How to Run PocketBase in a Sandbox With a Private HTTPS URL

sbx new --name pocketbase --type small --no-env
id=sb_v6tllk1ul8    # the id that sbx new printed; its subdomain was early-stormy-puffin

sbx exec $id --timeout 600 "mkdir -p ~/pb && cd ~/pb \
  && curl -fsSLo pb.zip https://github.com/pocketbase/pocketbase/releases/download/v0.40.6/pocketbase_0.40.6_linux_amd64.zip \
  && python3 -m zipfile -e pb.zip . && chmod +x pocketbase && rm pb.zip && ./pocketbase --version"

pocketbase version 0.40.6

sbx exec $id "cd ~/pb && ./pocketbase superuser upsert admin@example.com '<password>'"

Successfully saved superuser "admin@example.com"!

# pocketbase.service
[Unit]
Description = pocketbase

[Service]
Type             = simple
User             = user
Group            = user
LimitNOFILE      = 4096
Restart          = always
RestartSec       = 5s
StandardOutput   = append:/home/user/pb/std.log
StandardError    = append:/home/user/pb/std.log
WorkingDirectory = /home/user/pb
ExecStart        = /home/user/pb/pocketbase serve --http=0.0.0.0:8090

[Install]
WantedBy = multi-user.target

sbx scp pocketbase.service $id:/home/user/pb/
sbx exec $id "sudo cp ~/pb/pocketbase.service /etc/systemd/system/ && sudo systemctl daemon-reload && sudo systemctl enable --now pocketbase \
  && until curl -fs localhost:8090/api/health >/dev/null; do sleep 0.05; done; curl -s localhost:8090/api/health; ps -o pid,rss,cmd -C pocketbase"

Created symlink /etc/systemd/system/multi-user.target.wants/pocketbase.service → /etc/systemd/system/pocketbase.service.
{"message":"API is healthy.","code":200,"data":{}}
    PID   RSS CMD
    657 27956 /home/user/pb/pocketbase serve --http=0.0.0.0:8090

sbx host $id 8090 --title PocketBase

{"ok":true,"type":"port.hosted","sandboxId":"sb_v6tllk1ul8","port":8090,"url":"https://early-stormy-puffin-8090.box.sandboxer.com?_token=<token>","access":"private",…}

B=https://early-stormy-puffin-8090.box.sandboxer.com
curl -s -o /dev/null -c jar "$B/?_token=<token>"          # trade the token for the cookie once

curl -s -b jar -H 'Content-Type: application/json' \
  -d '{"identity":"admin@example.com","password":"<password>"}' \
  $B/api/collections/_superusers/auth-with-password > auth.json
PB=$(python3 -c "import json; print(json.load(open('auth.json'))['token'])")

{"name":"notes","type":"base","fields":[{"name":"text","type":"text","required":true}],
 "listRule":"","viewRule":"","createRule":"","updateRule":null,"deleteRule":null}

curl -s -b jar -H "Authorization: $PB" -H 'Content-Type: application/json' -d @notes.json $B/api/collections
curl -s -b jar -H 'Content-Type: application/json' -d '{"text":"hello from my laptop"}' $B/api/collections/notes/records
curl -s -b jar "$B/api/collections/notes/records?fields=id,text"

{"id":"pbc_3395098727","listRule":"","viewRule":"","createRule":"",…,"name":"notes","type":"base",…}
{"collectionId":"pbc_3395098727","collectionName":"notes","id":"doqgofal7a1xky6","text":"hello from my laptop"}
{"items":[{"id":"doqgofal7a1xky6","text":"hello from my laptop"}],"page":1,"perPage":30,"totalItems":1,"totalPages":1}

{"data":{},"message":"The request requires valid record authorization token.","status":401}