Logan.Li
0b16488029
- multi-stage root Dockerfile (opsx-loki pattern): frontend dist + go binary + gh-ost in one alpine image, non-root user, HEALTHCHECK, entrypoint warning for missing SECRET_KEY; gin now serves the SPA from DIST_DIR (asset/db-logos/favicon passthrough, /api returns JSON 404, SPA fallback to index.html) - one origin, no CORS surface - docker-compose.yml rewritten: single service, named data volume, no-new-privileges + cap_drop ALL, /health healthcheck, resource limits, log rotation; SECRET_KEY required (openssl rand -hex 32), JWT_SECRET optional (auto-generated and persisted in prod) - kubernetes/: install.sh one-command deploy (idempotent secret reuse, --nodeport/--ingress flags, rollout wait, backup tips) plus namespace/secret/pvc/deployment(single replica + Recreate, probes, resource limits, non-root)/service/nodeport/ingress manifests and README (sqlite single-writer constraints, snapshot backup) - docs: README quick-start now has 3 deployment paths; ARCHITECTURE ch.14 expanded single-image runtime verified locally (SPA/assets/api/login coexist on :9002); full image build left to server (docker hub unreachable from this machine)
21 lines
927 B
Bash
Executable File
21 lines
927 B
Bash
Executable File
#!/bin/sh
|
|
# opsxsql 容器入口(参照 opsx-loki):
|
|
# - 生产(DEBUG=false)缺 SECRET_KEY 时告警(AES 加密数据与密钥绑定,换密钥已存密文不可解)
|
|
# - JWT_SECRET 未显式提供时,后端会在生产模式自动生成随机密钥并持久化到 /app/data
|
|
set -e
|
|
|
|
if [ "${DEBUG:-false}" != "true" ]; then
|
|
if [ -z "${SECRET_KEY:-}" ]; then
|
|
echo "[entrypoint] 警告: 未设置 SECRET_KEY,使用内置默认密钥(AES 加密实例/LDAP 密码)。" >&2
|
|
echo "[entrypoint] 生产环境建议: export SECRET_KEY=\$(openssl rand -hex 32) 后重建容器;" >&2
|
|
echo "[entrypoint] 注意: 更换 SECRET_KEY 会导致已加密的实例/LDAP 密码无法解密,请首次部署即固定。" >&2
|
|
fi
|
|
if [ -z "${JWT_SECRET:-}" ]; then
|
|
echo "[entrypoint] 提示: 未设置 JWT_SECRET,生产模式将自动生成随机密钥并持久化到数据卷。" >&2
|
|
fi
|
|
fi
|
|
|
|
mkdir -p /app/data
|
|
|
|
exec ./opsxsql
|