fix(xrdb): update the app for XRDB v3

[IbbyLabs]

We added the xrdb app in #97 and maintained it for about ten days (#101, then a data-directory fix on 20 May). XRDB was rewritten after that and we did not come back to it, so the app here still describes v2 while :latest has served v3 since the rewrite. Everything below is ours rather than something wrong with the template.

A fresh deploy does not come up:

                  v3 image                       apps/xrdb
listens on        :8787                          traefik routes to 3000
database          /data/xrdb.db  (VOLUME /data)  host dir mounted at /app/data

Traefik gets a connection refused, so the route 502s. If it did start, saved profiles would be written into an anonymous volume rather than the mounted data directory.

compose.yaml — the image sets XRDB_ADDR=:8787, XRDB_DB=/data/xrdb.db and VOLUME ["/data"], so the port moves to 8787 and the volume to /data. The PORT and XRDB_DB_PATH environment entries are dropped; v3 reads neither. XRDB_IMAGE_TAG is unchanged.

.env — 14 of the documented variables do not exist in v3. Replaced with XRDB's own env.template, so it stays in step with the image rather than drifting again, with a short header for the two values this repo owns (XRDB_IMAGE_TAG, DOCKER_NETWORK_EXTERNAL). It also opens with the v2 to v3 rename table, which is what someone updating an existing deployment needs.

Authelia — the bypass list is rewritten for v3's routes, and a two_factor rule for ^/api/admin(/.*)?$ goes above it, following the ordering the Stremio addon rules already use at the top of the file.

The admin rule matters because XRDB_ADMIN_KEY is unset by default, and while it is unset part of /api/admin has no second gate. DELETE /api/admin/cache is the sharp one: it drops every rendered image. The old ^/api(/.*)?$ line covered it.

Going the other way, v3's Stremio addon lives under /stremio and was not bypassed, so Stremio could not fetch the manifest. /healthz and /readyz were not bypassed either. /proxy and /preview were, and are not routes in v3.

The RPDB-compatible routes are anchored on the literal second segment rather than matching any first segment, so they cannot reach /api/.

Checked

Patterns parsed back out of the edited file and run against real request paths, including query strings, since Authelia matches resources against path and query:

14 client paths      all bypass
11 admin/profile     none bypass
deny rule            matches /api/admin, /api/admin/cache, /api/admin/settings
rule order in file   two_factor, then bypass

I have not deployed the template itself, so the compose and env changes are checked against the image's Dockerfile and XRDB's env.template rather than by bringing the stack up.

I work on XRDB, so treat the route list as first-hand and the template conventions as my best reading of the surrounding file. Happy to reshape it if it does not match how you would rather have it.

— Milo#5574