feat: full rootless setup (#165)

* use local devtools configs instead of global ones

* make docker image rootless

* add migration notes

* fix setup command

* fix regress jo

recipes/oauth/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -9,9 +26,9 @@ services:
       AHRIMAN_OAUTH_CLIENT_SECRET: ${AHRIMAN_OAUTH_CLIENT_SECRET}
       AHRIMAN_OUTPUT: console
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: sudo -u ahriman ahriman user-add ${AHRIMAN_OAUTH_USER} -R full -p ""
+      AHRIMAN_POSTSETUP_COMMAND: ahriman user-add ${AHRIMAN_OAUTH_USER} -R full -p ""
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -21,8 +38,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -36,6 +55,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf