MMD
ce0735d775
Security: deep /api/health (DB+MinIO probes, 503 on failure) + /api/live; rate-limited public forms with honeypots; real client IP behind Traefik (--proxy-headers); TipTap URL sanitization on write (nh3); non-root containers + slim .dockerignore; prod MinIO console bound to 127.0.0.1; HSTS/nosniff on TLS routers; JWT 8h; no default credentials in code. Reliability: Alembic migrations (create_all baseline); graceful shutdown (exec uvicorn); hardened backups (checksums, sanity check, freshness gauge, optional rclone off-site) + restore.sh + hourly db-backup sidecar (ops profile); stack.sh ops tooling (deploy/logs/health/backup/restore/monitoring); .gitattributes LF for shell scripts. Orchestration: json-file log rotation, pinned images, per-service memory limits, edge/internal networks, Traefik ping/accesslog/metrics + flood limiter, conditional minio-setup, pgvector db image, one-shot db-init (umami + aramesh_chatbot databases). Chatbot: unified from site-chatbot branch (RAG + pgvector, SSE, ChatWidget). Monitoring: Prometheus/Alertmanager/Loki/Promtail/Grafana + cAdvisor, node/postgres/blackbox exporters, provisioned dashboards and 10 alert rules; alerts delivered to Bale (tapi.bale.ai — Telegram-compatible). Analytics: Umami on shared Postgres, build-time tracker injection, custom events (contact/newsletter/phone/chat/lang) via frontend/src/analytics.ts. Hygiene: CSV export for contact messages and subscribers; upload image optimization (Pillow); CI script + GitHub-compatible workflow; audit.sh; gen-env.sh for strong credentials.
26 lines
840 B
Bash
26 lines
840 B
Bash
#!/usr/bin/env bash
|
|
# تستها + بیلد ایمیجها — قابل اجرا محلی یا در هر CI (Gitea Actions/GitLab CI سازگار است)
|
|
# bash scripts/ci.sh
|
|
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
echo "== تستهای بکاند =="
|
|
if [ -d backend/.venv ]; then
|
|
# shellcheck disable=SC1091
|
|
source backend/.venv/bin/activate 2>/dev/null || source backend/.venv/Scripts/activate
|
|
(cd backend && pytest -q)
|
|
elif command -v pytest >/dev/null 2>&1; then
|
|
(cd backend && pytest -q)
|
|
else
|
|
echo "رد شد: pytest در دسترس نیست (backend/.venv را بسازید)"
|
|
fi
|
|
|
|
echo "== بیلد ایمیجهای داکر =="
|
|
docker compose -f docker-compose.yml build backend frontend chatbot
|
|
|
|
echo "== ممیزی وابستگیها =="
|
|
bash scripts/audit.sh || true
|
|
|
|
echo "✔ CI تمام شد"
|