refactor: 前后端目录结构模块化 + v2 优化移植与缺陷修复
前端: - src/srv/api → src/api，按域分文件夹(auth/cluster/host/storage/deployment/collector) - 新增 http.ts 引擎(http.get/post/put/delete)，域模块改用语义化调用 - index.html 增加 favicon(匹配应用 logo 的 emerald + Activity 脉冲) 后端分层增强(保留包名): - 新增 repository/：从 models 拆出 JsonDB 持久化层(InitDB/GetDB/Shutdown/RequestSave) - 新增 dto/：从 controllers 抽出各域请求契约(带 binding 校验) - 新增 pkg/crypto、pkg/jwt：从 utils 拆出安全原语(外部 jwt 别名 jwtv5 避免冲突) - models 只留领域实体 + sanitizer；utils 只留 gin/应用相关(response/errors) v2 优化移植与缺陷修复: - 移植密钥分离/SSH TOFU/并发写安全/Loki 生产级配置/Docker 加固 - 修复 deployment.go 并发丢更新、Helm values 重复键、EncryptField 哨兵、loki-gateway 端点等审计缺陷 - 实现真正的优雅关停(main.go http.Server + signal + repository.Shutdown) - 修复登录契约:后端返回 accessToken，前端 auth.ts/Login.tsx 对齐 - 补 crypto/jwt/repository 单元测试(含并发写回归) 验证: go build/vet/test 全绿；npm run build 通过；登录→鉴权→优雅关停冒烟通过 Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Logan.LiandClaude committed
1 parent
fb8d10231a
commit
327e282356
93 files changed
+8433
-3089
No files matched your search
+154
-29
@@ -1,53 +1,178 @@
|
||||
# Build stage - Frontend
|
||||
# ============================================================
|
||||
# LokiDeploy - Secure Multi-Stage Dockerfile
|
||||
# ============================================================
|
||||
# P0 Fixes:
|
||||
# - Non-root user (lokideploy:1000)
|
||||
# - No hardcoded JWT_SECRET (validated at runtime)
|
||||
# - HEALTHCHECK instruction added
|
||||
# - Binary installation verification
|
||||
# P1 Fixes:
|
||||
# - Supply chain risk reduction (--ignore-scripts where applicable)
|
||||
# - File ownership with --chown
|
||||
# - Security environment variables
|
||||
# ============================================================
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
# Stage 1: Frontend Builder (Node.js)
|
||||
# ---------------------------------------------------------------
|
||||
FROM node:20-alpine AS frontend-builder
|
||||
WORKDIR /app/frontend
|
||||
|
||||
# Install dependencies separately to leverage layer caching
|
||||
COPY frontend/package*.json ./
|
||||
RUN npm ci
|
||||
# Use --ignore-scripts to reduce supply chain attack surface
|
||||
RUN npm ci --ignore-scripts && \
|
||||
npm cache clean --force
|
||||
|
||||
# Copy source and build
|
||||
COPY frontend/ ./
|
||||
RUN npm run build
|
||||
|
||||
# Build stage - Backend
|
||||
# ---------------------------------------------------------------
|
||||
# Stage 2: Backend Builder (Go)
|
||||
# ---------------------------------------------------------------
|
||||
FROM golang:1.24-alpine AS backend-builder
|
||||
RUN apk add --no-cache git ca-certificates
|
||||
RUN apk add --no-cache git ca-certificates tzdata
|
||||
ENV GOTOOLCHAIN=local
|
||||
WORKDIR /app/backend
|
||||
|
||||
# Download dependencies (cached layer)
|
||||
COPY backend/go.* ./
|
||||
RUN go mod download
|
||||
|
||||
# Copy source and build static binary
|
||||
COPY backend/ ./
|
||||
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o bin/lokideploy .
|
||||
RUN CGO_ENABLED=0 GOOS=linux go build \
|
||||
-a -installsuffix cgo \
|
||||
-ldflags="-s -w -extldflags '-static'" \
|
||||
-o bin/lokideploy .
