Cheng Zhou
74feca4467
- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads - add login challenge replay protection, production RSA key validation, and auth tests - wire compose to environment-driven dev/prod settings without committing local secrets - update setup-config smoke scripts and Postman docs for encrypted login - add visit schedule migrations/tests and update study/subject setup workflows
80 lines
1.9 KiB
YAML
Executable File
80 lines
1.9 KiB
YAML
Executable File
services:
|
|
db:
|
|
image: postgres:15-alpine
|
|
container_name: ctms_db
|
|
restart: always
|
|
environment:
|
|
POSTGRES_USER: ctms_user
|
|
POSTGRES_PASSWORD: secret_password
|
|
POSTGRES_DB: ctms_db
|
|
volumes:
|
|
# 持久化数据到 Linux 本地，防止重启丢失
|
|
- ./pg_data:/var/lib/postgresql/data
|
|
ports:
|
|
- "5432:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ctms_user -d ctms_db"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
networks:
|
|
- ctms_net
|
|
|
|
backend:
|
|
build:
|
|
context: ./backend
|
|
dockerfile: Dockerfile
|
|
container_name: ctms_backend
|
|
restart: always
|
|
ports:
|
|
- "8000:8000"
|
|
environment:
|
|
DATABASE_URL: postgresql+asyncpg://ctms_user:secret_password@db/ctms_db
|
|
ENV: ${ENV:-development}
|
|
JWT_SECRET_KEY: ${JWT_SECRET_KEY:-dev-secret}
|
|
LOGIN_RSA_PRIVATE_KEY: ${LOGIN_RSA_PRIVATE_KEY:-}
|
|
LOGIN_RSA_KEY_ID: ${LOGIN_RSA_KEY_ID:-default}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
networks:
|
|
- ctms_net
|
|
|
|
backend-init:
|
|
build:
|
|
context: ./backend
|
|
dockerfile: Dockerfile
|
|
command: python scripts/init_production.py
|
|
environment:
|
|
DATABASE_URL: postgresql+asyncpg://ctms_user:secret_password@db/ctms_db
|
|
ENV: ${ENV:-development}
|
|
JWT_SECRET_KEY: ${JWT_SECRET_KEY:-dev-secret}
|
|
LOGIN_RSA_PRIVATE_KEY: ${LOGIN_RSA_PRIVATE_KEY:-}
|
|
LOGIN_RSA_KEY_ID: ${LOGIN_RSA_KEY_ID:-default}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
profiles: ["init"]
|
|
networks:
|
|
- ctms_net
|
|
|
|
nginx:
|
|
build:
|
|
context: .
|
|
dockerfile: nginx/Dockerfile
|
|
container_name: ctms_nginx
|
|
restart: always
|
|
ports:
|
|
- "8888:80"
|
|
volumes:
|
|
- ./nginx/certs:/etc/nginx/certs:ro
|
|
- ./frontend/public/favicon.ico:/usr/share/nginx/html/favicon.ico:ro
|
|
depends_on:
|
|
- backend
|
|
networks:
|
|
- ctms_net
|
|
|
|
networks:
|
|
ctms_net:
|
|
driver: bridge
|