kyle
934464bf8e
- Add helmet for HTTP security headers (CSP, HSTS, X-Frame-Options, etc.) - Add @nestjs/throttler for rate limiting (100 req/60s per IP) - Add shared secret validation on Signal webhook endpoint - Remove JWT token from localStorage, use Auth0 SDK memory cache with async getAccessTokenSilently() in API interceptor - Restrict hard delete (?hard=true) to ADMINISTRATOR role in service layer - Replace exposed Anthropic API key with placeholder in .env Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
127 lines
3.1 KiB
YAML
127 lines
3.1 KiB
YAML
services:
|
|
# PostgreSQL Database
|
|
postgres:
|
|
image: postgres:15-alpine
|
|
container_name: vip-postgres
|
|
environment:
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: changeme
|
|
POSTGRES_DB: vip_coordinator
|
|
ports:
|
|
- "5433:5432"
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U postgres"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
|
|
# Redis (for caching/sessions)
|
|
redis:
|
|
image: redis:7-alpine
|
|
container_name: vip-redis
|
|
ports:
|
|
- "6380:6379"
|
|
volumes:
|
|
- redis_data:/data
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
|
|
# Signal CLI REST API for messaging
|
|
signal-api:
|
|
image: bbernhard/signal-cli-rest-api:latest
|
|
container_name: vip-signal
|
|
environment:
|
|
- MODE=native
|
|
ports:
|
|
- "8080:8080"
|
|
volumes:
|
|
- signal_data:/home/.local/share/signal-cli
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:8080/v1/about"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
restart: unless-stopped
|
|
|
|
# Traccar GPS Tracking Server
|
|
traccar:
|
|
image: traccar/traccar:6.11
|
|
container_name: vip-traccar
|
|
ports:
|
|
- "8082:8082" # Web UI & API
|
|
- "5055:5055" # GPS device port (OsmAnd protocol)
|
|
volumes:
|
|
- traccar_data:/opt/traccar/data
|
|
- traccar_logs:/opt/traccar/logs
|
|
environment:
|
|
- JAVA_OPTS=-Xms256m -Xmx512m
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:8082/api/server"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
restart: unless-stopped
|
|
|
|
# Backend API
|
|
backend:
|
|
image: t72chevy/vip-coordinator-backend:latest
|
|
container_name: vip-backend
|
|
environment:
|
|
NODE_ENV: production
|
|
PORT: 3000
|
|
DATABASE_URL: postgresql://postgres:changeme@postgres:5432/vip_coordinator
|
|
REDIS_URL: redis://redis:6379
|
|
SIGNAL_API_URL: http://signal-api:8080
|
|
SIGNAL_WEBHOOK_SECRET: ${SIGNAL_WEBHOOK_SECRET:-}
|
|
TRACCAR_API_URL: http://traccar:8082
|
|
TRACCAR_DEVICE_PORT: 5055
|
|
AUTH0_DOMAIN: ${AUTH0_DOMAIN}
|
|
AUTH0_AUDIENCE: ${AUTH0_AUDIENCE}
|
|
AUTH0_ISSUER: ${AUTH0_ISSUER}
|
|
FRONTEND_URL: http://localhost:5173
|
|
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
|
|
ports:
|
|
- "3000:3000"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:3000/v1/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 40s
|
|
restart: unless-stopped
|
|
|
|
# Frontend
|
|
frontend:
|
|
image: t72chevy/vip-coordinator-frontend:latest
|
|
container_name: vip-frontend
|
|
ports:
|
|
- "5173:80"
|
|
depends_on:
|
|
- backend
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
postgres_data:
|
|
name: vip_postgres_data
|
|
redis_data:
|
|
name: vip_redis_data
|
|
signal_data:
|
|
name: vip_signal_data
|
|
traccar_data:
|
|
name: vip_traccar_data
|
|
traccar_logs:
|
|
name: vip_traccar_logs
|