MMD
ce0735d775
Security: deep /api/health (DB+MinIO probes, 503 on failure) + /api/live; rate-limited public forms with honeypots; real client IP behind Traefik (--proxy-headers); TipTap URL sanitization on write (nh3); non-root containers + slim .dockerignore; prod MinIO console bound to 127.0.0.1; HSTS/nosniff on TLS routers; JWT 8h; no default credentials in code. Reliability: Alembic migrations (create_all baseline); graceful shutdown (exec uvicorn); hardened backups (checksums, sanity check, freshness gauge, optional rclone off-site) + restore.sh + hourly db-backup sidecar (ops profile); stack.sh ops tooling (deploy/logs/health/backup/restore/monitoring); .gitattributes LF for shell scripts. Orchestration: json-file log rotation, pinned images, per-service memory limits, edge/internal networks, Traefik ping/accesslog/metrics + flood limiter, conditional minio-setup, pgvector db image, one-shot db-init (umami + aramesh_chatbot databases). Chatbot: unified from site-chatbot branch (RAG + pgvector, SSE, ChatWidget). Monitoring: Prometheus/Alertmanager/Loki/Promtail/Grafana + cAdvisor, node/postgres/blackbox exporters, provisioned dashboards and 10 alert rules; alerts delivered to Bale (tapi.bale.ai — Telegram-compatible). Analytics: Umami on shared Postgres, build-time tracker injection, custom events (contact/newsletter/phone/chat/lang) via frontend/src/analytics.ts. Hygiene: CSV export for contact messages and subscribers; upload image optimization (Pillow); CI script + GitHub-compatible workflow; audit.sh; gen-env.sh for strong credentials.
58 lines
2.4 KiB
Python
58 lines
2.4 KiB
Python
from fastapi import FastAPI
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from fastapi.middleware.gzip import GZipMiddleware
|
|
|
|
from . import models # noqa: F401 — ثبت مدل‌ها پیش از ساخت جداول
|
|
from .api import admin, forms, public
|
|
from .config import settings
|
|
from .database import Base, engine
|
|
from .seo_pages import router as seo_router
|
|
|
|
# ساخت جداول پایه — تغییرات بعدی اسکیما فقط با revisionهای Alembic اعمال می‌شوند
|
|
# (مigrations/versions). اجرای اینجا برای اجرای مستقیم uvicorn در محیط توسعه است؛
|
|
# در کانتینر، CMD همین کار را قبل از alembic upgrade head انجام می‌دهد.
|
|
Base.metadata.create_all(bind=engine)
|
|
|
|
app = FastAPI(
|
|
title="Aramesh Building Group API",
|
|
description=(
|
|
"بک‌اند سایت گروه ساختمانی آرامش — API محتوای سایت، فرم تماس و خبرنامه، "
|
|
"و پنل مدیریت با احراز هویت JWT."
|
|
),
|
|
version="1.0.0",
|
|
docs_url="/docs",
|
|
redoc_url="/redoc",
|
|
)
|
|
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=settings.cors_origins,
|
|
allow_credentials=False,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
# پاسخ‌های JSON /api — فشرده‌سازی وقتی بدنه قابل‌توجه است
|
|
app.add_middleware(GZipMiddleware, minimum_size=1024)
|
|
|
|
app.include_router(public.router, prefix="/api", tags=["عمومی"])
|
|
app.include_router(forms.router, prefix="/api", tags=["فرم‌ها"])
|
|
app.include_router(admin.auth_router, prefix="/api", tags=["احراز هویت"])
|
|
app.include_router(admin.router, prefix="/api/admin", tags=["پنل مدیریت"])
|
|
# robots.txt، sitemap.xml و HTML صفحات وبلاگ/پروژه با متای سئو — در ریشه دامنه
|
|
app.include_router(seo_router, tags=["سئو"])
|
|
|
|
# متریک‌های Prometheus — فقط Prometheus در شبکه داخلی اسکرپ می‌کند
|
|
# (Traefik مسیر /metrics را نمی‌شناسد، پس از بیرون در دسترس نیست)
|
|
from prometheus_fastapi_instrumentator import Instrumentator # noqa: E402
|
|
|
|
Instrumentator().instrument(app).expose(app, endpoint="/metrics", include_in_schema=False)
|
|
|
|
|
|
@app.get("/")
|
|
def root():
|
|
return {
|
|
"app": "Aramesh Building Group API",
|
|
"docs": "/docs",
|
|
"health": "/api/health",
|
|
}
|