From ddd7ad033df4e5c1d60fb990f4ea9ef017d4a422 Mon Sep 17 00:00:00 2001 From: Robert Rapp Date: Mon, 12 Oct 2026 20:41:35 +0200 Subject: [PATCH] =?UTF-8?q?nex-speech:=20Dateirechte=20explizit=20(Clone?= =?UTF-8?q?=20auf=20ops=20ist=200600,=20Piper=20l=C3=A4uft=20als=20nobody)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 --- deploy/compose/nex-speech/piper/Dockerfile | 4 ++-- deploy/compose/nex-speech/whisper/Dockerfile | 5 ++--- platform/proxmox/ansible/roles/nex-speech/tasks/main.yml | 2 +- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/deploy/compose/nex-speech/piper/Dockerfile b/deploy/compose/nex-speech/piper/Dockerfile index aa6868a..ee35150 100644 --- a/deploy/compose/nex-speech/piper/Dockerfile +++ b/deploy/compose/nex-speech/piper/Dockerfile @@ -4,9 +4,9 @@ FROM python:3.12-slim-bookworm@sha256:34386ef0cb081344d7ec1c103ba398e6e9f64e9ab3 RUN apt-get update \ && apt-get install -y --no-install-recommends ffmpeg \ && rm -rf /var/lib/apt/lists/* -COPY requirements.txt /app/requirements.txt +COPY --chmod=0644 requirements.txt /app/requirements.txt RUN pip install --no-cache-dir --disable-pip-version-check -r /app/requirements.txt -COPY app.py /app/app.py +COPY --chmod=0644 app.py /app/app.py ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 USER nobody WORKDIR /app diff --git a/deploy/compose/nex-speech/whisper/Dockerfile b/deploy/compose/nex-speech/whisper/Dockerfile index 7cdd419..c6b7eca 100644 --- a/deploy/compose/nex-speech/whisper/Dockerfile +++ b/deploy/compose/nex-speech/whisper/Dockerfile @@ -33,7 +33,6 @@ RUN apt-get update \ COPY --from=build /src/build/bin/whisper-server /usr/local/bin/whisper-server # ffmpeg-Hülle: whisper-server ruft "ffmpeg … 2>&1" auf und schriebe sonst Banner und # Container-Metadaten des Uploads ins Log. Die Hülle liegt vor /usr/bin im PATH. -COPY ffmpeg-quiet.sh /usr/local/bin/ffmpeg -COPY entrypoint.sh /usr/local/bin/entrypoint.sh -RUN chmod 0755 /usr/local/bin/ffmpeg /usr/local/bin/entrypoint.sh +COPY --chmod=0755 ffmpeg-quiet.sh /usr/local/bin/ffmpeg +COPY --chmod=0755 entrypoint.sh /usr/local/bin/entrypoint.sh ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] diff --git a/platform/proxmox/ansible/roles/nex-speech/tasks/main.yml b/platform/proxmox/ansible/roles/nex-speech/tasks/main.yml index af81870..aa7afa7 100644 --- a/platform/proxmox/ansible/roles/nex-speech/tasks/main.yml +++ b/platform/proxmox/ansible/roles/nex-speech/tasks/main.yml @@ -66,7 +66,7 @@ ansible.builtin.copy: src: "{{ playbook_dir }}/../../../../deploy/compose/nex-speech/" dest: "{{ nex_speech_dir }}/" - mode: preserve + mode: u=rwX,g=rX,o=rX # Clone auf ops ist 0600; der Piper-Container läuft als nobody directory_mode: "0755" register: nex_speech_files