MMD
ce0735d775
Security: deep /api/health (DB+MinIO probes, 503 on failure) + /api/live; rate-limited public forms with honeypots; real client IP behind Traefik (--proxy-headers); TipTap URL sanitization on write (nh3); non-root containers + slim .dockerignore; prod MinIO console bound to 127.0.0.1; HSTS/nosniff on TLS routers; JWT 8h; no default credentials in code. Reliability: Alembic migrations (create_all baseline); graceful shutdown (exec uvicorn); hardened backups (checksums, sanity check, freshness gauge, optional rclone off-site) + restore.sh + hourly db-backup sidecar (ops profile); stack.sh ops tooling (deploy/logs/health/backup/restore/monitoring); .gitattributes LF for shell scripts. Orchestration: json-file log rotation, pinned images, per-service memory limits, edge/internal networks, Traefik ping/accesslog/metrics + flood limiter, conditional minio-setup, pgvector db image, one-shot db-init (umami + aramesh_chatbot databases). Chatbot: unified from site-chatbot branch (RAG + pgvector, SSE, ChatWidget). Monitoring: Prometheus/Alertmanager/Loki/Promtail/Grafana + cAdvisor, node/postgres/blackbox exporters, provisioned dashboards and 10 alert rules; alerts delivered to Bale (tapi.bale.ai — Telegram-compatible). Analytics: Umami on shared Postgres, build-time tracker injection, custom events (contact/newsletter/phone/chat/lang) via frontend/src/analytics.ts. Hygiene: CSV export for contact messages and subscribers; upload image optimization (Pillow); CI script + GitHub-compatible workflow; audit.sh; gen-env.sh for strong credentials.
32 lines
1.2 KiB
Docker
32 lines
1.2 KiB
Docker
# سرویس چتبات — پایتون + مدلهای بازیابی (CPU)
|
|
FROM python:3.11-slim
|
|
|
|
WORKDIR /srv
|
|
|
|
# وابستگیهای سیستمی برای numpy/scikit-learn
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
g++ \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY requirements.txt /srv/chatbot/requirements.txt
|
|
RUN pip install --no-cache-dir -r /srv/chatbot/requirements.txt
|
|
|
|
COPY . /srv/chatbot/
|
|
|
|
# مدل امبدینگ/ریرنکر در /data کش میشود (والیوم داکر) — بردارها در pgvector میروند و فایل ایندکس جدا وجود ندارد
|
|
ENV HF_HOME=/data/hf \
|
|
HF_CACHE_DIR=/data/hf
|
|
VOLUME /data
|
|
|
|
# کاربر بدون دسترسی root — فقط /data باید نوشتنی باشد (کش مدلها)
|
|
RUN useradd --system --create-home appuser \
|
|
&& chown -R appuser:appuser /srv/chatbot /data
|
|
USER appuser
|
|
|
|
EXPOSE 8000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=180s --retries=5 \
|
|
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/chat/healthz')" || exit 1
|
|
|
|
CMD ["uvicorn", "chatbot.app:api", "--host", "0.0.0.0", "--port", "8000", "--proxy-headers", "--forwarded-allow-ips=*"]
|