containers/libreportal/docker-compose.yml

@@ -21,10 +21,8 @@ services:
       - ./backend/utils:/app/backend/utils
       - ./backend/server.js:/app/backend/server.js
       - ./libreportal.config:/app/libreportal.config:ro
-      # Absolute (filled at generation) — the containers root is now separate from
+      - ../../configs/webui/webui_logins:/app/webui_logins:ro
-      # the system tree, so the old relative ../../configs no longer reaches it.
+      - ../../configs/webui/webui_logs:/app/webui_logs:ro
-      - CONFIGS_DIR_DATA/webui/webui_logins:/app/webui_logins:ro #LIBREPORTAL|CONFIGS_DIR_TAG|CONFIGS_DIR_DATA
-      - CONFIGS_DIR_DATA/webui/webui_logs:/app/webui_logs:ro #LIBREPORTAL|CONFIGS_DIR_TAG|CONFIGS_DIR_DATA
       # >>> crowdsec-host-logs >>>
       #- /var/log/crowdsec.log:/host/var/log/crowdsec.log:ro
       #- /var/log/crowdsec-firewall-bouncer.log:/host/var/log/crowdsec-firewall-bouncer.log:ro

init.sh

@@ -220,7 +220,7 @@ if [[ "${BASH_SOURCE[0]}" == "$0" && "$param1" != "uninstall" && -z "$param7" ]]
     # downgrade an existing git install to local (that disables the updater
     # and blanks the saved creds). Honor a git URL already saved from a
     # prior install — only fall back to local when there's no git history.
-    saved_git_url=$(grep -E '^CFG_GIT_URL=' "${configs_dir}general/general_install" 2>/dev/null \
+    saved_git_url=$(grep -E '^CFG_GIT_URL=' /docker/configs/general/general_install 2>/dev/null \
                     | sed -E 's/^[^=]+=([^[:space:]#]*).*/\1/')
     if [[ -n "$param3" || -n "$param4" || -n "$param5" ]]; then
         # Git parameters provided, set to git mode
@@ -845,15 +845,7 @@ initRootHelpers()
 			continue
 		fi
 		helper_tmp=$(mktemp)
-		# Bake the manager name + the three relocatable roots into the installed
+		sed "s/__MANAGER__/${sudo_user_name}/g" "$helper_src" > "$helper_tmp"
-		# (root-owned, manager-immutable) helper. This is the trust boundary: the
-		# helpers operate on FIXED paths chosen at install by root, never read from
-		# manager-writable config. '#' delimiter since the values are paths.
-		sed -e "s/__MANAGER__/${sudo_user_name}/g" \
-		    -e "s#__SYSTEM_DIR__#${LP_SYSTEM_DIR}#g" \
-		    -e "s#__CONTAINERS_DIR__#${LP_CONTAINERS_DIR}#g" \
-		    -e "s#__BACKUPS_DIR__#${LP_BACKUPS_DIR}#g" \
-		    "$helper_src" > "$helper_tmp"
 		if bash -n "$helper_tmp" 2>/dev/null; then
 			sudo install -m 0755 -o root -g root "$helper_tmp" "$helper_dst"
 			isSuccessful "Installed root-owned helper ($helper)."
@@ -908,24 +900,20 @@ initContainerLayer()
 		isSuccessful "Created container user '$duser'."
 	fi
 
-	# The system root is manager-owned and initFolders makes it 750; give it the
+	# /docker is manager-owned and initFolders makes it 750; give it the rootless
-	# rootless traversal bit (o+x → 751) so the container user can reach the few
+	# traversal bit (o+x → 751, its documented rootless mode) so the container
-	# bind-mount sources it must read there (configs/webui/*). The container + backup
+	# user can traverse INTO /docker to reach its containers/ dir. Without this
-	# roots are SEPARATE roots now, so the container user no longer traverses the
+	# the boot scan can't enter /docker at all, no matter who owns containers/.
-	# system tree to reach its own data.
 	[[ -d "$docker_dir" ]] && sudo chmod o+x "$docker_dir"
 
