Шхуна не тонет: security, infra и доки на русском.

Безопасность довёл до ума — Cursor-генерацию переписал руками. IDOR закрыл, CSRF задушил, refresh rotation теперь как надо. HSTS на staging, ENABLE_DOCS=false, install.env recovery протестил. Backend: - jwt_denylist + auth_epoch: мгновенный revoke access JWT (logout/block/reset) - auth/admin/users: bump epoch, logout с Bearer, forgot_password skip для blocked - install_secrets: путь всегда apps/api/data/secrets/ (bootstrap из корня не ломает Docker) - seed: SEED_DEMO_USERS=false на prod/staging - тесты: jwt revoke, integration, coverage gate 90% Frontend: - logout шлёт Bearer, обработка TOKEN_REVOKED - guards TypeScript fix - E2E: blocked user → 401 сразу после block Infra: - staging/prod compose, TLS nginx, deploy-скрипты - k6 §17.2, backup/health/smoke scripts Docs: - docs/ на русском: project, security, deploy, release (старые md слили) - README короткий + план ТЗ + стандартные логины dev Код готов к плаванию. Капитан может идти писать фронт.
2026-07-15 00:06:13 +03:00
parent 86cc3fa541
commit 12c983c0fc
66 changed files with 2377 additions and 520 deletions
@@ -0,0 +1,13 @@
+# Copy to infra/docker/.env.production and fill in production values.
+FRONTEND_URL=https://compton.example.com
+PUBLIC_BASE_URL=https://compton.example.com
+CORS_ORIGINS=["https://compton.example.com"]
+TRUSTED_PROXY_IPS=172.16.0.0/12,10.0.0.0/8
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASSWORD=
+SMTP_FROM=noreply@compton.example.com
+TLS_CERT_DIR=./certs
+ADMIN_INITIAL_PASSWORD=ChangeMeProductionAdmin1234
+SEED_DEMO_USERS=false
@@ -0,0 +1,12 @@
+# Copy to infra/docker/.env.staging and fill in domain/SMTP values.
+FRONTEND_URL=https://staging.example.com
+PUBLIC_BASE_URL=https://staging.example.com
+CORS_ORIGINS=["https://staging.example.com"]
+TRUSTED_PROXY_IPS=172.16.0.0/12,10.0.0.0/8
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASSWORD=
+SMTP_FROM=noreply@example.com
+TLS_CERT_DIR=./certs
+ADMIN_INITIAL_PASSWORD=ChangeMeStagingAdmin1234
@@ -1,4 +1,31 @@
-# Docker notes
+# Docker deployment

-`docker-compose.yml` is for local development.
-`docker-compose.test.yml` is for CI-like integration and e2e testing.
+Краткая справка. Подробный runbook: [docs/deploy.md](../../docs/deploy.md).
+
+| Файл | Среда |
+|------|-------|
+| [`../../docker-compose.yml`](../../docker-compose.yml) | Локальная разработка |
+| [`../../docker-compose.test.yml`](../../docker-compose.test.yml) | CI / E2E |
+| [`docker-compose.staging.yml`](docker-compose.staging.yml) | Staging VPS |
+| [`docker-compose.prod.yml`](docker-compose.prod.yml) | Production VPS |
+
+## Staging
+
+```bash
+cp infra/docker/.env.staging.example infra/docker/.env.staging
+# TLS: infra/docker/certs/fullchain.pem, privkey.pem
+python3 apps/api/scripts/bootstrap_install.py
+./infra/docker/deploy-staging.sh
+```
+
+## Production
+
+```bash
+cp infra/docker/.env.production.example infra/docker/.env.production
+python3 apps/api/scripts/bootstrap_install.py
+./infra/docker/deploy-prod.sh infra/docker/.env.production
+```
+
+## QA на staging
+
+См. [docs/release.md](../../docs/release.md): E2E, k6, ZAP, Lighthouse.
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT"
+
+ENV_FILE="${1:-infra/docker/.env.production}"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "Missing $ENV_FILE — copy infra/docker/.env.production.example first."
+  exit 1
+fi
+
+if [[ ! -f apps/api/data/secrets/install.env ]]; then
+  python3 apps/api/scripts/bootstrap_install.py
+fi
+
+docker compose \
+  -f infra/docker/docker-compose.prod.yml \
+  --env-file "$ENV_FILE" \
+  up -d --build
+
+echo "Production deploy complete."
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT"
+
+ENV_FILE="${1:-infra/docker/.env.staging}"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "Missing $ENV_FILE — copy infra/docker/.env.staging.example first."
+  exit 1
+fi
+
+if [[ ! -f apps/api/data/secrets/install.env ]]; then
+  python3 apps/api/scripts/bootstrap_install.py
+fi
+
+docker compose \
+  -f infra/docker/docker-compose.staging.yml \
+  --env-file "$ENV_FILE" \
+  up -d --build
+
+echo "Staging deploy complete. Verify: curl -k https://\$(grep FRONTEND_URL $ENV_FILE | cut -d= -f2)/api/v1/health"
@@ -0,0 +1,99 @@
+# Production stack — VPS deploy.
