vh
3132a16ca0
Every fv-ml1 link on the Homepage dashboard was broken. Measured against the
live dashboard API before the fix: 16 entries pointing at the dead 10.250.50.54
and zero at the live 10.251.50.54, covering gen, M.O.G.-SEC, Scriberr, Embed,
Rerank, Reward, Coder, Dockge and six dormant seats.
The miss was structural, not careless. fv-ml1-rename-sweep.sh works from an
allowlist assembled from files that mention the HOST, and a homepage.href label
mentions only an IP -- so every stack whose sole stale reference was a label
fell outside it. The allowlist now covers those 24 files, and records how to
derive the list next time (grep the old address, subtract history) rather than
enumerating from memory.
History is still untouched, and the exclusions are now written down with the
reason each one keeps the old address: recorded benchmark results, whose
base_url is part of a measurement's provenance; the one LiteLLM comment
preserving a retired hand-test endpoint; and the cutover runbooks, where the old
address is the subject matter.
Two bugs found while applying it, both fixed here:
- deploy-stack.sh rejected any stack name containing a dot, so qwen3.5-122b,
qwopus3.5-122b and mistral-medium-3.5 could not be deployed by the script at
all. The check exists to stop path traversal, which means rejecting ".." and
"/" -- not every dot. Traversal is now rejected explicitly and tested.
- stacks/scriberr/.env.example allowed CORS only from the dead IP and from
scriberr.ana.internal, which no longer resolves; the box is at the fv site
and DNS already carries scriberr.fv.internal. The live .env had both stale
origins, i.e. an allowlist with nothing reachable in it.
Host side, applied separately: canonical pushed for the 16 stacks whose only
difference from the host was this renumber, and an in-place address-only fix for
the nine whose host copy has genuinely drifted or has no canonical copy, so that
drift survives for a deliberate reconciliation instead of being clobbered. Every
compose.yaml on fv-ml1 now reads 10.251.50.54. The labels themselves only take
effect at container creation, so the running containers still need recreating.
45 lines
2.8 KiB
Bash
45 lines
2.8 KiB
Bash
# Scriberr — copy to .env on the host at /opt/docker/compose/scriberr/.env
|
|
# Real .env is gitignored and lives only on fv-ml1.
|
|
|
|
# ── Image ────────────────────────────────────────────────────────────────
|
|
# Built locally from Dockerfile.cuda.12.9 — see the compose header for why
|
|
# the published scriberr-cuda image is NOT usable on these Blackwell cards.
|
|
SCRIBERR_IMAGE=scriberr:local-blackwell
|
|
|
|
# ── Network ──────────────────────────────────────────────────────────────
|
|
SCRIBERR_PORT=8080
|
|
SCRIBERR_BIND=0.0.0.0
|
|
# CORS. Must list every origin the UI is actually reached from, or the
|
|
# browser blocks the API calls. Comma-separated, no spaces, no trailing /.
|
|
SCRIBERR_ALLOWED_ORIGINS=http://10.251.50.54:8080,http://scriberr.fv.internal:8080
|
|
|
|
# ── GPU ──────────────────────────────────────────────────────────────────
|
|
# GPU0 is fully committed to the `gen` seat; GPU1 is the one with headroom.
|
|
SCRIBERR_GPU_ID=1
|
|
|
|
# ── Storage (on /tank — NOT the root pool, weights are multi-GB) ─────────
|
|
SCRIBERR_DATA_DIR=/tank/scriberr/data
|
|
SCRIBERR_ENV_DIR=/tank/scriberr/whisperx-env
|
|
|
|
# ── Runtime ──────────────────────────────────────────────────────────────
|
|
# ⚠ 10001, not the fleet-usual 1000. The Blackwell image's `appuser` IS 10001
|
|
# and its PUID remapping is broken — at 1000 the app cannot open its SQLite DB
|
|
# and crash-loops. The /tank dirs are chowned to 10001:10001 to match.
|
|
# See README "The PUID trap".
|
|
SCRIBERR_PUID=10001
|
|
SCRIBERR_PGID=10001
|
|
# Keep false while the app is served over plain HTTP. Setting this true
|
|
# without TLS makes login silently fail (cookie marked Secure, dropped).
|
|
SCRIBERR_SECURE_COOKIES=false
|
|
|
|
# ── Optional: summarisation / transcript chat ────────────────────────────
|
|
# Scriberr speaks the OpenAI API. Point it at the LiteLLM gateway so this
|
|
# costs nothing and stays on-prem, rather than a paid vendor key.
|
|
# Configure the base URL in the Scriberr UI (Settings -> AI provider):
|
|
# base URL : http://10.250.50.70:4000/v1
|
|
# model : summarizer (or gen / gen-reasoning)
|
|
# The key below is the shared all-agents gateway key.
|
|
# ⚠ That key also reaches PAID passthrough models (GLM, Kimi) on a shared
|
|
# tab — keep the configured model on a free local seat.
|
|
# SCRIBERR_OPENAI_API_KEY=
|