-	# Hand the container + backup roots to the container user — it owns per-app data
+	# Hand containers/ to the container user (it owns per-app data in rootless) so
-	# in rootless, and restic (which runs AS that user) writes the backup repos.
+	# the manager-run startup config scans can read it. 751: owner full; the
-	# 751: owner full; the manager (other) can traverse in to known paths.
+	# manager (other) can traverse in to known paths (it lists/writes via runFileOp).
-	local d
+	if [[ -d "$containers_dir" ]]; then
-	for d in "$containers_dir" "$backup_dir"; do
+		sudo chown "$duser:$duser" "$containers_dir"
-		if [[ -d "$d" ]]; then
+		sudo chmod 751 "$containers_dir"
-			sudo chown "$duser:$duser" "$d"
+		isSuccessful "containers/ handed to '$duser' (+ /docker traversable)."
-			sudo chmod 751 "$d"
 	fi
-	done
-	isSuccessful "containers/ + backups/ handed to '$duser' (system root traversable)."
 }
 
 setupConfigsFromRepo()
@@ -933,7 +921,7 @@ setupConfigsFromRepo()
     isNotice "Setting up configuration files from repository..."
 
     local src="$script_dir/configs"
-    local dst="${configs_dir%/}"
+    local dst="/docker/configs"
 
     if [[ ! -d "$src" ]]; then
         isError "Source configs directory missing: $src"
@@ -1346,7 +1334,7 @@ initUpdateConfigs()
     initUpdateConfigOption "CFG_INSTALL_MODE"         "$param7" && isSuccessful "Updated Installation Mode"
 
     isHeader "Verifying Saved Configuration"
-    local cfg_file="${configs_dir}general/general_install"
+    local cfg_file="/docker/configs/general/general_install"
     if [[ ! -f "$cfg_file" ]]; then
         isError "Expected $cfg_file is missing — install cannot proceed."
         exit 1
@@ -1414,7 +1402,7 @@ runFullUninstall()
 {
 	local mgr="${sudo_user_name:-libreportal}"
 	local iuser
-	iuser=$(grep -h '^CFG_DOCKER_INSTALL_USER=' "${configs_dir}general/general_docker_install" 2>/dev/null | head -1 | cut -d= -f2 | awk '{print $1}')
+	iuser=$(grep -h '^CFG_DOCKER_INSTALL_USER=' /docker/configs/general/general_docker_install 2>/dev/null | head -1 | cut -d= -f2 | awk '{print $1}')
 	iuser="${iuser:-dockerinstall}"
 
 	# --skip-docker-images: keep the rootless docker layer (the daemon, the
@@ -1427,9 +1415,7 @@ runFullUninstall()
 	isHeader "LibrePortal — FULL Uninstall"
 	isError "This PERMANENTLY removes EVERYTHING — there is no undo:"
 	echo "    - all containers + images + the rootless docker setup"
-	echo "    - $docker_dir  (system: configs, database, install)"
+	echo "    - /docker  (ALL app data, configs, database)"
-	echo "    - $containers_dir  (live app data)"
-	echo "    - $backup_dir  (backup repos)"
 	echo "    - the '$mgr' and '$iuser' users + their home directories"
 	echo "    - /usr/local/lib/libreportal/ + the /usr/local/bin/libreportal command"
 	echo "    - /etc/sudoers.d/$mgr, the systemd service, the sysctl drop-ins"
@@ -1498,11 +1484,9 @@ runFullUninstall()
 	rm -f /root/init.sh
 	isSuccessful "Removed the system-integration footprint"
 
-	# 4. Remove all app data — the three roots (on a legacy single-tree install the
+	# 4. Remove all app data.
-	#    container/backup roots are subdirs of the system root, so this is safe and
+	rm -rf /docker
-	#    idempotent either way).
+	isSuccessful "Removed /docker"
-	rm -rf "$docker_dir" "$containers_dir" "$backup_dir"
-	isSuccessful "Removed $docker_dir, $containers_dir, $backup_dir"
 
 	# 5. Remove the LibrePortal users + their subuid/subgid ranges + home dirs.
 	#    Terminate each user's session/linger and kill its processes first, or

scripts/config/tags/processors/tags_processor_standard_replacements.sh

@@ -24,9 +24,6 @@ tagsProcessorStandardReplacements()
     # Host live-app-data root, passed into the WebUI container (only the
     # libreportal compose carries this tag; "only update tags that exist").
     tagsManagerUpdateUniversalTag "$full_file_path" "CONTAINERS_DIR_TAG" "${containers_dir%/}"
-    # Host system-tree configs root — absolute bind-mount source for the WebUI's
-    # configs/webui/* (the containers root is separate from the system tree now).
-    tagsManagerUpdateUniversalTag "$full_file_path" "CONFIGS_DIR_TAG" "${configs_dir%/}"
 
     isSuccessful "Standard LibrePortal tag replacements applied using universal tag manager"
 }

scripts/system/libreportal-appcfg

@@ -10,12 +10,8 @@ set -u
 
 [[ $EUID -eq 0 ]] || { echo "libreportal-appcfg: must run as root" >&2; exit 1; }
 
