влад
12c983c0fc
Безопасность довёл до ума — Cursor-генерацию переписал руками. IDOR закрыл, CSRF задушил, refresh rotation теперь как надо. HSTS на staging, ENABLE_DOCS=false, install.env recovery протестил. Backend: - jwt_denylist + auth_epoch: мгновенный revoke access JWT (logout/block/reset) - auth/admin/users: bump epoch, logout с Bearer, forgot_password skip для blocked - install_secrets: путь всегда apps/api/data/secrets/ (bootstrap из корня не ломает Docker) - seed: SEED_DEMO_USERS=false на prod/staging - тесты: jwt revoke, integration, coverage gate 90% Frontend: - logout шлёт Bearer, обработка TOKEN_REVOKED - guards TypeScript fix - E2E: blocked user → 401 сразу после block Infra: - staging/prod compose, TLS nginx, deploy-скрипты - k6 §17.2, backup/health/smoke scripts Docs: - docs/ на русском: project, security, deploy, release (старые md слили) - README короткий + план ТЗ + стандартные логины dev Код готов к плаванию. Капитан может идти писать фронт.
84 lines
2.0 KiB
YAML
84 lines
2.0 KiB
YAML
# Staging stack — VPS deploy (no bind mounts, production-like settings).
|
|
# Usage:
|
|
# cp infra/docker/.env.staging.example infra/docker/.env.staging
|
|
# docker compose -f infra/docker/docker-compose.staging.yml --env-file infra/docker/.env.staging up -d --build
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:16
|
|
restart: unless-stopped
|
|
env_file:
|
|
- ../../apps/api/data/secrets/install.env
|
|
volumes:
|
|
- staging_postgres_data:/var/lib/postgresql/data
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
restart: unless-stopped
|
|
|
|
minio:
|
|
image: minio/minio
|
|
restart: unless-stopped
|
|
command: server /data --console-address ":9001"
|
|
env_file:
|
|
- ../../apps/api/data/secrets/install.env
|
|
volumes:
|
|
- staging_minio_data:/data
|
|
|
|
api:
|
|
build:
|
|
context: ../../apps/api
|
|
dockerfile: Dockerfile
|
|
restart: unless-stopped
|
|
environment:
|
|
APP_ENV: staging
|
|
ENABLE_DOCS: "false"
|
|
ENABLE_TEST_ROUTES: "false"
|
|
COOKIE_SECURE: "true"
|
|
ENABLE_RATE_LIMIT: "true"
|
|
EMAIL_DELIVERY_MODE: smtp
|
|
STORAGE_MODE: s3
|
|
S3_ENDPOINT: http://minio:9000
|
|
REDIS_URL: redis://redis:6379/0
|
|
SEED_DEMO_USERS: "false"
|
|
env_file:
|
|
- ../../apps/api/.env.example
|
|
- ../../apps/api/data/secrets/install.env
|
|
- .env.staging
|
|
volumes:
|
|
- ../../apps/api/data/secrets:/app/data/secrets
|
|
- staging_api_logs:/app/data/logs
|
|
depends_on:
|
|
- postgres
|
|
- redis
|
|
- minio
|
|
|
|
web:
|
|
build:
|
|
context: ../..
|
|
dockerfile: apps/web/Dockerfile
|
|
restart: unless-stopped
|
|
environment:
|
|
VITE_USE_API_PROXY: "true"
|
|
VITE_API_URL: http://api:8000
|
|
depends_on:
|
|
- api
|
|
|
|
nginx:
|
|
image: nginx:stable-alpine
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ../nginx/default.tls.conf:/etc/nginx/conf.d/default.conf:ro
|
|
- ${TLS_CERT_DIR:-./certs}:/etc/nginx/certs:ro
|
|
depends_on:
|
|
- web
|
|
- api
|
|
|
|
volumes:
|
|
staging_postgres_data:
|
|
staging_minio_data:
|
|
staging_api_logs:
|