MMD
ce0735d775
Security: deep /api/health (DB+MinIO probes, 503 on failure) + /api/live; rate-limited public forms with honeypots; real client IP behind Traefik (--proxy-headers); TipTap URL sanitization on write (nh3); non-root containers + slim .dockerignore; prod MinIO console bound to 127.0.0.1; HSTS/nosniff on TLS routers; JWT 8h; no default credentials in code. Reliability: Alembic migrations (create_all baseline); graceful shutdown (exec uvicorn); hardened backups (checksums, sanity check, freshness gauge, optional rclone off-site) + restore.sh + hourly db-backup sidecar (ops profile); stack.sh ops tooling (deploy/logs/health/backup/restore/monitoring); .gitattributes LF for shell scripts. Orchestration: json-file log rotation, pinned images, per-service memory limits, edge/internal networks, Traefik ping/accesslog/metrics + flood limiter, conditional minio-setup, pgvector db image, one-shot db-init (umami + aramesh_chatbot databases). Chatbot: unified from site-chatbot branch (RAG + pgvector, SSE, ChatWidget). Monitoring: Prometheus/Alertmanager/Loki/Promtail/Grafana + cAdvisor, node/postgres/blackbox exporters, provisioned dashboards and 10 alert rules; alerts delivered to Bale (tapi.bale.ai — Telegram-compatible). Analytics: Umami on shared Postgres, build-time tracker injection, custom events (contact/newsletter/phone/chat/lang) via frontend/src/analytics.ts. Hygiene: CSV export for contact messages and subscribers; upload image optimization (Pillow); CI script + GitHub-compatible workflow; audit.sh; gen-env.sh for strong credentials.
42 lines
1.4 KiB
Bash
42 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
# ممیزی وابستگی‌ها — آسیب‌پذیری‌های شناخته‌شده در پکیج‌های پایتون/نود و ایمیج‌های داکر.
|
|
# bash scripts/audit.sh
|
|
# ابزارها اگر نصب نباشند رد می‌شوند (پیام هشدار)؛ خروجی nonzero یعنی مشکل پیدا شد.
|
|
|
|
set -uo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
STATUS=0
|
|
|
|
echo "== pip-audit (بک‌اند) =="
|
|
if command -v pip-audit >/dev/null 2>&1; then
|
|
(cd backend && pip-audit -r requirements.txt --progress-spinner off) || STATUS=1
|
|
else
|
|
echo "رد شد: pip-audit نصب نیست (pip install pip-audit)"
|
|
fi
|
|
|
|
echo "== npm audit (فرانت‌اند) =="
|
|
if [ -d frontend/node_modules ]; then
|
|
(cd frontend && npm audit --omit=dev) || STATUS=1
|
|
else
|
|
echo "رد شد: frontend/node_modules نیست (npm install)"
|
|
fi
|
|
|
|
echo "== trivy (ایمیج‌های داکر) =="
|
|
if command -v trivy >/dev/null 2>&1; then
|
|
for img in aramesh-backend-backend aramesh-backend-frontend aramesh-backend-chatbot; do
|
|
if docker image inspect "$img" >/dev/null 2>&1; then
|
|
trivy image --severity HIGH,CRITICAL "$img" || STATUS=1
|
|
fi
|
|
done
|
|
else
|
|
echo "رد شد: trivy نصب نیست"
|
|
fi
|
|
|
|
if [ "$STATUS" -eq 0 ]; then
|
|
echo "✔ ممیزی تمام شد — مشکل شناخته‌شده‌ای پیدا نشد."
|
|
else
|
|
echo "✗ ممیزی مشکل پیدا کرد — خروجی بالا را بررسی کنید." >&2
|
|
fi
|
|
exit "$STATUS"
|