mirror of
https://github.com/koala73/worldmonitor.git
synced 2026-04-25 17:14:57 +02:00
f4183f99c7
* feat: self-hosted Docker stack with nginx, Redis REST proxy, and seeders
Multi-stage Docker build: esbuild TS handler compilation, vite frontend
build, nginx + Node.js API under supervisord. Upstash-compatible Redis
REST proxy with command allowlist for security. AIS relay WebSocket
sidecar. Seeder wrapper script with auto-sourced env vars from
docker-compose.override.yml. Self-hosting guide with architecture
diagram, API key setup, and troubleshooting.
Security: Redis proxy command allowlist (blocks FLUSHALL/CONFIG/EVAL),
nginx security headers (X-Content-Type-Options, X-Frame-Options,
Referrer-Policy), non-root container user.
* feat(docker): add Docker secrets support for API keys
Entrypoint reads /run/secrets/* files and exports as env vars at
startup. Secrets take priority over environment block values and
stay out of docker inspect / process metadata.
Both methods (env vars and secrets) work simultaneously.
* fix(docker): point supervisord at templated nginx config
The entrypoint runs envsubst on nginx.conf.template and writes
the result to /tmp/nginx.conf (with LOCAL_API_PORT substituted
and listening on port 8080 for non-root). But supervisord was
still launching nginx with /etc/nginx/nginx.conf — the default
Alpine config that listens on port 80, which fails with
"Permission denied" under the non-root appuser.
* fix(docker): remove KEYS from Redis allowlist, fix nginx header inheritance, add LLM vars to seeders
- Remove KEYS from redis-rest-proxy allowlist (O(N) blocking, Redis DoS risk)
- Move security headers into each nginx location block to prevent add_header
inheritance suppression
- Add LLM_API_URL / LLM_API_KEY / LLM_MODEL to run-seeders.sh grep filter
so LLM API keys set in docker-compose.override.yml are forwarded to seed scripts
* fix(docker): add path-based POST to Redis proxy, expand allowlist, add missing seeder secrets
- Add POST /{command}/{args...} handler to redis-rest-proxy so Upstash-style
path POSTs work (setCachedJson uses POST /set/<key>/<value>/EX/<ttl>)
- Expand allowlist: HLEN, LTRIM (seed-military-bases, seed-forecasts),
ZREVRANGE (premium-stock-store), ZRANDMEMBER (seed-military-bases)
- Add ACLED_EMAIL, ACLED_PASSWORD, OPENROUTER_API_KEY, OLLAMA_API_URL,
OLLAMA_MODEL to run-seeders.sh so override keys reach host-run seeders
---------
Co-authored-by: Elie Habib <elie.habib@gmail.com>
73 lines
2.7 KiB
Docker
73 lines
2.7 KiB
Docker
# =============================================================================
|
|
# World Monitor — Docker Image
|
|
# =============================================================================
|
|
# Multi-stage build:
|
|
# builder — installs deps, compiles TS handlers, builds Vite frontend
|
|
# final — nginx (static) + node (API) under supervisord
|
|
# =============================================================================
|
|
|
|
# ── Stage 1: Builder ─────────────────────────────────────────────────────────
|
|
FROM node:22-alpine AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
# Install root dependencies (layer-cached until package.json changes)
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci --ignore-scripts
|
|
|
|
# Copy full source
|
|
COPY . .
|
|
|
|
# Compile TypeScript API handlers → self-contained ESM bundles
|
|
# Output is api/**/*.js alongside the source .ts files
|
|
RUN node docker/build-handlers.mjs
|
|
|
|
# Build Vite frontend (outputs to dist/)
|
|
# Skip blog build — blog-site has its own deps not installed here
|
|
RUN npx tsc && npx vite build
|
|
|
|
# ── Stage 2: Runtime ─────────────────────────────────────────────────────────
|
|
FROM node:22-alpine AS final
|
|
|
|
# nginx + supervisord
|
|
RUN apk add --no-cache nginx supervisor gettext && \
|
|
mkdir -p /tmp/nginx-client-body /tmp/nginx-proxy /tmp/nginx-fastcgi \
|
|
/tmp/nginx-uwsgi /tmp/nginx-scgi /var/log/supervisor && \
|
|
addgroup -S appgroup && adduser -S appuser -G appgroup
|
|
|
|
WORKDIR /app
|
|
|
|
# API server
|
|
COPY --from=builder /app/src-tauri/sidecar/local-api-server.mjs ./local-api-server.mjs
|
|
COPY --from=builder /app/src-tauri/sidecar/package.json ./package.json
|
|
|
|
# API handler modules (JS originals + compiled TS bundles)
|
|
COPY --from=builder /app/api ./api
|
|
|
|
# Static data files used by handlers at runtime
|
|
COPY --from=builder /app/data ./data
|
|
|
|
# Built frontend static files
|
|
COPY --from=builder /app/dist /usr/share/nginx/html
|
|
|
|
# Nginx + supervisord configs
|
|
COPY docker/nginx.conf /etc/nginx/nginx.conf.template
|
|
COPY docker/supervisord.conf /etc/supervisor/conf.d/worldmonitor.conf
|
|
COPY docker/entrypoint.sh /app/entrypoint.sh
|
|
RUN chmod +x /app/entrypoint.sh
|
|
|
|
# Ensure writable dirs for non-root
|
|
RUN chown -R appuser:appgroup /app /tmp/nginx-client-body /tmp/nginx-proxy \
|
|
/tmp/nginx-fastcgi /tmp/nginx-uwsgi /tmp/nginx-scgi /var/log/supervisor \
|
|
/var/lib/nginx /var/log/nginx
|
|
|
|
USER appuser
|
|
|
|
EXPOSE 8080
|
|
|
|
# Healthcheck via nginx
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
|
CMD wget -qO- http://localhost:8080/api/health || exit 1
|
|
|
|
CMD ["/app/entrypoint.sh"]
|