909cacf7b3
- src/lib/rate-limit.ts (Redis sliding window, fail-open) - before-hook on /sign-in/email: 5 attempts/min per IP+email - worker job audit-archive (daily 03:30, JSONL → MinIO, 90d retention) - worker job panel-backup (daily 04:00, pg_dump -Fc -Z9 → MinIO) - Dockerfile adds postgresql16-client - scripts/restore-drill.sh restores latest dump into panel_drill - docs/disaster-recovery.md + docs/phase4-deferred.md (mTLS + Infisical rationale)
27 lines
959 B
Docker
27 lines
959 B
Docker
FROM node:22-alpine AS base
|
|
RUN apk add --no-cache libc6-compat openssl postgresql16-client
|
|
WORKDIR /app
|
|
RUN corepack enable && corepack prepare pnpm@9.12.0 --activate
|
|
|
|
# ---- builder: install everything (need apps/web prisma client) ----
|
|
FROM base AS builder
|
|
ENV NODE_ENV=development
|
|
COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml turbo.json ./
|
|
COPY apps/web/package.json apps/web/package.json
|
|
COPY apps/worker/package.json apps/worker/package.json
|
|
RUN pnpm install --frozen-lockfile --prod=false || pnpm install --prod=false
|
|
COPY . .
|
|
WORKDIR /app/apps/web
|
|
RUN npx --no-install prisma generate
|
|
|
|
# ---- runner ----
|
|
FROM base AS runner
|
|
ENV NODE_ENV=production
|
|
WORKDIR /app
|
|
COPY --from=builder /app/package.json /app/pnpm-workspace.yaml /app/turbo.json ./
|
|
COPY --from=builder /app/node_modules ./node_modules
|
|
COPY --from=builder /app/apps/web ./apps/web
|
|
COPY --from=builder /app/apps/worker ./apps/worker
|
|
|
|
CMD ["pnpm","--filter","@panel/worker","start"]
|