-# Baked at install; unbaked copies keep the "__" sentinel.
+CONTAINERS_DIR="/docker/containers"
-SYSTEM_DIR="__SYSTEM_DIR__"
+DB_CFG="/docker/configs/general/general_docker_install"
-CONTAINERS_DIR="__CONTAINERS_DIR__"
-[[ "$SYSTEM_DIR"     == *"__"* || -z "$SYSTEM_DIR"     ]] && SYSTEM_DIR="/libreportal-system"
-[[ "$CONTAINERS_DIR" == *"__"* || -z "$CONTAINERS_DIR" ]] && CONTAINERS_DIR="/libreportal-containers"
-DB_CFG="$SYSTEM_DIR/configs/general/general_docker_install"
 
 _install_user() {
     local u

scripts/system/libreportal-ownership

@@ -4,70 +4,50 @@
 #
 # Why this exists: under Model A the runtime executes AS the manager (libreportal),
 # so establishing the ownership model (manager owns the control plane, the docker
-# install user owns the containers + backups) needs root. Granting the manager a
+# install user owns the containers) needs root. Granting the manager a blanket
-# blanket `sudo chown`/`sudo chmod` would be root-equivalent (chown /etc/sudoers,
+# `sudo chown`/`sudo chmod` in the scoped sudoers would be root-equivalent (chown
-# etc.). Instead this script — installed root:root 0755 to /usr/local/lib/libreportal/
+# /etc/sudoers, etc.). Instead this script — installed root:root 0755 to
-# by init.sh, so the manager cannot modify it — performs a FIXED set of reconciles
+# /usr/local/sbin by init.sh, so the manager cannot modify it — performs a FIXED
-# on FIXED LibrePortal paths only. The roots and the manager name are BAKED at
+# set of reconciles on FIXED LibrePortal paths only. Owners are derived from
-# install (sed placeholders), never read at runtime from a manager-writable config;
+# config + the baked manager name, never from the caller; the single free argument
-# the single free argument (an app name / relpath) is strictly validated.
+# (an app name) is strictly validated and must resolve to an existing dir under
+# /docker/containers.
 #
-# Layout — three independently-relocatable roots, each owned by ONE principal:
+# Self-contained ON PURPOSE: it must NOT source any manager-owned code, or it
-#   SYSTEM_DIR     manager-owned control plane (configs/logs/install/db/ssl/ssh/…)
+# would re-open the very escalation it exists to close. init.sh is the source of
-#   CONTAINERS_DIR container-user-owned live app data (apps live directly under it)
+# truth for the install; it bakes the manager name into the installed copy.
-#   BACKUPS_DIR    container-user-owned backup repos (own mount-able)
-#
-# Self-contained ON PURPOSE: it must NOT source any manager-owned code (incl.
-# paths.sh), or it would re-open the very escalation it exists to close. init.sh is
-# the source of truth for the install; it bakes the values into the installed copy.
 
 set -u
 
 [[ $EUID -eq 0 ]] || { echo "libreportal-ownership: must run as root" >&2; exit 1; }
 
-# Baked by init.sh at install (placeholders replaced). An unbaked copy (run
+# Baked by init.sh at install (placeholder replaced); default if run unbaked.
-# directly from the repo before baking) still contains the "__" sentinel, which no
-# real absolute path does — fall back to the defaults in that case only.
 MANAGER="__MANAGER__"
-CONTAINERS_DIR="__CONTAINERS_DIR__"
+[[ "$MANAGER" == "__MANAGER__" || -z "$MANAGER" ]] && MANAGER="libreportal"
-BACKUPS_DIR="__BACKUPS_DIR__"
-SYSTEM_DIR="__SYSTEM_DIR__"
-[[ "$MANAGER"        == *"__"* || -z "$MANAGER"        ]] && MANAGER="libreportal"
-[[ "$SYSTEM_DIR"     == *"__"* || -z "$SYSTEM_DIR"     ]] && SYSTEM_DIR="/libreportal-system"
-[[ "$CONTAINERS_DIR" == *"__"* || -z "$CONTAINERS_DIR" ]] && CONTAINERS_DIR="/libreportal-containers"
-[[ "$BACKUPS_DIR"    == *"__"* || -z "$BACKUPS_DIR"    ]] && BACKUPS_DIR="/libreportal-backups"
 
