feat: 品牌统一 LokiStack + 全站中英 i18n + 用户批量删除 + 主题定时切换与浅色侧栏
- 品牌: Go 模块/数据文件/二进制/构建部署资产全部 opsx→lokistack;前端 localStorage 命名空间迁移(读旧写新,含按用户 id 前缀迁移);修复 nginx upstream 与 Makefile 引用已改名服务的断裂 - i18n: react-i18next 落地,common + 11 个页面域命名空间全站中英(菜单/顶栏/登录/列表页/表单/确认弹窗/状态徽章);设置页语言即时切换;修复词典自注册导致的循环导入白屏 - 用户管理: 批量删除(POST /users/batch-delete,不删自己/最后管理员,部分失败不阻断)+ 行复选/全选/批量工具条 - 主题: 浅色侧栏(中性灰激活态)、四态模式(浅色/深色/跟随系统/定时切换,按时区判定)、顶栏太阳月亮二态、设置页紧凑分段选择器 - UI: 登录记住用户名、CardActionButton 统一五页卡片操作钮、shadcn Badge 替换手写徽章、语义色修正 - 清理: 移除主机 Web 终端(前后端)、k8s-helm/Helm 遗留代码与字段、README 重写精简 - 修复: 侧栏与日志告警 order 重复、路由标题 i18n key 未翻译、词典双逗号等
This commit is contained in:
1 parent
02d1bd87a7
commit
f3733f0bfc
201 files changed
+5438
-2388
No files matched your search
+17
-17
@@ -1,8 +1,8 @@
|
||||
# ============================================================
|
||||
# opsx-loki - Secure Multi-Stage Dockerfile
|
||||
# lokistack - Secure Multi-Stage Dockerfile
|
||||
# ============================================================
|
||||
# P0 Fixes:
|
||||
# - Non-root user (opsxloki:1000)
|
||||
# - Non-root user (lokistack:1000)
|
||||
# - No hardcoded JWT_SECRET (validated at runtime)
|
||||
# - HEALTHCHECK instruction added
|
||||
# - Binary installation verification
|
||||
@@ -47,7 +47,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
|
||||
-trimpath \
|
||||
-a -installsuffix cgo \
|
||||
-ldflags="-s -w -extldflags '-static'" \
|
||||
-o bin/opsxloki .
|
||||
-o bin/lokistack .
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
# Stage 3: Final Runtime Image
|
||||
@@ -68,26 +68,26 @@ RUN apk --no-cache add \
|
||||
# ---------------------------------------------------------------
|
||||
# P0: Create non-root user and group
|
||||
# ---------------------------------------------------------------
|
||||
RUN addgroup -g 1000 opsxloki && \
|
||||
adduser -u 1000 -G opsxloki -s /bin/sh -D opsxloki
|
||||
RUN addgroup -g 1000 lokistack && \
|
||||
adduser -u 1000 -G lokistack -s /bin/sh -D lokistack
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
# Working directory with proper ownership
|
||||
# ---------------------------------------------------------------
|
||||
WORKDIR /app
|
||||
RUN chown opsxloki:opsxloki /app
|
||||
RUN chown lokistack:lokistack /app
|
||||
|
||||
# ---- Copy application files with correct ownership (P1) ----
|
||||
COPY --from=frontend-builder --chown=opsxloki:opsxloki /app/frontend/dist ./dist
|
||||
COPY --from=backend-builder --chown=opsxloki:opsxloki /app/backend/bin/opsxloki ./opsxloki
|
||||
COPY --from=frontend-builder --chown=lokistack:lokistack /app/frontend/dist ./dist
|
||||
COPY --from=backend-builder --chown=lokistack:lokistack /app/backend/bin/lokistack ./lokistack
|
||||
|
||||
# Create data directory with non-root ownership
|
||||
RUN mkdir -p /app/data && chown -R opsxloki:opsxloki /app/data
|
||||
RUN mkdir -p /app/data && chown -R lokistack:lokistack /app/data
|
||||
|
||||
# Create .kube directory for non-root user (P0: not /root/.kube)
|
||||
RUN mkdir -p /home/opsxloki/.kube && \
|
||||
chown -R opsxloki:opsxloki /home/opsxloki && \
|
||||
chmod 700 /home/opsxloki/.kube
|
||||
RUN mkdir -p /home/lokistack/.kube && \
|
||||
chown -R lokistack:lokistack /home/lokistack && \
|
||||
chmod 700 /home/lokistack/.kube
|
||||
|
||||
# ---- Security hardening: remove unnecessary tools ----
|
||||
RUN rm -rf /tmp/* /var/cache/apk/*
|
||||
@@ -97,15 +97,15 @@ RUN rm -rf /tmp/* /var/cache/apk/*
|
||||
# ---------------------------------------------------------------
|
||||
ENV DATA_DIR=/app/data
|
||||
ENV SERVER_PORT=8080
|
||||
ENV KUBECONFIG=/home/opsxloki/.kube/config
|
||||
ENV HOME=/home/opsxloki
|
||||
ENV KUBECONFIG=/home/lokistack/.kube/config
|
||||
ENV HOME=/home/lokistack
|
||||
|
||||
# NOTE: JWT_SECRET and ENCRYPTION_KEY are NOT set here.
|
||||
# They MUST be provided at runtime via docker-compose env or secrets.
|
||||
# The entrypoint script will enforce this requirement.
|
||||
|
||||
# ---- Copy and configure entrypoint script ----
|
||||
COPY --chown=opsxloki:opsxloki docker-entrypoint.sh /usr/local/bin/
|
||||
COPY --chown=lokistack:lokistack docker-entrypoint.sh /usr/local/bin/
|
||||
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
||||
|
||||
EXPOSE 8080
|
||||
@@ -120,7 +120,7 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
||||
# ---------------------------------------------------------------
|
||||
# P0: Switch to non-root user
|
||||
# ---------------------------------------------------------------
|
||||
USER opsxloki
|
||||
USER lokistack
|
||||
|
||||
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|
||||
CMD ["./opsxloki"]
|
||||
CMD ["./lokistack"]
|
||||
Reference in new issue
Block a user