feat: 品牌统一 LokiStack + 全站中英 i18n + 用户批量删除 + 主题定时切换与浅色侧栏

- 品牌: Go 模块/数据文件/二进制/构建部署资产全部 opsx→lokistack;前端 localStorage 命名空间迁移(读旧写新,含按用户 id 前缀迁移);修复 nginx upstream 与 Makefile 引用已改名服务的断裂
- i18n: react-i18next 落地,common + 11 个页面域命名空间全站中英(菜单/顶栏/登录/列表页/表单/确认弹窗/状态徽章);设置页语言即时切换;修复词典自注册导致的循环导入白屏
- 用户管理: 批量删除(POST /users/batch-delete,不删自己/最后管理员,部分失败不阻断)+ 行复选/全选/批量工具条
- 主题: 浅色侧栏(中性灰激活态)、四态模式(浅色/深色/跟随系统/定时切换,按时区判定)、顶栏太阳月亮二态、设置页紧凑分段选择器
- UI: 登录记住用户名、CardActionButton 统一五页卡片操作钮、shadcn Badge 替换手写徽章、语义色修正
- 清理: 移除主机 Web 终端(前后端)、k8s-helm/Helm 遗留代码与字段、README 重写精简
- 修复: 侧栏与日志告警 order 重复、路由标题 i18n key 未翻译、词典双逗号等
This commit is contained in:
opsx committed 2026-10-27 17:11:38 +08:00
1 parent 02d1bd87a7
commit f3733f0bfc
201 files changed
+5438 -2388

No files matched your search

+17 -17
View File
@@ -1,8 +1,8 @@
# ============================================================
# opsx-loki - Secure Multi-Stage Dockerfile
# lokistack - Secure Multi-Stage Dockerfile
# ============================================================
# P0 Fixes:
# - Non-root user (opsxloki:1000)
# - Non-root user (lokistack:1000)
# - No hardcoded JWT_SECRET (validated at runtime)
# - HEALTHCHECK instruction added
# - Binary installation verification
@@ -47,7 +47,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
-trimpath \
-a -installsuffix cgo \
-ldflags="-s -w -extldflags '-static'" \
-o bin/opsxloki .
-o bin/lokistack .
# ---------------------------------------------------------------
# Stage 3: Final Runtime Image
@@ -68,26 +68,26 @@ RUN apk --no-cache add \
# ---------------------------------------------------------------
# P0: Create non-root user and group
# ---------------------------------------------------------------
RUN addgroup -g 1000 opsxloki && \
adduser -u 1000 -G opsxloki -s /bin/sh -D opsxloki
RUN addgroup -g 1000 lokistack && \
adduser -u 1000 -G lokistack -s /bin/sh -D lokistack
# ---------------------------------------------------------------
# Working directory with proper ownership
# ---------------------------------------------------------------
WORKDIR /app
RUN chown opsxloki:opsxloki /app
RUN chown lokistack:lokistack /app
# ---- Copy application files with correct ownership (P1) ----
COPY --from=frontend-builder --chown=opsxloki:opsxloki /app/frontend/dist ./dist
COPY --from=backend-builder --chown=opsxloki:opsxloki /app/backend/bin/opsxloki ./opsxloki
COPY --from=frontend-builder --chown=lokistack:lokistack /app/frontend/dist ./dist
COPY --from=backend-builder --chown=lokistack:lokistack /app/backend/bin/lokistack ./lokistack
# Create data directory with non-root ownership
RUN mkdir -p /app/data && chown -R opsxloki:opsxloki /app/data
RUN mkdir -p /app/data && chown -R lokistack:lokistack /app/data
# Create .kube directory for non-root user (P0: not /root/.kube)
RUN mkdir -p /home/opsxloki/.kube && \
chown -R opsxloki:opsxloki /home/opsxloki && \
chmod 700 /home/opsxloki/.kube
RUN mkdir -p /home/lokistack/.kube && \
chown -R lokistack:lokistack /home/lokistack && \
chmod 700 /home/lokistack/.kube
# ---- Security hardening: remove unnecessary tools ----
RUN rm -rf /tmp/* /var/cache/apk/*
@@ -97,15 +97,15 @@ RUN rm -rf /tmp/* /var/cache/apk/*
# ---------------------------------------------------------------
ENV DATA_DIR=/app/data
ENV SERVER_PORT=8080
ENV KUBECONFIG=/home/opsxloki/.kube/config
ENV HOME=/home/opsxloki
ENV KUBECONFIG=/home/lokistack/.kube/config
ENV HOME=/home/lokistack
# NOTE: JWT_SECRET and ENCRYPTION_KEY are NOT set here.
# They MUST be provided at runtime via docker-compose env or secrets.
# The entrypoint script will enforce this requirement.
# ---- Copy and configure entrypoint script ----
COPY --chown=opsxloki:opsxloki docker-entrypoint.sh /usr/local/bin/
COPY --chown=lokistack:lokistack docker-entrypoint.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
EXPOSE 8080
@@ -120,7 +120,7 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
# ---------------------------------------------------------------
# P0: Switch to non-root user
# ---------------------------------------------------------------
USER opsxloki
USER lokistack
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
CMD ["./opsxloki"]
CMD ["./lokistack"]