rogee/gochat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HH-445: deploy production observability and runbooks (#96)

Browse Source 
* HH-445: deploy production observability and runbooks

* fix(ops): share production database DSN

* fix(HH-445): enforce database TLS gate

* fix(HH-445): preserve production serve command

* fix(prod): require external database dependencies

* fix(prod): unify database host rejection gates

* test(prod): enforce exact database TLS runbook contract

---------

Co-authored-by: Rogee <rogee@ipao.vip>
This commit is contained in:
Rogee
2026-08-22 19:39:57 +08:00
committed by GitHub
co-authored by rogee
parent 61376a57fd
commit fb83285617
28 changed files with 1622 additions and 220 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+16 -6
View File
@@ -9,16 +9,20 @@ GOCHAT_SERVER_TRUSTED_PROXIES=10.0.0.0/8
GOCHAT_DATABASE_DSN=postgres://gochat:CHANGE_ME@db.CHANGE_ME.example.com:5432/gochat_production?sslmode=verify-full
GOCHAT_REDIS_DSN=rediss://:CHANGE_ME@redis.CHANGE_ME.example.com:6380/0
POSTGRES_DB=gochat_production
POSTGRES_USER=gochat
POSTGRES_PASSWORD=CHANGE_ME
# Release mode requires external PostgreSQL/Redis endpoints with verified TLS.
# Set a complete GOCHAT_DATABASE_DSN with sslmode=verify-ca or verify-full.
# Compose passes this value unchanged to every database client. Keep these fixed
# container paths in the DSN and point the host variables at untracked files.
# GOCHAT_DATABASE_DSN='postgres://user:pass@db.example.com:5432/gochat?sslmode=verify-full&sslrootcert=/run/secrets/external-db-ca.crt&sslcert=/run/secrets/external-db-client.crt&sslkey=/run/secrets/external-db-client.key'
# GOCHAT_DATABASE_TLS_CA_FILE=../../.secrets/external-db-ca.crt
# GOCHAT_DATABASE_TLS_CLIENT_CERT_FILE=../../.secrets/external-db-client.crt
# GOCHAT_DATABASE_TLS_CLIENT_KEY_FILE=../../.secrets/external-db-client.key
# Set all three files to this group and grant group read permission (0640 is
# suitable for the private key). Compose adds the group to every DB client.
# GOCHAT_DATABASE_TLS_GID=65534
POSTGRES_IMAGE_REF=pgvector/pgvector:pg16@sha256:ccc6e83d6e35e931dc7c5def2022729d5a6c370318d099181995567ff1fb4d6b
REDIS_IMAGE_REF=redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf
MEILI_IMAGE_REF=getmeili/meilisearch:v1.13@sha256:bed3fb650e62da53145777204891159242f6ea4ce69e215b36223af4aa64a0ae
REDIS_PASSWORD=CHANGE_ME
MEILI_MASTER_KEY=CHANGE_ME
GOCHAT_JWT_SECRET=CHANGE_ME_WITH_AT_LEAST_32_RANDOM_CHARACTERS
# Optional during a bounded rotation window; comma-separated old 32+ byte secrets.
@@ -33,6 +37,12 @@ GOCHAT_ENCRYPTION_ENABLED=true
GOCHAT_ENCRYPTION_CURRENT_KEY_VERSION=1
GOCHAT_ENCRYPTION_AES_KEY=CHANGE_ME
# Alertmanager reads the HTTPS receiver from this untracked one-line file.
ALERTMANAGER_WEBHOOK_URL_FILE=../../.secrets/alertmanager-webhook-url
PROMETHEUS_PORT=9090
ALERTMANAGER_PORT=9093
PROMETHEUS_RETENTION=30d
# Optional connector. Supply the digest published by its release pipeline.
SHANGWUTONG_IMAGE_REF=ghcr.io/rogeecn/shangwutong@sha256:CHANGE_ME
GOCHAT_CONNECTOR_SERVICE_TOKEN=