+# Usage:
+#   python apps/api/scripts/bootstrap_install.py
+#   cp infra/docker/.env.production.example infra/docker/.env.production
+#   docker compose -f infra/docker/docker-compose.prod.yml --env-file infra/docker/.env.production up -d --build
+
+services:
+  postgres:
+    image: postgres:16
+    restart: unless-stopped
+    env_file:
+      - ../../apps/api/data/secrets/install.env
+    volumes:
+      - prod_postgres_data:/var/lib/postgresql/data
+    networks:
+      - internal
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    networks:
+      - internal
+
+  minio:
+    image: minio/minio
+    restart: unless-stopped
+    command: server /data --console-address ":9001"
+    env_file:
+      - ../../apps/api/data/secrets/install.env
+    volumes:
+      - prod_minio_data:/data
+    networks:
+      - internal
+
+  api:
+    build:
+      context: ../../apps/api
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    environment:
+      APP_ENV: production
+      ENABLE_DOCS: "false"
+      ENABLE_TEST_ROUTES: "false"
+      COOKIE_SECURE: "true"
+      ENABLE_RATE_LIMIT: "true"
+      EMAIL_DELIVERY_MODE: smtp
+      STORAGE_MODE: s3
+      S3_ENDPOINT: http://minio:9000
+      REDIS_URL: redis://redis:6379/0
+      SEED_DEMO_USERS: "false"
+    env_file:
+      - ../../apps/api/data/secrets/install.env
+      - .env.production
+    volumes:
+      - ../../apps/api/data/secrets:/app/data/secrets
+      - prod_api_logs:/app/data/logs
+    depends_on:
+      - postgres
+      - redis
+      - minio
+    networks:
+      - internal
+
+  web:
+    build:
+      context: ../..
+      dockerfile: apps/web/Dockerfile
+    restart: unless-stopped
+    environment:
+      VITE_USE_API_PROXY: "true"
+      VITE_API_URL: http://api:8000
+    depends_on:
+      - api
+    networks:
+      - internal
+
+  nginx:
+    image: nginx:stable-alpine
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ../nginx/default.tls.conf:/etc/nginx/conf.d/default.conf:ro
+      - ${TLS_CERT_DIR:-./certs}:/etc/nginx/certs:ro
+    depends_on:
+      - web
+      - api
+    networks:
+      - internal
+
+networks:
+  internal:
+    driver: bridge
+
+volumes:
+  prod_postgres_data:
+  prod_minio_data:
+  prod_api_logs:
@@ -1,9 +1,83 @@
+# Staging stack — VPS deploy (no bind mounts, production-like settings).
+# Usage:
+#   cp infra/docker/.env.staging.example infra/docker/.env.staging
+#   docker compose -f infra/docker/docker-compose.staging.yml --env-file infra/docker/.env.staging up -d --build
+
 services:
-  web:
-    image: compton/web:staging
+  postgres:
+    image: postgres:16
+    restart: unless-stopped
+    env_file:
+      - ../../apps/api/data/secrets/install.env
+    volumes:
+      - staging_postgres_data:/var/lib/postgresql/data
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+
+  minio:
+    image: minio/minio
+    restart: unless-stopped
+    command: server /data --console-address ":9001"
+    env_file:
+      - ../../apps/api/data/secrets/install.env
+    volumes:
+      - staging_minio_data:/data
+
  api:
-    image: compton/api:staging
+    build:
+      context: ../../apps/api
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    environment:
+      APP_ENV: staging
+      ENABLE_DOCS: "false"
+      ENABLE_TEST_ROUTES: "false"
+      COOKIE_SECURE: "true"
+      ENABLE_RATE_LIMIT: "true"
+      EMAIL_DELIVERY_MODE: smtp
+      STORAGE_MODE: s3
+      S3_ENDPOINT: http://minio:9000
+      REDIS_URL: redis://redis:6379/0
+      SEED_DEMO_USERS: "false"
+    env_file:
+      - ../../apps/api/.env.example
+      - ../../apps/api/data/secrets/install.env
+      - .env.staging
+    volumes:
+      - ../../apps/api/data/secrets:/app/data/secrets
+      - staging_api_logs:/app/data/logs
+    depends_on:
+      - postgres
+      - redis
+      - minio
+
+  web:
+    build:
+      context: ../..
+      dockerfile: apps/web/Dockerfile
+    restart: unless-stopped
+    environment:
+      VITE_USE_API_PROXY: "true"
+      VITE_API_URL: http://api:8000
+    depends_on:
+      - api
+
  nginx:
    image: nginx:stable-alpine
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
    volumes:
-      - ../nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
+      - ../nginx/default.tls.conf:/etc/nginx/conf.d/default.conf:ro
+      - ${TLS_CERT_DIR:-./certs}:/etc/nginx/certs:ro
+    depends_on:
+      - web
+      - api
+
+volumes:
+  staging_postgres_data:
+  staging_minio_data:
+  staging_api_logs: