://nas:3000 or https://healthlog.example.com.
Deploy the stack. The app waits for PostgreSQL, runs database migrations on first boot, then starts serving.
Open the app URL. The first registered user becomes the admin.

Verify the running version:

curl -s http://<host>:3000/api/version

Notes

Persistent state lives in one named volume (pgdata, the Postgres data dir); the app container is stateless. Back up the database to back up everything.
Pin a release tag (HEALTHLOG_IMAGE_REF=:vX.Y.Z) for deliberate upgrades, or track :latest. Skim the CHANGELOG and back up before upgrading. Migrations are forward-only.
For passive discovery you can also submit this template to the community aggregator at https://github.com/Lissy93/portainer-templates.