B0rbor4d
cc4c3fcecb
- Backend: Customer/Satellite Models, customer_id auf Server/Job/Audit - Satellite-API: heartbeat, poll (atomares Claiming), logs, result, scan-result, health-report - Auth via X-Api-Key (SHA-256 gehasht) - Job-Queue: pending/claimed/running/success/failed + Stale-Janitor - Batch-Trigger: ein Job pro Server, Satellite arbeitet sequenziell ab - Credentials bleiben lokal: nur symbolische credential_ref zentral - Neues Paket satellite/: Pull-Loop, WinRM/SSH/CAU/Scanner, PyInstaller-tauglich - Frontend: Kunden-Switcher, Satelliten-View, Polling statt WebSocket - Entfernt: WebSocket/Socket.io, Redis, zentrale Credentials, JobRunner - Docs: README/AGENTS/PROMPT auf neue Architektur aktualisiert
111 lines
3.3 KiB
YAML
111 lines
3.3 KiB
YAML
version: '3.8'
|
|
|
|
services:
|
|
# ---------------------------------------------------------------
|
|
# Backend - FastAPI (Production)
|
|
# ---------------------------------------------------------------
|
|
backend:
|
|
build:
|
|
context: ./backend
|
|
dockerfile: Dockerfile
|
|
target: production
|
|
container_name: insight-updater-backend
|
|
restart: unless-stopped
|
|
environment:
|
|
- APP_ENV=production
|
|
- DATABASE_URL=postgresql+asyncpg://${DB_USER}:${DB_PASSWORD}@db:5432/${DB_NAME}
|
|
- SECRET_KEY=${SECRET_KEY}
|
|
- JWT_PRIVATE_KEY_PATH=/app/keys/private.pem
|
|
- JWT_PUBLIC_KEY_PATH=/app/keys/public.pem
|
|
- LDAP_ENABLED=${LDAP_ENABLED:-false}
|
|
- LDAP_URI=${LDAP_URI}
|
|
- LDAP_BIND_DN=${LDAP_BIND_DN}
|
|
- LDAP_BIND_PASSWORD=${LDAP_BIND_PASSWORD}
|
|
- LDAP_USER_SEARCH_BASE=${LDAP_USER_SEARCH_BASE}
|
|
- LDAP_USER_FILTER=${LDAP_USER_FILTER}
|
|
- LOG_LEVEL=${LOG_LEVEL:-INFO}
|
|
- LOG_FORMAT=json
|
|
volumes:
|
|
- ./data:/app/data
|
|
- ./keys:/app/keys:ro
|
|
- ./certs:/app/certs:ro
|
|
networks:
|
|
- internal
|
|
- traefik-public
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '1.0'
|
|
memory: 1G
|
|
reservations:
|
|
cpus: '0.25'
|
|
memory: 256M
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 20s
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=traefik-public"
|
|
- "traefik.http.routers.updater-api.rule=Host(`${DOMAIN}`) && PathPrefix(`/api`)"
|
|
- "traefik.http.routers.updater-api.entrypoints=websecure"
|
|
- "traefik.http.routers.updater-api.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.updater-api.loadbalancer.server.port=8000"
|
|
|
|
# ---------------------------------------------------------------
|
|
# Frontend - Nginx (Production)
|
|
# ---------------------------------------------------------------
|
|
frontend:
|
|
build:
|
|
context: ./frontend
|
|
dockerfile: Dockerfile
|
|
target: production
|
|
container_name: insight-updater-frontend
|
|
restart: unless-stopped
|
|
networks:
|
|
- internal
|
|
- traefik-public
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=traefik-public"
|
|
- "traefik.http.routers.updater-web.rule=Host(`${DOMAIN}`)"
|
|
- "traefik.http.routers.updater-web.entrypoints=websecure"
|
|
- "traefik.http.routers.updater-web.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.updater-web.loadbalancer.server.port=80"
|
|
|
|
# ---------------------------------------------------------------
|
|
# PostgreSQL - Production Database
|
|
# ---------------------------------------------------------------
|
|
db:
|
|
image: postgres:16-alpine
|
|
container_name: insight-updater-db
|
|
restart: unless-stopped
|
|
environment:
|
|
- POSTGRES_DB=${DB_NAME}
|
|
- POSTGRES_USER=${DB_USER}
|
|
- POSTGRES_PASSWORD=${DB_PASSWORD}
|
|
volumes:
|
|
- pg-data:/var/lib/postgresql/data
|
|
networks:
|
|
- internal
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${DB_USER}"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 3
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.5'
|
|
memory: 512M
|
|
|
|
networks:
|
|
internal:
|
|
driver: bridge
|
|
traefik-public:
|
|
external: true
|
|
|
|
volumes:
|
|
pg-data: |