nessi
dfec7976c4
Add ALLOWED_HOSTS configuration to restrict trusted hosts in TrustedHostMiddleware. Enhance SSRF protection to block all private, loopback, link-local, multicast, reserved, and unspecified IP addresses using ipaddress module and DNS resolution checks. Add encrypt_value/decrypt_value aliases for encryption functions. Upgrade PostgreSQL from 16 to 18.4 in Docker Compose with updated data directory path (/var/lib/postgresql). Add security_opt no
133 lines
3.1 KiB
YAML
133 lines
3.1 KiB
YAML
name: nexadash
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:18.4-alpine
|
|
container_name: nexadash-postgres
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:?Set POSTGRES_USER in .env}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
|
|
POSTGRES_DB: ${POSTGRES_DB:?Set POSTGRES_DB in .env}
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\""]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
networks:
|
|
- nexadash
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
container_name: nexadash-redis
|
|
restart: unless-stopped
|
|
command: ["sh", "-c", "redis-server --requirepass \"$${REDIS_PASSWORD}\""]
|
|
environment:
|
|
REDIS_PASSWORD: ${REDIS_PASSWORD:?Set REDIS_PASSWORD in .env}
|
|
volumes:
|
|
- redis_data:/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "REDISCLI_AUTH=\"$${REDIS_PASSWORD}\" redis-cli ping"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
networks:
|
|
- nexadash
|
|
|
|
api:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/api.Dockerfile
|
|
container_name: nexadash-api
|
|
restart: unless-stopped
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
DATABASE_URL: ${DATABASE_URL}
|
|
REDIS_URL: ${REDIS_URL}
|
|
CELERY_BROKER_URL: ${CELERY_BROKER_URL}
|
|
CELERY_RESULT_BACKEND: ${CELERY_RESULT_BACKEND}
|
|
volumes:
|
|
- plugin_data:/app/plugins
|
|
ports:
|
|
- "${API_PORT:-8000}:8000"
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
networks:
|
|
- nexadash
|
|
|
|
worker:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/worker.Dockerfile
|
|
container_name: nexadash-worker
|
|
restart: unless-stopped
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
DATABASE_URL: ${DATABASE_URL}
|
|
REDIS_URL: ${REDIS_URL}
|
|
CELERY_BROKER_URL: ${CELERY_BROKER_URL}
|
|
CELERY_RESULT_BACKEND: ${CELERY_RESULT_BACKEND}
|
|
volumes:
|
|
- plugin_data:/app/plugins
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
networks:
|
|
- nexadash
|
|
|
|
web:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/web.Dockerfile
|
|
container_name: nexadash-web
|
|
restart: unless-stopped
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
NEXT_PUBLIC_API_URL: ${NEXADASH_API_URL:-http://localhost:8000}
|
|
ports:
|
|
- "${WEB_PORT:-3000}:3000"
|
|
healthcheck:
|
|
test: ["CMD", "node", "healthcheck.js"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
networks:
|
|
- nexadash
|
|
|
|
volumes:
|
|
postgres_data:
|
|
redis_data:
|
|
plugin_data:
|
|
|
|
networks:
|
|
nexadash:
|
|
driver: bridge
|