-# Refuse to operate on dangerous roots even if mis-baked (defence in depth).
+DOCKER_DIR="/docker"
-for _d in "$SYSTEM_DIR" "$CONTAINERS_DIR" "$BACKUPS_DIR"; do
+CONFIGS_DIR="$DOCKER_DIR/configs"
-    case "$_d" in
+LOGS_DIR="$DOCKER_DIR/logs"
-        /|/etc|/usr|/bin|/sbin|/lib|/lib64|/boot|/proc|/sys|/dev|/run|/home|/root|/var|/tmp)
+INSTALL_DIR="$DOCKER_DIR/install"
-            echo "libreportal-ownership: refusing dangerous root '$_d'" >&2; exit 1 ;;
+CONTAINERS_DIR="$DOCKER_DIR/containers"
-        /*) ;;  # absolute — ok
+SSL_DIR="$DOCKER_DIR/ssl"
-        *)  echo "libreportal-ownership: root must be absolute: '$_d'" >&2; exit 1 ;;
+SSH_DIR="$DOCKER_DIR/ssh"
-    esac
+BACKUP_DIR="$DOCKER_DIR/backups"
-done
+RESTORE_DIR="$DOCKER_DIR/restore"
-
+MIGRATE_DIR="$DOCKER_DIR/migrate"
-CONFIGS_DIR="$SYSTEM_DIR/configs"
+DB_PATH="$DOCKER_DIR/database.db"
-LOGS_DIR="$SYSTEM_DIR/logs"
-INSTALL_DIR="$SYSTEM_DIR/install"
-SSL_DIR="$SYSTEM_DIR/ssl"
-SSH_DIR="$SYSTEM_DIR/ssh"
-RESTORE_DIR="$SYSTEM_DIR/restore"
-MIGRATE_DIR="$SYSTEM_DIR/migrate"
-DB_PATH="$SYSTEM_DIR/database.db"
 WEBUI_DIR="$CONTAINERS_DIR/libreportal"
 TASK_DIR="$WEBUI_DIR/frontend/data/tasks"
 DB_CFG="$CONFIGS_DIR/general/general_docker_install"
 
-# Current docker mode, read authoritatively from config (read-only — informs the
+# Current docker mode, read authoritatively from config.
-# container OWNER choice, not any path).
 _mode() {
     local m
     m=$(grep -h '^CFG_DOCKER_INSTALL_TYPE=' "$DB_CFG" 2>/dev/null | head -1 | cut -d= -f2 | awk '{print $1}')
     echo "${m:-rootless}"
 }
 
-# Who owns container/backup data for a mode: rooted -> the manager; rootless -> the
+# Who owns container data for a mode: rooted -> the manager; rootless -> the
 # configured docker install user (must be a real account, else fall back).
 _container_owner() {
     local mode="$1" appusr=""
@@ -92,61 +72,38 @@ _app_dir() {
     printf '%s' "$d"
 }
 
