Simplify deployment

[Wetzel402]

Would it be possible to deploy bar assistant similar to how Home Assistant works were there are several containers talking over their internal network and only the frontend (in this case salt rim) requires a proxy? Deployment seems complex and I find when searching the internet there are many people asking for help deploying Bar Assistant. It also seems like a bit of a security risk requiring proxying 3 different containers when it could possibly be done with one.

[dphildebrandt]

[karlomikus]

There is always room for improvement, but other than bundling all services together in one image I don't see how you can simplify it more.

Using internal docker network won't work since the browser needs to be able to resolve "http://bar-assistant:8080/"

[remoteaudio]

Are there any instructions for deploying with Portainer?

[Wetzel402]

Create a new stack using docker compose and environment variables...

version: "3"

services:
  meilisearch:
    image: getmeili/meilisearch:v1.7 # 
    container_name: meilisearch
    environment:
      - MEILI_MASTER_KEY=$MEILI_MASTER_KEY
      - MEILI_ENV=production
    restart: unless-stopped
    volumes:
      - /share/ContainerStation/bar-assistant/meilisearch_data:/meili_data:rw
    ports:
      - 7700:7700
    networks:
      ba:
        ipv4_address: 10.10.7.10

  redis:
    image: redis
    container_name: redis
    environment:
      - ALLOW_EMPTY_PASSWORD=yes
    restart: unless-stopped
    networks:
      ba:
        ipv4_address: 10.10.7.11

  bar-assistant:
    image: barassistant/server:v3
    container_name: bar-assistant
    depends_on:
      - meilisearch
      - redis
    environment:
      # - PUID=1000 # Optional
      # - PGID=1000 # Optional
      - APP_URL=http://192.168.1.176:3030
      - LOG_CHANNEL=stderr # 
      - MEILISEARCH_KEY=$MEILI_MASTER_KEY
      - MEILISEARCH_HOST=http://192.168.1.176:7700 # 
      - REDIS_HOST=redis # 
      - ALLOW_REGISTRATION=true
    restart: unless-stopped
    volumes:
      - /share/ContainerStation/bar-assistant/bar_data:/var/www/cocktails/storage/bar-assistant:rw
    ports:
      - 3030:3000
    networks:
      ba:
        ipv4_address: 10.10.7.12

  salt-rim:
    image: barassistant/salt-rim:v2
    container_name: salt-rim
    depends_on:
      - bar-assistant
    environment:
      - API_URL=http://192.168.1.176:3030
      - MEILISEARCH_URL=http://192.168.1.176:7700
      - BAR_NAME=$BAR_NAME
      - DESCRIPTION=$BAR_DESCRIPTION
      - DEFAULT_LOCALE=en-US
    restart: unless-stopped
    ports:
      - 3031:8080
    networks:
      ba:
        ipv4_address: 10.10.7.13
      
networks:
  ba:
    name: ba
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 10.10.7.0/24
          gateway: 10.10.7.1

Adjust as needed.

[remoteaudio]

I am getting the following errors. Do you know why?

In Client.php line 159:

Failed to connect to 192.168.1.176 port 7700 after 3007 ms: Couldn't connec
t to server for "http://192.168.1.176:7700/indexes/cocktails/documents".

In Psr18Client.php line 113:

Failed to connect to 192.168.1.176 port 7700 after 3007 ms: Couldn't connec
t to server for "http://192.168.1.176:7700/indexes/cocktails/documents".

In ErrorChunk.php line 55:

Failed to connect to 192.168.1.176 port 7700 after 3007 ms: Couldn't connec
t to server for "http://192.168.1.176:7700/indexes/cocktails/documents".

In CurlResponse.php line 319:

Failed to connect to 192.168.1.176 port 7700 after 3007 ms: Couldn't connec
t to server for "http://192.168.1.176:7700/indexes/cocktails/documents".

                           `

[damitjimii]

yes to putting search, salt-rim and bar-assistant all in the same container. The browser should not be making 3 connections just to run this.
The apps should have internal connections via sockets or such and give us PORT variables to change the salt-rim and api ports if they have to be exposed.
redis should have it's own container, as well as nginx proxy.

[karlomikus]

Browser client (saltrim in this case) needs a way to communicate with api and meilisearch, how to setup this networking is in the hands of the user.

These are "production ready" images and as such they try to follow best practices, basically one container, one service.

