jdsjkdjk

lean/README.md

@@ -61,13 +61,16 @@ The `BAKE_MATHLIB=false` image still ships the pinned elan toolchain, but not
 the project's `.lake`: the entrypoint notices a fresh volume and fills it once
 at first start — `lake update` fetches the sources pinned in
 `lake-manifest.json`, Mathlib's post-update hook downloads the matching
-precompiled cache, `lake build` writes the project's own module. Expect ~10
-minutes and a few hundred MB of download; restarts after that are instant,
-and **image rebuilds never touch Mathlib again** (the volume stays). The
-trade: the cache must survive on the host, first start needs network, and it
-redoes once if you recreate with a clean volume — hence the default staying
-`BAKE_MATHLIB=true`. The commented blocks in `docker-compose.yml` wire this
-up for the production stack.
+precompiled cache, `lake build` writes the project's own module. The manifest
+`lake update` resolved gets saved into the volume and re-applied at every
+start, so the packages in the volume and the manifest in the image never tell
+different stories (an unsynced pair would try to re-fetch Mathlib from GitHub
+at each session). Expect ~10 minutes and a few hundred MB of download;
+restarts after that are instant, and **image rebuilds never touch Mathlib
+again** (the volume stays). The trade: the cache must survive on the host,
+first start needs network, and it redoes once if you recreate with a clean
+volume — hence the default staying `BAKE_MATHLIB=true`. The commented blocks
+in `docker-compose.yml` wire this up for the production stack.
 
 ## The protocol the wiki's client speaks
 
@@ -138,7 +141,12 @@ browser will refuse the editor's `ws://` connection to an `http://` server
 (mixed content). Serve the
 Lean server over HTTPS — either its own `SSL_CRT_FILE`/`SSL_KEY_FILE`, or a
 reverse proxy in front (websocket upgrade on the same path) — and point
-`NUXT_PUBLIC_LEAN_URL` at the `https://` address.
+`NUXT_PUBLIC_LEAN_URL` at the `https://` address. The production stack does
+the latter: nginx serves it at `https://mathew.aranroig.com/api/lean` and
+proxies to `lean:8080`; the compose service publishes 8080 on loopback only
+(dev's frontend), so the public way in is that one address. Note that the
+bundled classic client expects to sit at the server root — under `/api/lean`
+its assets resolve against the wiki and 404; the wiki's own editor is fine.
 
 ## Updating
 

lean/entrypoint.sh

@@ -8,19 +8,33 @@
 # "Keeping Mathlib out of the image"), the project's .lake is meant to be a
 # volume: a fresh one gets filled once, at first start, so Mathlib's ~7GB of
 # compiled cache never travels through the registry.
+#
+# The manifest pairing matters: `lake update` advances the packages in .lake
+# AND rewrites lake-manifest.json — but the manifest sits in the (ephemeral)
+# image while the packages sit in the (permanent) volume. Without help, a new
+# container would find manifest ≠ volume and try to re-sync Mathlib from
+# GitHub at every session. So the first start saves the manifest it resolved
+# into the volume, and every later start puts that saved copy over the
+# image's — manifest and packages always tell the same story.
 set -eu
 
 PROJECT=/opt/lean4web/Projects/MathlibDemo
+MANIFEST="$PROJECT/lake-manifest.json"
+SAVED_MANIFEST="$PROJECT/.lake/mathew-lake-manifest.json"
+
+if [ -f "$SAVED_MANIFEST" ]; then
+  cp "$SAVED_MANIFEST" "$MANIFEST"
+fi
 
 if [ ! -f "$PROJECT/.lake/build/lib/lean/MathlibDemo.olean" ]; then
   echo "[mathew-lean] $PROJECT/.lake holds no built Mathlib — fetching it once (expect ~10 minutes)"
-  cd "$PROJECT"
   # lake update pulls the sources pinned in lake-manifest.json, and Mathlib's
   # post-update hook fetches the matching precompiled cache; lake build then
   # only writes the project's own module. The image's pinned toolchain
   # (elan) stays as it is — no lean-toolchain re-curl, no surprise downloads.
-  lake update -R
-  lake build
+  # (subshell: its cd must not leak into the server's working directory)
+  ( cd "$PROJECT" && lake update -R && lake build )
+  cp "$MANIFEST" "$SAVED_MANIFEST"
   echo "[mathew-lean] Mathlib ready"
 fi