Rogeeandrogee
f719529d66
* fix(security): harden auth and credential handling (HH-444) * fix(security): address HH-444 review blockers * fix(security): close remaining HH-444 review blockers --------- Co-authored-by: Rogee <rogee@ipao.vip>
49 lines
1.6 KiB
YAML
49 lines
1.6 KiB
YAML
services:
|
|
postgres:
|
|
entrypoint:
|
|
- /bin/sh
|
|
- -ec
|
|
- |
|
|
install -o postgres -g postgres -m 600 /run/tls/postgres.key /var/lib/postgresql/server.key
|
|
install -o postgres -g postgres -m 644 /run/tls/postgres.crt /var/lib/postgresql/server.crt
|
|
exec docker-entrypoint.sh postgres -c ssl=on -c ssl_cert_file=/var/lib/postgresql/server.crt -c ssl_key_file=/var/lib/postgresql/server.key
|
|
command: []
|
|
volumes:
|
|
- ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro
|
|
|
|
redis:
|
|
entrypoint:
|
|
- /bin/sh
|
|
- -ec
|
|
- |
|
|
install -o redis -g redis -m 600 /run/tls/redis.key /data/redis.key
|
|
install -o redis -g redis -m 644 /run/tls/redis.crt /data/redis.crt
|
|
exec /usr/bin/setpriv --reuid redis --regid redis --clear-groups redis-server --port 0 --tls-port 6379 --tls-cert-file /data/redis.crt --tls-key-file /data/redis.key --tls-ca-cert-file /run/tls/ca.crt --tls-auth-clients no --requirepass "$${REDIS_PASSWORD}" --appendonly yes
|
|
command: []
|
|
volumes:
|
|
- ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"redis-cli --tls --cacert /run/tls/ca.crt -h redis -a '$${REDIS_PASSWORD}' ping",
|
|
]
|
|
|
|
gochat:
|
|
environment:
|
|
SSL_CERT_FILE: /run/tls/ca.crt
|
|
volumes:
|
|
- ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro
|
|
|
|
worker:
|
|
environment:
|
|
SSL_CERT_FILE: /run/tls/ca.crt
|
|
volumes:
|
|
- ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro
|
|
|
|
migrate:
|
|
environment:
|
|
SSL_CERT_FILE: /run/tls/ca.crt
|
|
volumes:
|
|
- ${GOCHAT_TLS_DIR:?set GOCHAT_TLS_DIR}:/run/tls:ro
|