logan
f9c6c1d826
基于 WEB-UI-Development-Guide 标准的整体升级,并更名 LokiDeploy → opsx-loki。 前端(Gin+React+shadcn/ui): - 按 02/07 章重构:页面域化拆分(无超 400 行文件)、PageContainer/ListQuery、 反馈分级(成功静默/失败 toast/危险确认)、401 单飞刷新+队列重放 - 暗色模式(next-themes)+ 语义 Token(--primary 品牌色/success/warning/info) - 部署向导(状态推导四步:环境→存储→Loki→采集,内嵌表单闭环) - 日志查询页:LogQL 标签构建器/拖拽直方图/日志上下文/Live Tail/查询历史 - 按用户+标签策略的查询授权(服务端强制合并策略) 后端(Go+Gin+JSON DB): - 简单用户管理(仅 admin,无 RBAC)+ TokenVersion 会话吊销 + 登录 IP 限流 - LDAP 接入:配置(AES 加密存储/hasPassword 脱敏)/测试连接/批量导入/登录 - 存储配置测试连接(SigV4 零依赖)+ 桶不存在自动创建 - Loki 三模式部署修复:SSH 密钥认证、3.x 配置模板、ruler 对象存储嵌套块、 凭证解密、孤儿 deploying 状态恢复、Grafana 部署(可选默认关)+面板导入 - DaemonSet 采集纯 YAML(去 helm 依赖)+ DNS 自愈回退 ClusterIP + 集群名标签 - 日志查询代理:cluster-svc 经 kube-apiserver proxy/url 直连 + cursor 翻页 - 统一 log 命名空间;部署就绪探活;Grafana 访问地址自动记录 修复:run.sh 增量编译检测、Sanitized 脱敏补全、LokiDeployment Update 白名单、 健康检查 CreatedAt 零值等 10+ 存量 bug。 数据兼容:DB 沿用旧 lokideploy.json(新名优先);localStorage 一次性迁移; HKDF 加密前缀保留(已加密凭证不受影响)。
116 lines
3.4 KiB
YAML
116 lines
3.4 KiB
YAML
# ============================================================
|
|
# opsx-loki - Development Docker Compose Configuration
|
|
# ============================================================
|
|
# P0 Fixes:
|
|
# - Non-root kubeconfig mount (/home/opsxloki/.kube)
|
|
# - Healthcheck for orchestration visibility
|
|
# - Resource limits to prevent noisy-neighbor
|
|
# - security_opt: no-new-privileges
|
|
# - Log rotation (json-file driver)
|
|
# - Named volumes instead of bind mounts
|
|
# P1 Fixes:
|
|
# - Restart policy optimization
|
|
# - Network isolation
|
|
# ============================================================
|
|
|
|
services:
|
|
opsxloki:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
args:
|
|
TARGETARCH: ${TARGETARCH:-amd64}
|
|
image: opsxloki:v2
|
|
container_name: opsxloki
|
|
hostname: opsxloki
|
|
|
|
# ---- P0: Security options ----
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
# Required for healthcheck (wget) and runtime operations
|
|
- NET_BIND_SERVICE
|
|
# Required for file operations in /app/data
|
|
- CHOWN
|
|
- SETGID
|
|
- SETUID
|
|
read_only: false # Dev mode needs writable /app/data
|
|
|
|
ports:
|
|
- "${SERVER_PORT:-8080}:8080"
|
|
|
|
# ---- P0: Named volumes for data persistence ----
|
|
volumes:
|
|
- opsxloki-data:/app/data
|
|
# P0: Mount kubeconfig to non-root user directory
|
|
- ${KUBECONFIG_PATH:-${HOME}/.kube}:/home/opsxloki/.kube:ro
|
|
# SSH keys for host-based deployments
|
|
- ${SSH_KEY_PATH:-${HOME}/.ssh}:/home/opsxloki/.ssh:ro
|
|
|
|
# ---- P0: Environment variables (no default secrets) ----
|
|
environment:
|
|
- SERVER_PORT=8080
|
|
- DATA_DIR=/app/data
|
|
# P0: JWT_SECRET must be provided externally
|
|
# Set via .env file or shell export before running docker compose up.
|
|
# 注意：错误提示里不要内嵌 $(openssl ...)，否则会在 compose 解析时被执行。
|
|
- "JWT_SECRET=${JWT_SECRET:?JWT_SECRET is required. Generate: openssl rand -hex 32, then: export JWT_SECRET=<value>}"
|
|
# P0: ENCRYPTION_KEY must be provided externally (AES-256, >=32 字符)
|
|
- "ENCRYPTION_KEY=${ENCRYPTION_KEY:?ENCRYPTION_KEY is required. Generate: openssl rand -hex 32, then: export ENCRYPTION_KEY=<value>}"
|
|
# KUBECONFIG points to non-root user's .kube directory
|
|
- KUBECONFIG=/home/opsxloki/.kube/config
|
|
|
|
# ---- P0: Healthcheck ----
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/index.html"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 15s
|
|
|
|
# ---- P0: Resource limits ----
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2.0'
|
|
memory: 512M
|
|
pids: 100
|
|
reservations:
|
|
cpus: '0.25'
|
|
memory: 64M
|
|
|
|
# ---- P0: Log rotation ----
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "50m"
|
|
max-file: "5"
|
|
labels: "service,image"
|
|
env: "SERVER_PORT,DATA_DIR"
|
|
|
|
# ---- P1: Restart policy ----
|
|
restart: unless-stopped
|
|
stop_grace_period: 15s
|
|
|
|
networks:
|
|
- opsxloki-net
|
|
|
|
# ---- Named volumes ----
|
|
volumes:
|
|
opsxloki-data:
|
|
driver: local
|
|
labels:
|
|
- "com.opsxloki.description=opsx-loki data directory"
|
|
|
|
# ---- Network isolation ----
|
|
networks:
|
|
opsxloki-net:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.28.0.0/16
|
|
labels:
|
|
- "com.opsxloki.description=opsx-loki internal network"
|