I had planned to add an all-in-one image to make deployments easier for new users, similar to what linuxserver.io images do, but for that I want to make meilisearch optional dependency first.

[damitjimii]

Hey;
Sorry to bag on you, and I really like it now that I have it working BUT;

My main difficulties deploying were understanding that all 3 (search, api and web app) all needed to be available to the browser. This is very difficultly to expose to the internet via proxy or cloudflare and is way outside the norm. Nor is it best practice; best practice is to only expose what the user needs; If the user doesn’t need the api, don’t show it. And yes, I understand API’s are exposed everywhere but that’s a choice for other clients and automation to access, and usually has key management. Here the only client I’m aware of is salt-rim.
Keeping the traffic on the backend should also increase your performance; right now it looks like you go from web container to browser, and browser to api container to database and/or files back to browser and back to web container and then render in the browser.

As for separating the apps per container; I’m not saying you shouldn’t but in this case; I see no reason for the browser to need to see the api. That traffic should stay on the host between the salt-rim web container and the bar-assistant container. Much the same as the traffic between a database and an middleware app is not exposed. Speaking of that; I would love to see the db with its own container, preferably Postgres but any regular RDMS would make data manipulation easier.

Also bad form having them both containers use the same port (8080), it’s confusing, and awkward to diagnose issues on.

The api-key issue with the exposed API kinda leaves me worried given I see no security there that I can control. I.e. it appears to be all controlled in salt-rim, which needs some sort of uncontrolled access to get it’s keys… So I’d also like to see a declared api key (as a docker environment setting) between salt-rim and the api, again, not stored in the browser; it’s not a huge deal, as there really isn’t any money on the line but at some point, if you use this for a business, it needs proper security.

The Meili is kinda a strange beast so I’m not sure what the best practice there is; but it is intended to work with mobile apps (react, etc) so I find it hard to believe they need to be exposed for web services, but who knows. I like the Meilisearch speed but it seems overkill so I agree on the optional thing.

In general; if possible; you want to expose as little as possible. But if the api really needs to be exposed, there is no reason it can’t be on the same container as salt-rim, it’s not like you don’t have other services like SQLite running there as well and connecting them all with sockets should give you some speed.

The other issue I had is no logging on the salt-rim container. Not sure if that’s a bug or just not implemented yet but also makes debugging issues difficult.

Again, sorry for all the rambling criticism; and I’ve made a huge number of assumptions here so feel free to correct me.

To reiterate; Great stuff so far, and I’m up, and functional. So I’m looking forward to whatever you are prioritizing and I don’t consider any of the above critical.
Clay

[karlomikus]

You're not bagging, don't worry.

I think the issue stems from the webserver container in docker compose example. That's optional and it just shows how to configure all services.

Saltrim container is just a bunch of html files that get served via nginx. There is nothing to log here since all the code is intended to run in your browser, everything that happens will show up in the browsers console.

Api is intended to be exposed so there should be no major security concerns. There is no plan to move to another db engine at the moment.

Saltrim communicates with meilisearch via tenant tokens which are a recommended way to hit meilisearch api endpoints.

If the user wants to expose any of these services to the public internet I would assume that he is aware of the possible security implications.

Also the managed instance available at barassistant.app is running on similar infrastructure documented in docker compose example, other than a few extra services.

Hopefully this clears some unkowns.

[damitjimii]

No, none of your example configs work on the internet. You have to combine a few entries and it’s pretty unclear what and where. Hence this request for simplified deployment and all the “api not found” issues. If you want a cleaner example configuration; I would delete the nginx, change one of the 8080 ports, publish all the ports for each container and be clear on what env variables need to be where re portainer deployment.

…

On Tue, Aug 5, 2025 at 5:32 AM Karlo Mikus ***@***.***> wrote: You're not bagging, don't worry. I think the issue stems from the webserver container in docker compose example. That's optional and it just shows how to configure all services. Saltrim container is just a bunch of html files that get served via nginx. There is nothing to log here since all the code is intended to run in your browser, everything that happens will show up in the browsers console. Api is intended to be exposed so there should be no major security concerns. There is no plan to move to another db engine at the moment. Saltrim communicates with meilisearch via tenant tokens which are a recommended way to hit meilisearch api endpoints. If the user wants to expose any of these services to the public internet I would assume that he is aware of the possible security implications. Also the managed instance available at barassistant.app is running on similar infrastructure documented in docker compose example, other than a few extra services. Hopefully this clears some unkowns. — Reply to this email directly, view it on GitHub <#311 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APQ6BTZCIBFTQVJN3VCODAT3MCB3RAVCNFSM6AAAAACDDTVHUCVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMBQGQYDMNY> . You are receiving this because you commented.Message ID: ***@***.*** com>

[zhdenny]

"publish all ports for each container"

General security practice is to only publish the port needed for the Web UI and secure the rest of your containers from bad actors. Nobody should be directly accessing BarAssistant, Meilisearch, Redis, etc.
The only thing that should be forward facing is SaltRim.

