derekcandClaude Opus 5.5
3170c7f4eb
- nginx: resolve real client IP through Cloudflare -> NPM so rate limits are per client instead of shared across all users - Bump vulnerable Python deps (PyJWT auth bypass, anyio, starlette via fastapi 0.141.1, cryptography, python-multipart, Mako); pin PyMySQL 1.1.2 since 1.2.x breaks SQLAlchemy 2.0.35's aiomysql ping - Backend: python 3.12.14-slim, apt-get upgrade, drop unneeded build deps - Frontend: nginx 1.30.5-alpine (stable) + apk upgrade - MySQL 8.0.40 (EOL) -> 8.4.11 LTS; add healthcheck start_period so slow startups (e.g. data upgrades) don't abort dependent services - Add maintenance review report Co-Authored-By: Claude Opus 5.5 <[email protected]>
66 lines
1.6 KiB
YAML
66 lines
1.6 KiB
YAML
services:
|
|
db:
|
|
image: mysql:8.4.11
|
|
container_name: homeschool_db
|
|
restart: unless-stopped
|
|
environment:
|
|
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
|
|
MYSQL_DATABASE: ${MYSQL_DATABASE}
|
|
MYSQL_USER: ${MYSQL_USER}
|
|
MYSQL_PASSWORD: ${MYSQL_PASSWORD}
|
|
volumes:
|
|
- mysql_data:/var/lib/mysql
|
|
networks:
|
|
- homeschool_net
|
|
healthcheck:
|
|
test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 180s
|
|
mem_limit: 512m
|
|
cpus: 1.0
|
|
|
|
backend:
|
|
build: ./backend
|
|
container_name: homeschool_backend
|
|
restart: unless-stopped
|
|
environment:
|
|
DATABASE_URL: mysql+aiomysql://${MYSQL_USER}:${MYSQL_PASSWORD}@db/${MYSQL_DATABASE}
|
|
SECRET_KEY: ${SECRET_KEY}
|
|
ALGORITHM: ${ALGORITHM:-HS256}
|
|
ACCESS_TOKEN_EXPIRE_MINUTES: ${ACCESS_TOKEN_EXPIRE_MINUTES:-30}
|
|
REFRESH_TOKEN_EXPIRE_DAYS: ${REFRESH_TOKEN_EXPIRE_DAYS:-30}
|
|
CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:8057}
|
|
ADMIN_USERNAME: ${ADMIN_USERNAME}
|
|
ADMIN_PASSWORD: ${ADMIN_PASSWORD}
|
|
NTFY_URL: ${NTFY_URL:-}
|
|
NTFY_TOKEN: ${NTFY_TOKEN:-}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
networks:
|
|
- homeschool_net
|
|
mem_limit: 512m
|
|
cpus: 1.0
|
|
|
|
frontend:
|
|
build: ./frontend
|
|
container_name: homeschool_frontend
|
|
restart: unless-stopped
|
|
ports:
|
|
- "8054:80"
|
|
depends_on:
|
|
- backend
|
|
networks:
|
|
- homeschool_net
|
|
mem_limit: 128m
|
|
cpus: 0.5
|
|
|
|
networks:
|
|
homeschool_net:
|
|
driver: bridge
|
|
|
|
volumes:
|
|
mysql_data:
|