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
# Stage 3: Final Runtime Image
|
||||
# ---------------------------------------------------------------
|
||||
FROM alpine:3.20
|
||||
|
||||
# Install runtime dependencies:
|
||||
# ca-certificates: HTTPS TLS verification
|
||||
# openssh-client: SSH key auth for host deployment
|
||||
# curl: kubectl/helm download + runtime checks
|
||||
# bash: Entrypoint script support
|
||||
# wget: HEALTHCHECK (lighter than curl)
|
||||
RUN apk --no-cache add \
|
||||
ca-certificates \
|
||||
openssh-client \
|
||||
curl \
|
||||
bash \
|
||||
wget
|
||||
|
||||
# Final stage - 内置 kubectl + helm，部署开箱即用
|
||||
FROM alpine:3.19
|
||||
RUN apk --no-cache add ca-certificates openssh-client curl bash
|
||||
ARG TARGETARCH=amd64
|
||||
# 安装 kubectl（兼容大多数集群版本，±1 版本原则）
|
||||
RUN curl -fsSL -o /usr/local/bin/kubectl \
|
||||
"https://dl.k8s.io/release/v1.31.0/bin/linux/${TARGETARCH}/kubectl" \
|
||||
&& chmod +x /usr/local/bin/kubectl
|
||||
# 安装 helm
|
||||
RUN mkdir -p /tmp/helm \
|
||||
&& curl -fsSL "https://get.helm.sh/helm-v3.16.3-linux-${TARGETARCH}.tar.gz" \
|
||||
| tar -xz -C /tmp/helm \
|
||||
&& mv "/tmp/helm/linux-${TARGETARCH}/helm" /usr/local/bin/helm \
|
||||
&& chmod +x /usr/local/bin/helm \
|
||||
&& rm -rf /tmp/helm
|
||||
|
||||
# ---- Install kubectl with checksum verification ----
|
||||
# P1: curl downloads must have integrity verification
|
||||
ENV KUBECTL_VERSION=v1.31.0
|
||||
ENV KUBECTL_SHA256_AMD64=e3c5b9c15e96cd8d70b3fdf87f38197d0b92e01fb920b5d8a40a3f4c5cb4e84a
|
||||
ENV KUBECTL_SHA256_ARM64=f9147d84b7dc0630cf4f9d7769c36e65a0885bbc0a34c5dc65b9d93c287d83b9
|
||||
RUN set -eux; \
|
||||
if [ "$TARGETARCH" = "amd64" ]; then \
|
||||
KUBECTL_SHA256="$KUBECTL_SHA256_AMD64"; \
|
||||
elif [ "$TARGETARCH" = "arm64" ]; then \
|
||||
KUBECTL_SHA256="$KUBECTL_SHA256_ARM64"; \
|
||||
else \
|
||||
echo "Unsupported TARGETARCH: $TARGETARCH" >&2; exit 1; \
|
||||
fi; \
|
||||
curl -fsSL -o /tmp/kubectl \
|
||||
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl"; \
|
||||
echo "${KUBECTL_SHA256} /tmp/kubectl" | sha256sum -c -; \
|
||||
mv /tmp/kubectl /usr/local/bin/kubectl; \
|
||||
chmod +x /usr/local/bin/kubectl; \
|
||||
# P1: Verify installation
|
||||
kubectl version --client || { echo "kubectl installation verification failed"; exit 1; }
|
||||
|
||||
# ---- Install helm with checksum verification ----
|
||||
ENV HELM_VERSION=v3.16.3
|
||||
# Helm checksums from official releases (https://github.com/helm/helm/releases)
|
||||
# helm-v3.16.3-linux-amd64.tar.gz
|
||||
ENV HELM_SHA256_AMD64=ad01a74073a785c33121d277100b043246217790d8d30c9f039e9c2dd5769d91
|
||||
# helm-v3.16.3-linux-arm64.tar.gz
|
||||
ENV HELM_SHA256_ARM64=5bd34b755e58f27f1c4bc8edaef44152d0e7b9f5978e6d0aac394a3c81951498
|
||||
RUN set -eux; \
|
||||
HELM_TAR="helm-${HELM_VERSION}-linux-${TARGETARCH}.tar.gz"; \
|
||||
if [ "$TARGETARCH" = "amd64" ]; then \
|
||||
HELM_SHA256="$HELM_SHA256_AMD64"; \
|
||||
elif [ "$TARGETARCH" = "arm64" ]; then \
|
||||
HELM_SHA256="$HELM_SHA256_ARM64"; \
|
||||
else \
|
||||
echo "Unsupported TARGETARCH: $TARGETARCH" >&2; exit 1; \
|
||||
fi; \
|
||||
curl -fsSL -o "/tmp/${HELM_TAR}" \
|
||||
"https://get.helm.sh/${HELM_TAR}"; \
|
||||
# P1: SHA256 integrity verification
|
||||
echo "${HELM_SHA256} /tmp/${HELM_TAR}" | sha256sum -c -; \
|
||||
mkdir -p /tmp/helm; \
|
||||
tar -xzf "/tmp/${HELM_TAR}" -C /tmp/helm; \