In current configuration, this is managed via the included nginx container.

I'm all for simplifying deployment....but NOT at the cost of security.

[damitjimii]

There is no functional difference between /bar and port 8080. Both are exposed the same.

…

On Tue, Aug 5, 2025 at 6:37 AM zhdenny ***@***.***> wrote: "publish all ports for each container" General security practice is to only publish the port needed for the Web UI and secure the rest of your containers from bad actors. Nobody should be directly accessing BarAssistant, Meilisearch, Redis, etc. The only thing that should be forward facing is SaltRim. In current configuration, this is managed via the included nginx container. I'm all for simplifying deployment....but NOT at the cost of security. — Reply to this email directly, view it on GitHub <#311 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APQ6BT4WDBPDRKC3RFIMBAD3MCJQ5AVCNFSM6AAAAACDDTVHUCVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMBQGUYDCMQ> . You are receiving this because you commented.Message ID: ***@***.*** com>

[damitjimii]

Here is my sanitized deployment for Cloudflare;

#Simpified bar-assistant build for portainer and cloudflair
# this assumes you have a basic knowledge of Cloudflare zerotrust and Portainer. 
services:
  meilisearch:
    image: getmeili/meilisearch:v1.12 # Never use latest tag
    container_name: meilisearch
    dns:
      - "1.1.1.1"
      - "10.10.10.10"
    # replace 10.10.10.10 with your local DNS or secondary of choice, do not replace 1.1.1.1 as that is cloudflare
    ports:
      - target: 7700
        published: 3002
        protocol: tcp
    # configure barsearch.example.com on Cloudflare zerotrust tunnel to point to http://<dockerhostIP>:3002        
    environment:
      - MEILI_NO_ANALYTICS=true
      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
      - MEILI_ENV=production
    env_file:
      - stack.env
    restart: unless-stopped
    volumes:
      - ${APPDATA}bar-assist/meilisearch_data:/meili_data

  bar-assistant:
    image: barassistant/server:v5
    container_name: bar-assistant
    dns:
      - "1.1.1.1"
      - "10.10.10.10"
    ports:
      - target: 8080
        published: 3001
        protocol: tcp
    # configure barapi.example.com on Cloudflare zerotrust tunnel to point to http://<dockerhostIP>:3001        
    depends_on:
      - meilisearch
    environment:
      - APP_URL=$API_URL
      - MEILISEARCH_KEY=$MEILI_MASTER_KEY
      - MEILISEARCH_HOST=$MEILISEARCH_URL # This needs to be host that can be resolved from inside the MEILISEARCH_URLcontainer.
      - CACHE_DRIVER=file # Change to "file" if not using redis
      - SESSION_DRIVER=file # Change to "file" if not using redis
      - ALLOW_REGISTRATION=true
    env_file:
      - stack.env
    restart: unless-stopped
    volumes:
      - ${APPDATA}bar-assist/data:/var/www/cocktails/storage/bar-assistant

  salt-rim:
    image: barassistant/salt-rim:v4
    container_name: salt-rim
    dns:
      - "1.1.1.1"
      - "10.10.10.10"
    ports:
      - target: 8080
        published: 3000
        protocol: tcp
    # configure bar.example.com on Cloudflare zerotrust tunnel to point to http://<dockerhostIP>:3000
    depends_on:
      - bar-assistant
    environment:
      - API_URL=$API_URL
      - MEILISEARCH_URL=$MEILISEARCH_URL
    env_file:
      - stack.env
    restart: unless-stopped

# Env variables 	
APPDATA='./'  #replace with your local path; useful for uploading/downloading backups, 
#On the docker host>chown -R 33:33 .  after starting the stack
MEILI_MASTER_KEY=Change.me.to.something.long
BASE_URL=https://bar.example.com
MEILISEARCH_URL=https://barsearch.example.com
API_URL=https://barapi.example.com