Egor fureunoir Gorbunov
adec5503b2
Add encryption for user PII fields (phone number, name, attributes) and address fields to enhance data security. Introduced timestamped activation tokens for improved validation. Included migrations to encrypt existing plaintext data. Refactored GraphQL settings to limit query depth and optionally disable introspection for enhanced API defense. Implemented throttling to safeguard API rates. Improved Dockerfiles for better user management and restored media migration tools for smooth instance upgrades.
59 lines
1.8 KiB
Docker
59 lines
1.8 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM python:3.12-slim-bookworm
|
|
LABEL authors="fureunoir"
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
LANG=C.UTF-8 \
|
|
DEBIAN_FRONTEND=noninteractive
|
|
|
|
WORKDIR /app
|
|
|
|
RUN set -eux; \
|
|
sed -i 's|https://deb.debian.org/debian|https://ftp.uk.debian.org/debian|g' /etc/apt/sources.list.d/debian.sources; \
|
|
apt-get update; \
|
|
apt-get install -y --no-install-recommends wget gnupg curl; \
|
|
wget -qO - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add -; \
|
|
echo "deb http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" \
|
|
> /etc/apt/sources.list.d/pgdg.list; \
|
|
apt-get update; \
|
|
apt-get install -y --no-install-recommends --fix-missing \
|
|
build-essential \
|
|
libpq-dev \
|
|
gettext \
|
|
libgettextpo-dev \
|
|
libgts-dev \
|
|
libpq5 \
|
|
chrony \
|
|
binutils \
|
|
libproj-dev \
|
|
postgresql-client-17 \
|
|
gdal-bin; \
|
|
rm -rf /var/lib/apt/lists/*; \
|
|
pip install --upgrade pip
|
|
|
|
RUN curl -LsSf https://astral.sh/uv/install.sh | UV_INSTALL_DIR=/usr/local/bin sh
|
|
|
|
ENV VIRTUAL_ENV=/opt/schon-python
|
|
ENV UV_PROJECT_ENVIRONMENT=/opt/schon-python
|
|
ENV PATH="/opt/schon-python/bin:/usr/local/bin:$PATH"
|
|
|
|
COPY pyproject.toml pyproject.toml
|
|
COPY uv.lock uv.lock
|
|
|
|
RUN uv venv /opt/schon-python && \
|
|
uv sync --extra worker --extra openai --locked
|
|
|
|
COPY ./scripts/Docker/beat-entrypoint.sh /usr/local/bin/beat-entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/beat-entrypoint.sh
|
|
|
|
COPY . .
|
|
|
|
RUN groupadd --system --gid 1000 schon && \
|
|
useradd --system --uid 1000 --gid schon --shell /bin/bash --create-home schon && \
|
|
mkdir -p /app/media && \
|
|
chown -R schon:schon /app /opt/schon-python
|
|
|
|
USER schon
|
|
|
|
ENTRYPOINT ["/usr/bin/bash", "beat-entrypoint.sh"]
|