mirror of
https://github.com/koala73/worldmonitor.git
synced 2026-04-25 17:14:57 +02:00
f4183f99c7
* feat: self-hosted Docker stack with nginx, Redis REST proxy, and seeders
Multi-stage Docker build: esbuild TS handler compilation, vite frontend
build, nginx + Node.js API under supervisord. Upstash-compatible Redis
REST proxy with command allowlist for security. AIS relay WebSocket
sidecar. Seeder wrapper script with auto-sourced env vars from
docker-compose.override.yml. Self-hosting guide with architecture
diagram, API key setup, and troubleshooting.
Security: Redis proxy command allowlist (blocks FLUSHALL/CONFIG/EVAL),
nginx security headers (X-Content-Type-Options, X-Frame-Options,
Referrer-Policy), non-root container user.
* feat(docker): add Docker secrets support for API keys
Entrypoint reads /run/secrets/* files and exports as env vars at
startup. Secrets take priority over environment block values and
stay out of docker inspect / process metadata.
Both methods (env vars and secrets) work simultaneously.
* fix(docker): point supervisord at templated nginx config
The entrypoint runs envsubst on nginx.conf.template and writes
the result to /tmp/nginx.conf (with LOCAL_API_PORT substituted
and listening on port 8080 for non-root). But supervisord was
still launching nginx with /etc/nginx/nginx.conf — the default
Alpine config that listens on port 80, which fails with
"Permission denied" under the non-root appuser.
* fix(docker): remove KEYS from Redis allowlist, fix nginx header inheritance, add LLM vars to seeders
- Remove KEYS from redis-rest-proxy allowlist (O(N) blocking, Redis DoS risk)
- Move security headers into each nginx location block to prevent add_header
inheritance suppression
- Add LLM_API_URL / LLM_API_KEY / LLM_MODEL to run-seeders.sh grep filter
so LLM API keys set in docker-compose.override.yml are forwarded to seed scripts
* fix(docker): add path-based POST to Redis proxy, expand allowlist, add missing seeder secrets
- Add POST /{command}/{args...} handler to redis-rest-proxy so Upstash-style
path POSTs work (setCachedJson uses POST /set/<key>/<value>/EX/<ttl>)
- Expand allowlist: HLEN, LTRIM (seed-military-bases, seed-forecasts),
ZREVRANGE (premium-stock-store), ZRANDMEMBER (seed-military-bases)
- Add ACLED_EMAIL, ACLED_PASSWORD, OPENROUTER_API_KEY, OLLAMA_API_URL,
OLLAMA_MODEL to run-seeders.sh so override keys reach host-run seeders
---------
Co-authored-by: Elie Habib <elie.habib@gmail.com>
64 lines
1.3 KiB
Plaintext
64 lines
1.3 KiB
Plaintext
node_modules/
|
|
.idea/
|
|
dist/
|
|
public/blog/
|
|
.DS_Store
|
|
*.log
|
|
.env
|
|
.env.local
|
|
.playwright-mcp/
|
|
.vercel
|
|
api/\[domain\]/v1/\[rpc\].js
|
|
api/\[\[...path\]\].js
|
|
.claude/
|
|
.cursor/
|
|
CLAUDE.md
|
|
.env.vercel-backup
|
|
.env.vercel-export
|
|
.agent/
|
|
.factory/
|
|
.windsurf/
|
|
skills/
|
|
ideas/
|
|
docs/internal/
|
|
internal/
|
|
test-results/
|
|
src-tauri/sidecar/node/*
|
|
!src-tauri/sidecar/node/.gitkeep
|
|
|
|
# AI planning session state
|
|
.planning/
|
|
|
|
# Compiled sebuf gateway bundle (built by scripts/build-sidecar-sebuf.mjs)
|
|
api/[[][[].*.js
|
|
|
|
# Compiled sidecar domain handler bundles (built by scripts/build-sidecar-handlers.mjs)
|
|
api/*/v1/\[rpc\].js
|
|
.claudedocs/
|
|
|
|
# Large generated data files (reproduced by scripts/)
|
|
scripts/data/pizzint-processed.json
|
|
scripts/data/osm-military-processed.json
|
|
scripts/data/military-bases-final.json
|
|
scripts/data/dedup-dropped-pairs.json
|
|
scripts/data/pizzint-partial.json
|
|
scripts/data/gpsjam-latest.json
|
|
scripts/data/mirta-raw.geojson
|
|
scripts/data/osm-military-raw.json
|
|
|
|
# Iran events data (sensitive, not for public repo)
|
|
scripts/data/iran-events-latest.json
|
|
|
|
# Military bases rebuild script (references external Supabase URLs)
|
|
scripts/rebuild-military-bases.mjs
|
|
.wrangler
|
|
|
|
# Build artifacts (generated by esbuild/tsc, not source code)
|
|
api/data/city-coords.js
|
|
|
|
# Runtime artifacts (generated by sidecar/tools, not source code)
|
|
api-cache.json
|
|
verbose-mode.json
|
|
skills-lock.json
|
|
tmp/
|