-# Let the rootless container user reach the few system-tree files it must read as
+# Control plane -> manager; structural container dirs -> container owner. Owner
-# bind-mount sources (the WebUI's configs/webui/*), WITHOUT exposing the rest of
+# only, never reset mode bits; only ADD o+x (traversal) and o+r (DB read).
-# the control plane: traverse SYSTEM_DIR + configs, read configs/webui only.
-_webui_bind_access() {
-    chmod o+x "$SYSTEM_DIR" 2>/dev/null
-    [[ -d "$CONFIGS_DIR" ]] && chmod o+x "$CONFIGS_DIR" 2>/dev/null
-    if [[ -d "$CONFIGS_DIR/webui" ]]; then
-        chmod o+rx "$CONFIGS_DIR/webui" 2>/dev/null
-        find "$CONFIGS_DIR/webui" -maxdepth 1 -type f -exec chmod o+r {} \; 2>/dev/null
-    fi
-}
-
-# Control plane -> manager; container + backup roots -> container owner.
 reconcile() {
     local mode="${1:-$(_mode)}"
-    local cowner; cowner="$(_container_owner "$mode")"
+    [[ -d "$DOCKER_DIR" ]] || return 0
-
+    chown "$MANAGER:$MANAGER" "$DOCKER_DIR"
-    if [[ -d "$SYSTEM_DIR" ]]; then
+    chmod o+x "$DOCKER_DIR"
-        chown "$MANAGER:$MANAGER" "$SYSTEM_DIR"
     local p
-        for p in "$CONFIGS_DIR" "$LOGS_DIR" "$INSTALL_DIR" "$SSL_DIR" "$SSH_DIR" \
+    for p in "$CONFIGS_DIR" "$LOGS_DIR" "$INSTALL_DIR" "$DB_PATH"; do
-                 "$RESTORE_DIR" "$MIGRATE_DIR" "$DB_PATH"; do
         [[ -e "$p" ]] && chown -R "$MANAGER:$MANAGER" "$p"
     done
     [[ -f "$DB_PATH" ]] && chmod o+r "$DB_PATH"
-        _webui_bind_access
+    local cowner; cowner="$(_container_owner "$mode")"
+    if [[ -d "$CONTAINERS_DIR" ]]; then
+        chown "$cowner:$cowner" "$CONTAINERS_DIR"
+        chmod o+x "$CONTAINERS_DIR"
     fi
-
-    # Data + backups: wholly the container owner's (rootless requires it; this is
-    # also what lets restic — which runs AS that user — write the backup repos).
-    local d
-    for d in "$CONTAINERS_DIR" "$BACKUPS_DIR"; do
-        if [[ -d "$d" ]]; then
-            chown "$cowner:$cowner" "$d"
-            chmod o+x "$d"
-        fi
-    done
     [[ -d "$WEBUI_DIR" ]] && chown -R "$cowner:$cowner" "$WEBUI_DIR"
 }
 
 # Traversal (+x) bits only, on the structural LibrePortal dirs.
 traversal() {
-    [[ -d "$SYSTEM_DIR" ]] && chmod o+x "$SYSTEM_DIR"
+    [[ -d "$DOCKER_DIR" ]] && chmod +x "$DOCKER_DIR"
     local d
-    for d in "$INSTALL_DIR" "$SSL_DIR" "$SSH_DIR" "$RESTORE_DIR" "$MIGRATE_DIR"; do
+    for d in "$INSTALL_DIR" "$SSL_DIR" "$SSH_DIR" "$BACKUP_DIR" "$RESTORE_DIR" "$MIGRATE_DIR"; do
         [[ -d "$d" ]] && find "$d" -maxdepth 2 -type d -exec chmod +x {} \;
     done
-    _webui_bind_access
     local mode cowner; mode="$(_mode)"; cowner="$(_container_owner "$mode")"
-    for d in "$CONTAINERS_DIR" "$BACKUPS_DIR"; do
+    if [[ -d "$CONTAINERS_DIR" ]]; then
-        if [[ -d "$d" ]]; then
+        chown "$cowner:$cowner" "$CONTAINERS_DIR"
-            chown "$cowner:$cowner" "$d"
+        chmod o+x "$CONTAINERS_DIR"
-            chmod o+x "$d"
     fi
-    done
 }
 
 # Per-app structural perms + ownership of the LibrePortal-managed files only.
@@ -174,7 +131,7 @@ webui() {
 }
 
 # Ensure the apps DB is manager-owned + world-readable (reclaims a stray
-# root/other-owned DB; the WebUI reads it).
+# root/other-owned DB; the WebUI container reads it).
 db_own() {
     [[ -f "$DB_PATH" ]] || return 0
     chown "$MANAGER:$MANAGER" "$DB_PATH"
@@ -190,15 +147,6 @@ containers_top() {
     fi
 }
 
-# The backups root -> container owner + traversable (restic runs AS that user).
-backups_top() {
-    local mode cowner; mode="$(_mode)"; cowner="$(_container_owner "$mode")"
-    if [[ -d "$BACKUPS_DIR" ]]; then
-        chown "$cowner:$cowner" "$BACKUPS_DIR"
-        chmod o+x "$BACKUPS_DIR"
-    fi
-}
-
 # The task IPC dir -> container owner (reclaims stale manager/root-owned files).
 taskdir() {
     local mode cowner; mode="$(_mode)"; cowner="$(_container_owner "$mode")"
@@ -211,7 +159,8 @@ app_data_nobody() {
     [[ -d "$d/data" ]] && chown -R 65534:65534 "$d/data"
 }
 
