09186e23b9
Some checks failed
Backend Tests / pytest (Python 3.12) (push) Has been cancelled
Deploy to Production / backend-tests (push) Has been cancelled
Deploy to Production / frontend-build (push) Has been cancelled
Frontend Checks / Build & typecheck (push) Has been cancelled
SonarCloud / SonarCloud Analysis (push) Has been cancelled
Deploy to Production / Trigger production update (push) Has been cancelled
Security - Enforce guest ownership and server assignment across Proxmox endpoints (VM/LXC actions, firewall, backups, tasks, bulk operations, deploy, LXC/ISO creation, golden template) and WebSocket channels - Keep the panel's PVE root ticket server-side for consoles; single-use WebSocket tickets instead of the JWT in URLs; re-check access on open WebSocket bridges - Validate identifiers that reach Proxmox API paths and node shell commands; reject backup archives / foreign volumes in create requests - Close privilege escalation in user management, TOTP replay, reset-link poisoning, X-Forwarded-For spoofing, stored XSS (group icons, SVG logos) - SSH host key pinning (TOFU), encrypted 2FA seeds and notification secrets, password changes end other sessions, redact secrets in logs - Quotas count in-flight creations; 2FA failures count toward lockout Fixes - Consoles on non-default API ports, large App Store/script files, interrupted tasks after restart, impersonation lost on token refresh, HTTPExceptions swallowed into 500s, WebSocket client reconnects Performance and process - Fewer DB writes and queries on hot paths, lazy-loaded locales and heavy pages, off-loop blocking work, indexes (migrations 44-46) - Deploy waits for backend tests and frontend build; frontend checks workflow; API bound to loopback without the SSL profile
123 lines
3.6 KiB
YAML
123 lines
3.6 KiB
YAML
services:
|
|
db:
|
|
image: postgres:16-alpine
|
|
container_name: pvemanager-db
|
|
environment:
|
|
POSTGRES_DB: pvemanager
|
|
POSTGRES_USER: pvemanager
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required — run deploy.sh or bootstrap.sh to generate .env}
|
|
TZ: ${TZ:-Asia/Tashkent}
|
|
# Оптимизация для быстрого старта
|
|
POSTGRES_INITDB_ARGS: "--no-sync"
|
|
volumes:
|
|
- db_data:/var/lib/postgresql/data
|
|
- ./init.sql:/docker-entrypoint-initdb.d/init.sql:ro
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U pvemanager -d pvemanager"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 5s
|
|
networks:
|
|
- pvemanager-network
|
|
# Оптимизация производительности БД (>- склеит в одну строку через пробел)
|
|
command: >-
|
|
postgres
|
|
-c shared_buffers=256MB
|
|
-c max_connections=200
|
|
-c work_mem=4MB
|
|
-c maintenance_work_mem=64MB
|
|
-c effective_cache_size=512MB
|
|
-c checkpoint_completion_target=0.9
|
|
-c wal_buffers=16MB
|
|
-c random_page_cost=1.1
|
|
|
|
app:
|
|
build:
|
|
context: ./backend
|
|
dockerfile: Dockerfile
|
|
image: pvemanager-app:latest
|
|
pull_policy: build
|
|
container_name: pvemanager-app
|
|
ports:
|
|
# Loopback only: the UI reaches the API through the frontend's nginx on
|
|
# the compose network. Published on all interfaces, the API bypassed it,
|
|
# and a LAN client (a private peer) could set X-Forwarded-For freely.
|
|
- "127.0.0.1:8000:8000"
|
|
env_file:
|
|
- path: ./backend/.env
|
|
required: false
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
volumes:
|
|
- ~/.ssh:/root/.ssh:ro
|
|
- ./logs:/app/logs
|
|
- ./VERSION:/app/VERSION:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
# App Store: кэш логотипов/данных каталога (persist across rebuilds)
|
|
- appstore_data:/app/data
|
|
# For system updates
|
|
- .:/project:rw
|
|
restart: unless-stopped
|
|
environment:
|
|
- DATABASE_URL=postgresql://pvemanager:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@db:5432/pvemanager
|
|
- PYTHONPATH=/app
|
|
- TZ=${TZ:-Asia/Tashkent}
|
|
- PROJECT_ROOT=/project
|
|
# Отключить проверку обновлений для приватных репозиториев
|
|
- DISABLE_UPDATE_CHECK=${DISABLE_UPDATE_CHECK:-false}
|
|
# GitHub token для доступа к приватным репозиториям (опционально)
|
|
- GITHUB_TOKEN=${GITHUB_TOKEN:-}
|
|
# Оптимизация для production
|
|
- UVICORN_WORKERS=1
|
|
- UVICORN_TIMEOUT_KEEP_ALIVE=30
|
|
networks:
|
|
- pvemanager-network
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-fs", "http://localhost:8000/health"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 5
|
|
start_period: 120s
|
|
# Ограничение ресурсов для стабильности
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2'
|
|
memory: 512M
|
|
reservations:
|
|
cpus: '0.5'
|
|
memory: 256M
|
|
|
|
frontend:
|
|
build:
|
|
context: ./frontend
|
|
dockerfile: Dockerfile
|
|
image: pvemanager-frontend:latest
|
|
pull_policy: build
|
|
container_name: pvemanager-frontend
|
|
ports:
|
|
- "3001:80"
|
|
depends_on:
|
|
app:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
networks:
|
|
- pvemanager-network
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.5'
|
|
memory: 128M
|
|
|
|
volumes:
|
|
db_data:
|
|
logs:
|
|
appstore_data:
|
|
|
|
networks:
|
|
pvemanager-network:
|
|
driver: bridge
|