- Production: https://archivesspace.lib.lehigh.edu/
- Staging: https://as-test.lib.lehigh.edu/
- Production: https://archivesspace.lib.lehigh.edu/staff
- Staging: https://as-test.lib.lehigh.edu/staff
To run the stack locally you can
git clone git@github.com:lehigh-university-libraries/archivesspace.git
cd archivesspace
make up
The stack should then be available at https://localhost
cd /opt
git clone https://github.com/lehigh-university-libraries/archivesspace archivesspace
## follow instructions at https://docs.archivesspace.org/administration/docker/
sudo cp /opt/archivesspace/scripts/systemd/archivesspace.service /etc/systemd/system/archivesspace.service
sudo systemctl enable archivesspace
sudo systemctl start archivesspace
ArchivesSpace's docker compose stack is bound to the docker service so when the docker daemon restarts on the host the service will start back up. The systemd unit is in ./scripts/systemd
Traefik uses Lehigh's Let's Encrypt wildcard certificate through Compose
secrets. The weekly wildcard updater invokes /usr/local/sbin/local-cert-hook
after it downloads these files:
- Full certificate chain:
/etc/ssl/certs/le/lib.lehigh.edu.pem - Private key:
/etc/ssl/private/le/lib.lehigh.edu.key
Install the hook and its root-only configuration on each Docker host:
cd /opt/archivesspace
sudo install -o root -g root -m 0600 \
scripts/local-cert-hook.env.example /etc/default/local-cert-hook
sudoedit /etc/default/local-cert-hook # set SLACK_WEBHOOK and EXPECTED_HOST
sudo install -o root -g root -m 0755 \
scripts/lehigh-certs.sh /usr/local/sbin/local-cert-hook
sudo chown root:root /opt/archivesspace /opt/archivesspace/docker-compose.yml certs
sudo chmod go-w /opt/archivesspace /opt/archivesspace/docker-compose.yml certs
The hook validates the full chain, hostname, expiry, private key, and key/cert pair before changing anything. It compares SHA-256 checksums with the files already backing the Compose secrets, so an unchanged renewal exits without recreating Traefik. When either file has changed, it atomically installs both and force-recreates only Traefik so Docker remounts the secrets. Any validation, Compose, or healthcheck failure is sent to Slack and logged to stderr and syslog.
The hook and every path it uses for root-level Compose operations must remain
root-owned and not group/world-writable. Salt can manage the two installed
files instead of the commands above; keep /etc/default/local-cert-hook at
mode 0600 because it contains the Slack webhook.
To invoke the same hook manually:
cd /opt/archivesspace
make lehigh-certs
SET ships syslog to their ELK stack. So to get docker's logs there we ship them to syslog.
$ cat /etc/docker/daemon.json
{
"log-driver": "syslog",
"log-opts": {
"tag": "{{.Name}}"
}
}
- Pinned docker image tags and removed host ports binds solr and mariadb no longer expose their ports on the host, leaving their network only available inside the docker network namespace
- Replaced ArchivesSpace NGINX proxy with Traefik We replaced Archivesspace's default proxy nginx config with traefik. This is so we can easily add CloudFlare Turnstile in front of the public UI
db-backup runs at 02:00 UTC, writing compressed SQL to ./backups/daily/
and the latest successful dump of each month to ./backups/monthly/.
It retains seven daily dates and the previous twelve completed months, plus the
current month's latest copy. Pruning runs only after a successful dump.
SET backs up Galera every 30 days; these additional copies are a LOCKSS
(Lots of Copies Keep Stuff Safe) precaution. They cover the configured application
database; uploaded files and other volumes still need their own backups.
Build/publish Buildkit's mysql-backup image before rollout, then set
MYSQL_BACKUP_IMAGE in .env to its published GHCR image reference with digest.
The default :main is the release handoff reference, not an immutable pin.
For an immediate dump: docker compose exec db-backup /command/with-contenv mysql-backup.sh.
See Buildkit's images/mysql-backup/README.md for restore instructions and limits.