-# Chown one LibrePortal-managed file under an app dir to the container owner.
+# Chown one LibrePortal-managed file under an app dir to the container owner
+# (e.g. traefik acme.json / traefik.yml the container creates as another uid).
 # relpath is validated: no traversal, no absolute path, safe charset only.
 app_file() {
     local d rel mode cowner
@@ -228,12 +177,11 @@ case "$action" in
     reconcile)        reconcile "${1:-}";;
     traversal)        traversal;;
     containers-top)   containers_top;;
-    backups-top)      backups_top;;
     db-own)           db_own;;
     app-perms)        app_perms;;
     webui)            webui;;
     taskdir)          taskdir;;
     app-data-nobody)  app_data_nobody "${1:-}";;
     app-file)         app_file "${1:-}" "${2:-}";;
-    *) echo "usage: libreportal-ownership {reconcile [mode]|traversal|containers-top|backups-top|db-own|app-perms|webui|taskdir|app-data-nobody <app>|app-file <app> <relpath>}" >&2; exit 2;;
+    *) echo "usage: libreportal-ownership {reconcile [mode]|traversal|containers-top|db-own|app-perms|webui|taskdir|app-data-nobody <app>|app-file <app> <relpath>}" >&2; exit 2;;
 esac

scripts/system/libreportal-socket

@@ -11,10 +11,7 @@ set -u
 
 [[ $EUID -eq 0 ]] || { echo "libreportal-socket: must run as root" >&2; exit 1; }
 
-# SYSTEM_DIR baked at install; unbaked copies keep the "__" sentinel.
+DB_CFG="/docker/configs/general/general_docker_install"
-SYSTEM_DIR="__SYSTEM_DIR__"
-[[ "$SYSTEM_DIR" == *"__"* || -z "$SYSTEM_DIR" ]] && SYSTEM_DIR="/libreportal-system"
-DB_CFG="$SYSTEM_DIR/configs/general/general_docker_install"
 ROOTED_SOCK="/var/run/docker.sock"
 
 _rootless_sock() {

scripts/system/libreportal-svc

@@ -14,21 +14,13 @@ set -u
 
 [[ $EUID -eq 0 ]] || { echo "libreportal-svc: must run as root" >&2; exit 1; }
 
-# Baked at install (placeholders replaced). Unbaked copies still contain the "__"
-# sentinel, which no real absolute path does — fall back to defaults then.
 MANAGER="__MANAGER__"
-SYSTEM_DIR="__SYSTEM_DIR__"
+[[ "$MANAGER" == "__MANAGER__" || -z "$MANAGER" ]] && MANAGER="libreportal"
-CONTAINERS_DIR="__CONTAINERS_DIR__"
-BACKUPS_DIR="__BACKUPS_DIR__"
-[[ "$MANAGER"        == *"__"* || -z "$MANAGER"        ]] && MANAGER="libreportal"
-[[ "$SYSTEM_DIR"     == *"__"* || -z "$SYSTEM_DIR"     ]] && SYSTEM_DIR="/libreportal-system"
-[[ "$CONTAINERS_DIR" == *"__"* || -z "$CONTAINERS_DIR" ]] && CONTAINERS_DIR="/libreportal-containers"
-[[ "$BACKUPS_DIR"    == *"__"* || -z "$BACKUPS_DIR"    ]] && BACKUPS_DIR="/libreportal-backups"
 
 SERVICE_FILE="/etc/systemd/system/libreportal.service"
-INSTALL_SCRIPTS_DIR="$SYSTEM_DIR/install/scripts"
+INSTALL_SCRIPTS_DIR="/docker/install/scripts"
 TASK_PROCESSOR="$INSTALL_SCRIPTS_DIR/crontab/task/crontab_task_processor.sh"
-DB_CFG="$SYSTEM_DIR/configs/general/general_docker_install"
+DB_CFG="/docker/configs/general/general_docker_install"
 
 _mode() {
     local m
@@ -58,11 +50,6 @@ Type=simple
 User=$MANAGER
 Group=$MANAGER
 WorkingDirectory=$INSTALL_SCRIPTS_DIR
-# Relocatable path roots — baked here by root so the processor resolves them
-# authoritatively (not via the legacy compat default in paths.sh).
-Environment=LP_SYSTEM_DIR=$SYSTEM_DIR
-Environment=LP_CONTAINERS_DIR=$CONTAINERS_DIR
-Environment=LP_BACKUPS_DIR=$BACKUPS_DIR
 ExecStart=$TASK_PROCESSOR start_script
 Restart=always
 RestartSec=5