MMD
43e317eeba
- Delete backups/*.dump and all real credentials from README/docs
(prod MinIO creds, Casdoor passwords, server IP, admin password)
- All stack secrets now come from git-ignored .env (.env.example added);
docker-compose.prod.yml refuses to boot without them (${VAR:?})
- seed_casdoor.py: bcrypt password hashing, generated console/client secrets
- Harden infra/deploy-webhook: HMAC-verified Gitea webhook receiver
+ systemd unit + README (replaces unauthenticated deploy endpoint)
- docs/SECRET-MANAGEMENT.md: secret inventory + rotation checklist
26 lines
822 B
Desktop File
26 lines
822 B
Desktop File
[Unit]
|
|
Description=ERP push-to-deploy webhook receiver (Gitea -> docker compose)
|
|
After=network-online.target docker.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
# Run as a dedicated non-root user with docker group membership:
|
|
# sudo useradd -r -s /usr/sbin/nologin erpdeploy && sudo usermod -aG docker erpdeploy
|
|
# sudo chown -R erpdeploy /srv/erp
|
|
User=erpdeploy
|
|
Group=erpdeploy
|
|
WorkingDirectory=/srv/erp
|
|
# EnvironmentFile carries GITEA_WEBHOOK_SECRET (same .env used by compose).
|
|
EnvironmentFile=/srv/erp/.env
|
|
ExecStart=/usr/bin/python3 /srv/erp/infra/deploy-webhook/deploy_webhook.py
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
# Minimal exposure: no write access outside /srv/erp, no new privileges.
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/srv/erp /tmp
|
|
ProtectHome=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|