MMD
43e317eeba
- Delete backups/*.dump and all real credentials from README/docs
(prod MinIO creds, Casdoor passwords, server IP, admin password)
- All stack secrets now come from git-ignored .env (.env.example added);
docker-compose.prod.yml refuses to boot without them (${VAR:?})
- seed_casdoor.py: bcrypt password hashing, generated console/client secrets
- Harden infra/deploy-webhook: HMAC-verified Gitea webhook receiver
+ systemd unit + README (replaces unauthenticated deploy endpoint)
- docs/SECRET-MANAGEMENT.md: secret inventory + rotation checklist
35 lines
1.0 KiB
Docker
35 lines
1.0 KiB
Docker
# Frontend image — multi-stage build
|
|
# Stage 1: build the Vite app with Node.js
|
|
# Stage 2: serve static files with nginx (which also proxies /api -> api:8000)
|
|
|
|
FROM node:22-alpine AS build
|
|
|
|
WORKDIR /app
|
|
|
|
# Dependencies first (layer caching)
|
|
# NPM_REGISTRY overridable; default points at npmmirror because
|
|
# registry.npmjs.org is unreachable from this network.
|
|
ARG NPM_REGISTRY=https://registry.npmmirror.com
|
|
COPY package.json package-lock.json ./
|
|
RUN npm config set registry ${NPM_REGISTRY} && npm ci
|
|
|
|
# Developer Mode panel on the login page (dev-only aid). Production builds
|
|
# MUST keep this "false" — identity comes from Casdoor tokens, and the
|
|
# backend rejects the X-User-* header path unless DEV_LOGIN_ENABLED=true.
|
|
ARG DEV_LOGIN_ENABLED=false
|
|
ENV VITE_ENABLE_DEV_LOGIN=${DEV_LOGIN_ENABLED}
|
|
|
|
# Source code + build
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
# ---------- runtime ----------
|
|
FROM nginx:alpine
|
|
|
|
COPY --from=build /app/dist /usr/share/nginx/html
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
|
|
EXPOSE 80
|
|
|
|
CMD ["nginx", "-g", "daemon off;"]
|