k1nq/TREK

mirror of https://github.com/mauriceboe/TREK.git synced 2026-10-18 21:16:47 +00:00

Files

T

jubnl 6c87bf2f7a feat(help): serve the in-app wiki from disk instead of fetching GitHub

The /help pages fetched their markdown from raw.githubusercontent.com at
runtime, so a self-hosted install was served docs from main rather than the
version it was actually running, and help was unusable without network access.
The wiki/ directory was in the repo the whole time; the bundled-snapshot
fallback the code reached for was gitignored and never populated by any build
step, so it was dead code.

Read wiki/ straight from disk instead. server/{src,dist}/services both sit
three levels under the repo root, so a single __dirname anchor resolves in dev,
a built source install, vitest and Docker with no copy or build step. GitHub is
kept strictly as a fallback for when the directory cannot be resolved, decided
once at load by probing for _Sidebar.md: a page missing from a present wiki is
a genuine 404, since falling back per-file would reintroduce the version skew
this removes.

Ship wiki/ in the image: .dockerignore excluded it outright, so the COPY alone
would have produced an image with no wiki, and the GitHub fallback would have
masked that at runtime. Add a real path-containment check on assets now that
the path becomes a filesystem read rather than a URL, and document
TREK_WIKI_DIR as an off-by-default escape hatch across the deployment configs.

2026-07-13 23:11:59 +02:00

trek

feat(help): serve the in-app wiki from disk instead of fetching GitHub

2026-07-13 23:11:59 +02:00

README.md

3.2.0 (#1426 )

2026-07-05 01:13:04 +02:00

README.md

TREK Helm Chart

This is a minimal Helm chart for deploying the TREK app.

Features

Deploys the TREK container
Exposes port 3000 via Service
Optional persistent storage for /app/data and /app/uploads
Configurable environment variables and secrets
Optional generic Ingress support
Health checks on /api/health

Helm Repository

A hosted Helm repository is available:

helm repo add trek https://mauriceboe.github.io/TREK
helm repo update
helm install trek trek/trek

Usage

Or install directly from the local chart:

helm install trek ./chart \
  --set ingress.enabled=true \
  --set ingress.hosts[0].host=yourdomain.com

See values.yaml for more options.

Files

Chart.yaml — chart metadata
values.yaml — configuration values
templates/ — Kubernetes manifests

Notes

Ingress is off by default. Enable and configure hosts for your domain.
PVCs use the cluster's default StorageClass. Set persistence.data.storageClassName and/or persistence.uploads.storageClassName to bind a specific class.
To use your own PVCs, set persistence.data.existingClaim and/or persistence.uploads.existingClaim. The other values for that volume (size, storageClassName, annotations) are then ignored.
With persistence.enabled: false, the data and uploads volumes use an emptyDir — storage is ephemeral and lost on pod restart. Intended for testing only.
JWT_SECRET is managed entirely by the server — auto-generated into the data PVC on first start and rotatable via the admin panel (Settings → Danger Zone). No Helm configuration needed.
ENCRYPTION_KEY encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. Recommended: set via secretEnv.ENCRYPTION_KEY or existingSecret. If left empty, the server falls back automatically: existing installs use data/.jwt_secret (no action needed on upgrade); fresh installs auto-generate a key persisted to the data PVC.
If using ingress, you must manually keep env.ALLOWED_ORIGINS and ingress.hosts in sync to ensure CORS works correctly. The chart does not sync these automatically.
Set env.ALLOW_INTERNAL_NETWORK: "true" if Immich or other integrated services are hosted on a private/RFC-1918 address (e.g. a pod on the same cluster or a NAS on your LAN). Loopback (127.x) and link-local/metadata addresses (169.254.x) remain blocked regardless.
FORCE_HTTPS is optional. Set env.FORCE_HTTPS: "true" only when ingress (or another proxy) terminates TLS. It enables HTTPS redirects, HSTS, CSP upgrade-insecure-requests, and forces the session cookie secure flag. Requires TRUST_PROXY to be set.
Set env.TRUST_PROXY: "1" (or the number of proxy hops) when running behind ingress or a load balancer. Required for FORCE_HTTPS to detect the forwarded protocol correctly. In production it defaults to 1 automatically.
COOKIE_SECURE is auto-derived (on when NODE_ENV=production or FORCE_HTTPS=true). Set env.COOKIE_SECURE: "false" only during local testing without TLS. Not recommended for production.
Set env.OIDC_DISCOVERY_URL to override the auto-constructed OIDC discovery endpoint. Required for providers (e.g. Authentik) that expose it at a non-standard path.