MMD
ce0735d775
Security: deep /api/health (DB+MinIO probes, 503 on failure) + /api/live; rate-limited public forms with honeypots; real client IP behind Traefik (--proxy-headers); TipTap URL sanitization on write (nh3); non-root containers + slim .dockerignore; prod MinIO console bound to 127.0.0.1; HSTS/nosniff on TLS routers; JWT 8h; no default credentials in code. Reliability: Alembic migrations (create_all baseline); graceful shutdown (exec uvicorn); hardened backups (checksums, sanity check, freshness gauge, optional rclone off-site) + restore.sh + hourly db-backup sidecar (ops profile); stack.sh ops tooling (deploy/logs/health/backup/restore/monitoring); .gitattributes LF for shell scripts. Orchestration: json-file log rotation, pinned images, per-service memory limits, edge/internal networks, Traefik ping/accesslog/metrics + flood limiter, conditional minio-setup, pgvector db image, one-shot db-init (umami + aramesh_chatbot databases). Chatbot: unified from site-chatbot branch (RAG + pgvector, SSE, ChatWidget). Monitoring: Prometheus/Alertmanager/Loki/Promtail/Grafana + cAdvisor, node/postgres/blackbox exporters, provisioned dashboards and 10 alert rules; alerts delivered to Bale (tapi.bale.ai — Telegram-compatible). Analytics: Umami on shared Postgres, build-time tracker injection, custom events (contact/newsletter/phone/chat/lang) via frontend/src/analytics.ts. Hygiene: CSV export for contact messages and subscribers; upload image optimization (Pillow); CI script + GitHub-compatible workflow; audit.sh; gen-env.sh for strong credentials.
88 lines
2.4 KiB
YAML
88 lines
2.4 KiB
YAML
# تنظیمات Prometheus — اسکرپ همهٔ سرویس‌های استک از شبکه‌های داخلی
|
|
global:
|
|
scrape_interval: 30s
|
|
evaluation_interval: 30s
|
|
|
|
alerting:
|
|
alertmanagers:
|
|
- static_configs:
|
|
- targets: ["alertmanager:9093"]
|
|
|
|
rule_files:
|
|
- /etc/prometheus/alerts.yml
|
|
|
|
scrape_configs:
|
|
- job_name: prometheus
|
|
static_configs:
|
|
- targets: ["localhost:9090"]
|
|
|
|
# بک‌اند FastAPI — /metrics با instrumentator (فقط از شبکه داخلی)
|
|
- job_name: backend
|
|
static_configs:
|
|
- targets: ["backend:8000"]
|
|
|
|
# پراکسی — RPS هر روتر، کدهای وضعیت، انقضای گواهی TLS
|
|
- job_name: traefik
|
|
static_configs:
|
|
- targets: ["traefik:8080"]
|
|
|
|
# منابع کانتینرها و میزبان
|
|
- job_name: cadvisor
|
|
static_configs:
|
|
- targets: ["cadvisor:8080"]
|
|
|
|
- job_name: node
|
|
static_configs:
|
|
- targets: ["node-exporter:9100"]
|
|
|
|
- job_name: postgres
|
|
static_configs:
|
|
- targets: ["postgres-exporter:9187"]
|
|
|
|
# سلامت مستقیم سرویس‌ها — up == 0 یعنی آن سرویس پایین است
|
|
- job_name: frontend
|
|
metrics_path: /
|
|
static_configs:
|
|
- targets: ["frontend:80"]
|
|
|
|
- job_name: minio
|
|
metrics_path: /minio/health/live
|
|
static_configs:
|
|
- targets: ["minio:9000"]
|
|
|
|
- job_name: umami
|
|
metrics_path: /api/heartbeat
|
|
static_configs:
|
|
- targets: ["umami:3000"]
|
|
|
|
- job_name: chatbot
|
|
metrics_path: /chat/healthz
|
|
static_configs:
|
|
- targets: ["chatbot:8000"]
|
|
|
|
# پروب بیرون‌نگر — سلامت واقعی /api/health (بخش عمق: DB و MinIO را می‌آزماید)
|
|
# و در تولید، آدرس عمومی سایت (SITE_URL از .env — پشتیبانی متغیر محیطی Prometheus)
|
|
- job_name: blackbox-internal-health
|
|
metrics_path: /probe
|
|
params:
|
|
module: [http_2xx]
|
|
static_configs:
|
|
- targets:
|
|
- http://backend:8000/api/health
|
|
relabel_configs: &blackbox_relabel
|
|
- source_labels: [__address__]
|
|
target_label: __param_target
|
|
- source_labels: [__param_target]
|
|
target_label: instance
|
|
- target_label: __address__
|
|
replacement: blackbox-exporter:9115
|
|
|
|
- job_name: blackbox-public
|
|
metrics_path: /probe
|
|
params:
|
|
module: [http_2xx]
|
|
static_configs:
|
|
- targets:
|
|
- ${SITE_URL:-http://frontend/}
|
|
relabel_configs: *blackbox_relabel
|