hobokenchicken
130187c7be
P0 fixes: - WebSocket origin checking (reject untrusted origins) - WS session token moved from URL query param to first message frame - WebAuthn login cookie now uses Secure flag via shared SetSessionCookie - PostgreSQL sslmode configurable via POSTGRES_SSLMODE env (default: require) - Fixed DatabaseDSN to use real password instead of masked placeholder P1 fixes: - Per-IP rate limiting middleware (auth: 5 req/s, invites: 2 req/s) - Security headers on all responses (CSP, X-Frame-Options, nosniff, etc.) - WS broadcasts scoped to server members (prevents cross-server data leak) - Webhook tokens stored as SHA-256 hashes (not plaintext) P2 fixes: - CSRF protection via Origin header validation on state-changing requests - MANAGE_CHANNELS permission enforced on channel update/delete - Upload validation: 25MB limit, extension allowlist, server-side MIME check - File serve: path traversal protection + Content-Disposition: attachment Files: 23 changed, +499/-100. Builds clean (go build, go vet, npm build). Zero CVEs (govulncheck, npm audit).
124 lines
3.2 KiB
YAML
124 lines
3.2 KiB
YAML
version: '3.8'
|
|
|
|
services:
|
|
app:
|
|
build:
|
|
context: ..
|
|
dockerfile: docker/Dockerfile
|
|
container_name: dumpster-app
|
|
environment:
|
|
DUMPSTER_HOST: ${DUMPSTER_HOST:-localhost}
|
|
DUMPSTER_PORT: "8080"
|
|
DUMPSTER_SECRET: ${DUMPSTER_SECRET:-}
|
|
POSTGRES_HOST: postgres
|
|
POSTGRES_PORT: "5432"
|
|
POSTGRES_USER: ${POSTGRES_USER:-dumpster}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-dumpster}
|
|
POSTGRES_DB: ${POSTGRES_DB:-dumpster}
|
|
POSTGRES_SSLMODE: ${POSTGRES_SSLMODE:-disable}
|
|
VALKEY_URL: redis://valkey:6379
|
|
MINIO_ENDPOINT: ${MINIO_ENDPOINT:-}
|
|
MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY:-}
|
|
MINIO_SECRET_KEY: ${MINIO_SECRET_KEY:-}
|
|
LIVEKIT_API_KEY: ${LIVEKIT_API_KEY:-devkey}
|
|
LIVEKIT_API_SECRET: ${LIVEKIT_API_SECRET:-secret}
|
|
GIPHY_API_KEY: ${GIPHY_API_KEY:-}
|
|
ports:
|
|
- "8080:8080"
|
|
volumes:
|
|
- web_assets:/srv/web
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
valkey:
|
|
condition: service_healthy
|
|
|
|
postgres:
|
|
image: postgres:16
|
|
container_name: dumpster-postgres
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-dumpster}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-dumpster}
|
|
POSTGRES_DB: ${POSTGRES_DB:-dumpster}
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-dumpster} -d ${POSTGRES_DB:-dumpster}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
valkey:
|
|
image: valkey/valkey:8
|
|
container_name: dumpster-valkey
|
|
volumes:
|
|
- valkey_data:/data
|
|
healthcheck:
|
|
test: ["CMD", "valkey-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 5
|
|
|
|
minio:
|
|
image: minio/minio:latest
|
|
container_name: dumpster-minio
|
|
command: server /data --console-address ":9001"
|
|
environment:
|
|
MINIO_ROOT_USER: ${MINIO_ACCESS_KEY:-dumpster}
|
|
MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY:-dumpster-secret}
|
|
volumes:
|
|
- minio_data:/data
|
|
|
|
livekit:
|
|
image: livekit/livekit-server:latest
|
|
container_name: dumpster-livekit
|
|
command: --config /etc/livekit.yaml
|
|
ports:
|
|
- "7880:7880"
|
|
- "7881:7881"
|
|
- "7882:7882/udp"
|
|
- "50000-50100:50000-50100/udp"
|
|
volumes:
|
|
- ./livekit.yaml:/etc/livekit.yaml:ro
|
|
environment:
|
|
LIVEKIT_KEYS: "${LIVEKIT_API_KEY:-devkey}:${LIVEKIT_API_SECRET:-secret}"
|
|
|
|
coturn:
|
|
image: coturn/coturn:latest
|
|
container_name: dumpster-coturn
|
|
command:
|
|
- "-n"
|
|
- "--log-file=stdout"
|
|
- "--min-port=10000"
|
|
- "--max-port=20000"
|
|
- "--realm=${DUMPSTER_HOST:-localhost}"
|
|
- "--user=${LIVEKIT_API_KEY:-devkey}:${LIVEKIT_API_SECRET:-secret}"
|
|
ports:
|
|
- "3478:3478/tcp"
|
|
- "3478:3478/udp"
|
|
- "5349:5349/tcp"
|
|
- "5349:5349/udp"
|
|
- "10000-20000:10000-20000/udp"
|
|
|
|
caddy:
|
|
image: caddy:2
|
|
container_name: dumpster-caddy
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- web_assets:/srv/web:ro
|
|
- caddy_data:/data
|
|
- caddy_config:/config
|
|
depends_on:
|
|
- app
|
|
|
|
volumes:
|
|
postgres_data:
|
|
valkey_data:
|
|
minio_data:
|
|
web_assets:
|
|
caddy_data:
|
|
caddy_config:
|