friedrichrehren/resourcespace repository overview

⁠Features

⁠Published Images

⁠What This Project Does

1. checks the ResourceSpace SVN repository once a day for the newest release branch and its latest revision
2. builds a new image when that revision is missing on GHCR or Docker Hub
3. rebuilds once a week to pick up Ubuntu security updates
4. runs a smoke test (fresh install, admin login, dump, restore) and only then pushes to Docker Hub and GHCR
5. keeps its scheduled workflows enabled – GitHub would otherwise disable them after 60 days without commits

⁠Quick Start

services:
  mariadb:
    image: mariadb:11.4
    environment:
      MARIADB_RANDOM_ROOT_PASSWORD: "1"
      MARIADB_DATABASE: resourcespace
      MARIADB_USER: resourcespace
      MARIADB_PASSWORD: change-me
    volumes:
      - db:/var/lib/mysql

  resourcespace:
    image: friedrichrehren/resourcespace:latest
    depends_on: [mariadb]
    ports:
      - "8080:80"
    environment:
      RS_BASEURL: http://localhost:8080
      RS_DB_PASSWORD: change-me
      RS_SCRAMBLE_KEY: "<openssl rand -hex 32>"
      RS_API_SCRAMBLE_KEY: "<openssl rand -hex 32>"
      RS_ADMIN_PASSWORD: "<your admin password>"
      RS_ADMIN_EMAIL: [email protected]
      RS_WAIT_FOR_SYNC: "false"
    volumes:
      - data:/data

volumes:
  db:
  data:

A complete Portainer stack with Traefik labels and a two-way SharePoint sync via rclone bisync is in stack/docker-compose.yml⁠.

⁠Environment Variables

Secrets can also be passed as files: RS_DB_PASSWORD_FILE, RS_SCRAMBLE_KEY_FILE, RS_API_SCRAMBLE_KEY_FILE, RS_ADMIN_PASSWORD_FILE, RS_SMTP_PASSWORD_FILE.

⁠Passwords with exactly 32 or 64 characters

ResourceSpace refuses every login whose password is exactly 32 or 64 characters long, because such strings look like MD5/SHA-256 hashes (rs_password_verify()). The image therefore rejects such an RS_ADMIN_PASSWORD with a clear error. The same applies to passwords users set later in the UI.

⁠The Data Volume

/data
├── filestore/   originals, previews, slideshow images (served under /filestore)
│   └── plugins/ additional third-party plugins (PHP allowed here only)
├── db-dump/     resourcespace.sql.gz – latest database dump
├── config/      config.local.php – optional, included after the generated config
├── tmp/         temporary files
└── .rclone/     state of the optional sync container

Custom ResourceSpace settings go into /data/config/config.local.php:

docker exec -it <container> nano /data/config/config.local.php

<?php
$plugins[] = 'tms_link';
$watermark = 'gfx/watermark.png';

⁠Additional Plugins

All plugins that ship with ResourceSpace can be activated and configured in the UI as usual. Third-party or custom plugins are placed in the data volume – ResourceSpace loads plugins from filestore/plugins/ in addition to its own plugins/ folder:

docker cp my_plugin <container>:/data/filestore/plugins/
docker exec <container> chown -R www-data:www-data /data/filestore/plugins/my_plugin

Then activate it in the plugin management of the admin area. PHP execution is allowed in filestore/plugins/ only; everything else in the filestore stays blocked.

Anyone who can write to filestore/plugins/ can run code in the container. The example stack therefore excludes this folder from the SharePoint sync.

⁠Restore

Database and media can be restored from the data volume alone: start the container with the restored /data and an empty database. The entrypoint imports db-dump/resourcespace.sql.gz before ResourceSpace starts. Changes made after the last dump (at most 6 hours by default) are lost; the media files are not.

RS_SCRAMBLE_KEY must be the same as before, otherwise no password matches.

⁠Differences to the Official Image

The official resourcespace/docker⁠ repository only provides a Dockerfile; its GHCR package is not public. This image keeps the same Ubuntu base and runtime packages, but

• does not ship build tools, Subversion, Postfix or OpenCV (facial recognition is deprecated upstream) – configure SMTP instead of local mail
• keeps the application code read-only; additional plugins go into /data/filestore/plugins/ (see below)
• replaces the web installer with environment variables

⁠Repository Setup

⁠Workflows

⁠Secrets and Variables

Optional repository variable RS_RELEASE pins the release branch (e.g. 11.0); default is the newest branch.

After the first run, set the GHCR package visibility to public (Package settings → Change visibility), otherwise pulls without login fail.