glm-5.1
3ea3f56de7
Remove src/admin/socket.rs and replace with Bearer token HTTP auth on the health check listener (port 9900). New src/admin/auth.rs provides SHA-256 key hashing with constant-time comparison; src/admin/handler.rs implements /admin/reload, /admin/status, and /admin/rotate-key. Admin endpoints return 404 when disabled (empty admin_key_path), 401 on bad auth. Config field renamed admin_socket_path → admin_key_path. Deployment files updated for key file mount instead of socket directory.
52 lines
1.2 KiB
YAML
52 lines
1.2 KiB
YAML
services:
|
|
reverse-proxy:
|
|
build: .
|
|
container_name: reverse-proxy
|
|
restart: unless-stopped
|
|
ports:
|
|
- "203.0.113.10:80:80"
|
|
- "203.0.113.10:443:443"
|
|
volumes:
|
|
- /etc/reverse-proxy/config.toml:/etc/reverse-proxy/config.toml:ro
|
|
- /var/lib/reverse-proxy/acme-cache:/var/lib/reverse-proxy/acme-cache
|
|
- /var/log/reverse-proxy:/var/log/reverse-proxy
|
|
- /etc/reverse-proxy/admin-key:/etc/reverse-proxy/admin-key:ro
|
|
networks:
|
|
- proxy-net
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:9900/health"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
gitea:
|
|
image: gitea/gitea:latest
|
|
container_name: gitea
|
|
restart: unless-stopped
|
|
ports:
|
|
- "203.0.113.10:22:2222"
|
|
volumes:
|
|
- /opt/gitea:/data
|
|
networks:
|
|
- proxy-net
|
|
- gitea-db-net
|
|
|
|
gitea-db:
|
|
image: postgres:16-alpine
|
|
container_name: gitea-db
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: admin
|
|
POSTGRES_PASSWORD: ${DB_PASSWORD}
|
|
POSTGRES_DB: gitea
|
|
volumes:
|
|
- gitea-db:/var/lib/postgresql/data
|
|
networks:
|
|
- gitea-db-net
|
|
|
|
networks:
|
|
proxy-net:
|
|
gitea-db-net:
|
|
|
|
volumes:
|
|
gitea-db: |