2026-08-05 18:04:34 +02:00
2 changed files with 10 additions and 3 deletions
@@ -32,11 +32,13 @@ docker compose up -d        # http://localhost:3000, live-reloads on source chan

 ```bash
 cp -r examples/plugins/admin plugins/admin
-docker compose restart web
+docker compose up -d
 ```

 The bootstrap grants the seeded admin every permission the installed plugins declare, so the
-**Admin** section now shows in the menu.
+**Admin** section now shows in the menu. Use `up -d`, not `restart web`: the seed runs in the
+one-shot `bootstrap` service, and only `up` re-runs it to pick up the new plugin's permissions
+(it is idempotent, so re-running costs nothing).
 See [`examples/plugins/admin/`](examples/plugins/admin/).

 **4. Add your first plugin.** The clone is bind-mounted into the container, so a new
@@ -60,7 +62,8 @@ docker compose restart web

 Visit <http://localhost:3000/hello> — the page is mounted at `/hello` (the folder name
 is the plugin id *and* the mount path) and "Hello" is in the menu. That's the whole loop:
-**drop a folder in `plugins/`, restart, it's live.**
+**drop a folder in `plugins/`, restart, it's live.** A plugin that declares `permissions` needs
+`docker compose up -d` instead, so the seed re-runs and grants them (as in step 3).

 From here, render real pages against the app shell and fetch upstream data — see
 [Building plugins](#building-plugins) and the runnable reference in
@@ -139,6 +139,10 @@ services:
      KRATOS_ADMIN_URL: http://kratos:4434
    volumes:
      - ./ory/kratos/tokenizer:/etc/config/kratos/tokenizer
+      # The seed grants what the installed plugins declare, so bootstrap must see the same plugins/
+      # as web. Without this it discovers only the image's (empty) copy and the demo admin is seeded
+      # with nothing — a drop-in plugin's screens then 403 with nothing logged.
+      - ./plugins:/app/plugins:ro
    command: node src/auth/bootstrap.ts
    # Bounded retry: the seed is idempotent, so transient Ory blips recover — but a permanent
    # error must give up, not loop forever and hang `web` (gates on completion).