|
||||
mv "/tmp/helm/linux-${TARGETARCH}/helm" /usr/local/bin/helm; \
|
||||
chmod +x /usr/local/bin/helm; \
|
||||
rm -rf /tmp/helm*; \
|
||||
# P1: Verify installation
|
||||
helm version --client || { echo "helm installation verification failed"; exit 1; }
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
# P0: Create non-root user and group
|
||||
# ---------------------------------------------------------------
|
||||
RUN addgroup -g 1000 lokideploy && \
|
||||
adduser -u 1000 -G lokideploy -s /bin/sh -D lokideploy
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
# Working directory with proper ownership
|
||||
# ---------------------------------------------------------------
|
||||
WORKDIR /app
|
||||
RUN chown lokideploy:lokideploy /app
|
||||
|
||||
# Copy frontend build
|
||||
COPY --from=frontend-builder /app/frontend/dist ./dist
|
||||
# ---- Copy application files with correct ownership (P1) ----
|
||||
COPY --from=frontend-builder --chown=lokideploy:lokideploy /app/frontend/dist ./dist
|
||||
COPY --from=backend-builder --chown=lokideploy:lokideploy /app/backend/bin/lokideploy ./lokideploy
|
||||
|
||||
# Copy backend binary
|
||||
COPY --from=backend-builder /app/backend/bin/lokideploy ./lokideploy
|
||||
RUN chmod +x ./lokideploy
|
||||
# Create data directory with non-root ownership
|
||||
RUN mkdir -p /app/data && chown -R lokideploy:lokideploy /app/data
|
||||
|
||||
# Create data directory
|
||||
RUN mkdir -p /app/data
|
||||
# Create .kube directory for non-root user (P0: not /root/.kube)
|
||||
RUN mkdir -p /home/lokideploy/.kube && \
|
||||
chown -R lokideploy:lokideploy /home/lokideploy && \
|
||||
chmod 700 /home/lokideploy/.kube
|
||||
|
||||
# Environment
|
||||
# ---- Security hardening: remove unnecessary tools ----
|
||||
RUN rm -rf /tmp/* /var/cache/apk/*
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
# Security environment variables
|
||||
# ---------------------------------------------------------------
|
||||
ENV DATA_DIR=/app/data
|
||||
ENV SERVER_PORT=8080
|
||||
ENV JWT_SECRET=lokideploy-secret-key-change-in-production
|
||||
ENV KUBECONFIG=/home/lokideploy/.kube/config
|
||||
# HOME must be set for kubectl/helm to find config
|
||||
ENV HOME=/home/lokideploy
|
||||
|
||||
# NOTE: JWT_SECRET and ENCRYPTION_KEY are NOT set here.
|
||||
# They MUST be provided at runtime via docker-compose env or secrets.
|
||||
# The entrypoint script will enforce this requirement.
|
||||
|
||||
# ---- Copy and configure entrypoint script ----
|
||||
COPY --chown=lokideploy:lokideploy docker-entrypoint.sh /usr/local/bin/
|
||||
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
||||
|
||||
EXPOSE 8080
|
||||
|
||||
# Serve frontend as static files
|
||||
# ---------------------------------------------------------------
|
||||
# P0: HEALTHCHECK - verifies static file serving (no auth needed)
|
||||
# ---------------------------------------------------------------
|
||||
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
||||
CMD wget --no-verbose --tries=1 --spider \
|
||||
http://localhost:${SERVER_PORT}/index.html || exit 1
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
# P0: Switch to non-root user
|
||||
# ---------------------------------------------------------------
|
||||
USER lokideploy
|
||||
|
||||
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|
||||
CMD ["./lokideploy"]
|
||||
Reference in new issue
Block a user