Mattsson
9aced4790c
* feat(api): implement caching and logging in health check endpoint - Added in-memory caching for health check responses to reduce load on Postgres. - Introduced logging for error handling in health check. - Updated response structure to exclude error details from public responses. feat(api): enhance OAuth consent UI and scope handling - Improved consent UI to reflect exact requested scopes and added better user guidance. - Updated scope handling logic to ensure least-privilege access. - Enhanced styling for better user experience and accessibility. chore(docker): improve security and resource management in Docker setup - Updated Docker Compose configuration to enforce read-only file systems and resource limits. - Added health checks and logging options for better observability. - Introduced optional Caddy reverse proxy for TLS termination. fix(migrations): resolve ambiguity in create_company_with_owner function - Dropped orphaned 3-arg overload of create_company_with_owner function. - Recreated canonical 4-arg version with cash account seeding logic. - Ensured proper permissions for function execution in Postgres. * feat: enhance security checks for team membership in company creation
74 lines
2.1 KiB
YAML
74 lines
2.1 KiB
YAML
services:
|
|
app:
|
|
image: ghcr.io/erp-mafia/gnubok:${IMAGE_TAG:-latest}
|
|
env_file: .env
|
|
# Bound to loopback by default — put a TLS-terminating reverse proxy in
|
|
# front (see docker-compose.caddy.yml). Override PORT in .env to change
|
|
# the host port, or use the caddy overlay to remove the host binding.
|
|
ports:
|
|
- "127.0.0.1:${PORT:-3000}:3000"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
read_only: true
|
|
init: true
|
|
# tmpfs ordering matters — the parent /app/.next must be mounted before
|
|
# any sub-mounts. The entrypoint cp's image-baked templates into these
|
|
# mounts at startup, then sed-substitutes, then chmod -R a-w.
|
|
#
|
|
# mode=750: root-owned, group-readable. The entrypoint runs as root long
|
|
# enough to copy templates, substitute placeholders, and chown the cache
|
|
# directory to nextjs:nodejs (gid 1001). nodejs group members can read
|
|
# the partially-substituted bundle during startup; nothing else on the
|
|
# host can. After chmod a-w the served files are read-only for everyone.
|
|
tmpfs:
|
|
- /tmp
|
|
- /app/.next:uid=0,gid=1001,mode=750,size=400m
|
|
- /app/public:uid=0,gid=1001,mode=750,size=200m
|
|
mem_limit: 1g
|
|
cpus: 2
|
|
pids_limit: 200
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000/api/health"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 30s
|
|
start_interval: 5s
|
|
retries: 3
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "5"
|
|
|
|
cron:
|
|
build:
|
|
context: docker
|
|
dockerfile: cron.Dockerfile
|
|
depends_on:
|
|
app:
|
|
condition: service_healthy
|
|
environment:
|
|
- CRON_SECRET=${CRON_SECRET}
|
|
- APP_URL=http://app:3000
|
|
volumes:
|
|
- ./docker/crontab.self-hosted:/etc/supercronic/crontab:ro
|
|
init: true
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
mem_limit: 64m
|
|
pids_limit: 30
|
|
restart: unless-stopped
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "5"
|