OverCooked Customer Installer

This repository is the public, image-only customer installer. A customer does not need access to any application source repository. The installer downloads only these public images:

git.leee.xin/overcooked/overcooked-e
git.leee.xin/overcooked/overcooked-s-control
git.leee.xin/overcooked/overcooked-s-webui
git.leee.xin/overcooked/overcooked-media-node

It does not download or start an Auth image, and it does not use Docker build contexts.

Because E production mode requires an encrypted control-plane connection, the installer generates a minimal allowlisted HTTPS reverse proxy at install time and runs it from the already-listed S WebUI image. The proxy only accepts mTLS-authenticated /internal/v1/ requests and /health/live, and forwards only to the S control service; it is not a public endpoint and does not expose Shell, SQL, Docker, or arbitrary file access.

Install

curl -fsSL \\
  https://git.leee.xin/OverCooked/OverCooked-Installer/raw/branch/main/install.sh \\
  -o install.sh

sudo env \\
  OVERCOOKED_SERVER_IP=203.0.113.10 \\
  OVERCOOKED_AUTH_PUBLIC_KEYS='{"auth-1":"PUBLIC_KEY"}' \\
  OVERCOOKED_ACTIVATION_CODE='ACTIVATION_CODE' \\
  ./install.sh

The default central Auth endpoint is http://148.135.97.10:18091. Override it with OVERCOOKED_AUTH_URL. Auth private keys, administrator credentials, license databases, provider credentials, and production secrets are never included in this repository.

Turnstile is optional. Set OVERCOOKED_TURNSTILE_SITE_KEY and OVERCOOKED_TURNSTILE_SECRET_KEY together to enable it; leaving both empty disables only the Turnstile challenge and does not disable Auth, license, or login policy checks. A partial pair is rejected by S configuration validation.

Endpoints

WebUI: http://SERVER_IP:18083/
S API: http://SERVER_IP:18080/
E: http://SERVER_IP:8096/
First setup: http://SERVER_IP:18083/setup

The installer checks these host ports before changing service state and does not bind ports 80 or 443. Configure the firewall to allow the chosen public ports and restrict database/Valkey traffic to the Docker networks.

S's E client uses the private backend Docker network (http://e-server:8096) with its explicit private-network opt-in. E's control-plane client is a separate production path and always uses the generated HTTPS/mTLS proxy.

The server address is selected from OVERCOOKED_SERVER_IP, or from the interface selected by ip -4 route get 1.1.1.1. A detected RFC1918, loopback, link-local, or carrier-grade NAT address is rejected unless explicitly provided through OVERCOOKED_SERVER_IP.

Configuration and logs

OVERCOOKED_REGISTRY and OVERCOOKED_VERSION override the default image registry and tag. OVERCOOKED_ROOT changes the default /opt/overcooked installation directory. Generated production.env is mode 600 and contains the setup token and randomly generated service keys. The installer never prints those values. Keep the file private.

docker compose --env-file /opt/overcooked/production.env \\
  -f /opt/overcooked/compose/s.yml -p overcooked-s ps
docker compose --env-file /opt/overcooked/production.env \\
  -f /opt/overcooked/compose/e.yml -p overcooked-e logs --tail=100

Migration is fail-closed. E uses the migration command built into its official image. S uses only the schema migration assets published in this repository. If either migration fails, the installer exits non-zero and does not start the corresponding application service.

The fixed PostgreSQL roles are product_e and product_s; the installer never uses a postgres superuser login. A retry reuses the passwords in the existing mode-600 production.env and keeps named volumes. If a role password cannot be authenticated, it stops with DATABASE_PASSWORD_MISMATCH_NEEDS_MANUAL_RECOVERY and does not delete data. Only a failed E database volume may be reset, and only when both OVERCOOKED_RESET_FAILED_INSTALL=1 and OVERCOOKED_CONFIRM_NO_BUSINESS_DATA=YES are explicitly supplied. No down -v or broad volume cleanup is performed.

The installer also exports the approved Media Node image into /opt/overcooked/node-images/media-node.tar.gz; S uses that archive when a customer adds a node without a source checkout.

Common 404/401 download failures

The customer command must fetch the raw script from the public Installer repository. A 404 usually means a wrong repository, branch, or raw path. A 401/403 means that a private source URL or credentialed mirror was used. Do not grant customer access to application source to work around these errors. Use the public raw URL and verify anonymous image pulls instead.

Uninstall

Review the project names and volumes first, then stop the two projects:

docker compose --env-file /opt/overcooked/production.env \\
  -f /opt/overcooked/compose/s.yml -p overcooked-s down
docker compose --env-file /opt/overcooked/production.env \\
  -f /opt/overcooked/compose/e.yml -p overcooked-e down

The named volumes contain customer data and are intentionally not removed by the installer or this documentation.

5.0 KiB Raw Permalink Blame History