Tomas Kracmar
d01e7801ed
- Add WEBHOOK_CLIENT_SECRET validation for Graph webhooks - Add Redis-backed rate limiting (fetch/ask/write/default tiers) - Validate LLM_BASE_URL to prevent SSRF (HTTPS only, block private IPs) - Enforce non-wildcard CORS when AUTH_ENABLED=true - Add Content-Security-Policy headers - Fix audit middleware to use verified JWT claims via contextvars - Cap bulk_tags updates to 10,000 documents - Return generic error messages to clients (no internal detail leakage) - Strict AlertCondition Pydantic model for alert rules - Security warning on MCP stdio server startup - Remove MongoDB/Redis host ports from docker-compose - Remove mongo_query from /ask API response
55 lines
1.3 KiB
YAML
55 lines
1.3 KiB
YAML
services:
|
|
redis:
|
|
image: valkey/valkey:8-alpine
|
|
container_name: aoc-redis
|
|
restart: always
|
|
# Ports not exposed to host; backend and worker connect via Docker network
|
|
volumes:
|
|
- redis_data:/data
|
|
|
|
mongo:
|
|
image: mongo:7
|
|
container_name: aoc-mongo
|
|
restart: always
|
|
# Ports not exposed to host; backend and worker connect via Docker network
|
|
environment:
|
|
MONGO_INITDB_ROOT_USERNAME: ${MONGO_ROOT_USERNAME}
|
|
MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD}
|
|
volumes:
|
|
- mongo_data:/data/db
|
|
|
|
backend:
|
|
build: ./backend
|
|
# For production, use the pre-built image instead:
|
|
# image: git.cqre.net/cqrenet/aoc-backend:v1.2.5
|
|
container_name: aoc-backend
|
|
restart: always
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
MONGO_URI: mongodb://${MONGO_ROOT_USERNAME}:${MONGO_ROOT_PASSWORD}@mongo:${MONGO_PORT}/
|
|
REDIS_URL: redis://redis:6379/0
|
|
depends_on:
|
|
- mongo
|
|
- redis
|
|
ports:
|
|
- "8000:8000"
|
|
|
|
worker:
|
|
build: ./backend
|
|
container_name: aoc-worker
|
|
restart: always
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
MONGO_URI: mongodb://${MONGO_ROOT_USERNAME}:${MONGO_ROOT_PASSWORD}@mongo:${MONGO_PORT}/
|
|
REDIS_URL: redis://redis:6379/0
|
|
command: ["arq", "jobs.WorkerSettings"]
|
|
depends_on:
|
|
- redis
|
|
- mongo
|
|
|
|
volumes:
|
|
mongo_data:
|
|
redis_data:
|