Darkraise
ee9c2a296f
- Pin DNS resolution to prevent SSRF rebinding between check and connect (GameDataDownloader) - Fail-closed on realpath failure in GameZipServer - Zip Slip validation before extraction (RuffleService) - Escape LIKE wildcards in ActivityService queries - Sanitize sort order to prevent SQL injection - Whitelist sort order instead of passing raw user input - Add headersSent guard to global error handler - Remove cookie from CGI allowed headers, sanitize content-type against null/CR/LF injection - Revoke refresh tokens on password change and user deactivation - Wrap role/user uniqueness checks in transactions (TOCTOU fix) - Fix concurrent ZIP mount race with deferred promise and double-close prevention via _manuallyClosed flag - Handle client disconnect in collectRequestBody - Tighten nginx CSP, repeat headers in location blocks, hide server version, pin nginx:1.27-alpine - Fix health check endpoint path in backend Dockerfile - Use wget instead of curl for frontend health checks - Replace any types with proper types across backend and frontend - Replace || with ?? for config/form defaults - Replace hardcoded Tailwind colors with theme tokens - Replace console.log/error with logger in ErrorReporter and ChartErrorBoundary - Conditionally render AddToPlaylistModal to avoid hidden instances - Add NaN guards for parseInt in GameBrowseLayout - Standardize query key for publicSettings - Simplify README to Docker-first quickstart with wiki link - Fix license to GPL-3.0 in backend package.json - Slow down particle animation speed - Add Zod max-length limits on playlist/error schemas - Ensure positive limit in parsePaginationQuery - Validate settings category param against allowlist - Fix static/parameterized route ordering in favorites - Add asyncHandler to game-zip wildcard route - Close readline/stream on error in getRecentErrors - Add .catch() on fire-and-forget syncAndReload - Fix LazyBackgroundImage cleanup on unmount - Store NetworkStatusIndicator timeout in ref - Add Flash/SWF condition to random game query
74 lines
2.6 KiB
YAML
74 lines
2.6 KiB
YAML
# =============================================================================
|
|
# Flashpoint Web - Production Docker Compose
|
|
# =============================================================================
|
|
# Uses pre-built images from container registry.
|
|
#
|
|
# Usage:
|
|
# 1. Copy .env.example to .env and configure required variables
|
|
# 2. docker compose up -d
|
|
#
|
|
# For local development with image building, use:
|
|
# docker compose -f docker-compose.dev.yml up -d --build
|
|
#
|
|
# User permissions:
|
|
# Set PUID/PGID to match your host user (run 'id -u' and 'id -g' to find)
|
|
# This ensures bind-mounted volumes have correct ownership
|
|
# =============================================================================
|
|
|
|
services:
|
|
backend:
|
|
image: darkraise/flashpoint-backend:${IMAGE_TAG:-latest}
|
|
container_name: flashpoint-backend
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${API_PORT:-3100}:3100"
|
|
# Backend now includes game content serving on /game-proxy and /game-zip
|
|
volumes:
|
|
- ${FLASHPOINT_HOST_PATH:?FLASHPOINT_HOST_PATH is required}:/data/flashpoint:ro
|
|
- ${DATA_PATH:-./data}:/app/data
|
|
- ${LOGS_PATH:-./logs}:/app/logs
|
|
environment:
|
|
- PUID=${PUID:-1000}
|
|
- PGID=${PGID:-1000}
|
|
- NODE_ENV=production
|
|
- TZ=${TZ:-UTC}
|
|
- DOMAIN=${DOMAIN:-http://localhost:${WEB_PORT:-80}}
|
|
- LOG_LEVEL=${LOG_LEVEL:-info}
|
|
- JWT_SECRET=${JWT_SECRET:?JWT_SECRET is required}
|
|
- ENABLE_LOCAL_DB_COPY=${ENABLE_LOCAL_DB_COPY:-false}
|
|
- SQLITE_CACHE_SIZE=${SQLITE_CACHE_SIZE:--64000}
|
|
- SQLITE_MMAP_SIZE=${SQLITE_MMAP_SIZE:-268435456}
|
|
- ENABLE_CACHE_PREWARM=${ENABLE_CACHE_PREWARM:-true}
|
|
- OTEL_ENABLED=${OTEL_ENABLED:-false}
|
|
- OTEL_EXPORTER_OTLP_ENDPOINT=${OTEL_EXPORTER_OTLP_ENDPOINT:-}
|
|
- OTEL_API_KEY=${OTEL_API_KEY:-}
|
|
- OTEL_SERVICE_NAME=${OTEL_SERVICE_NAME:-flashpoint-web-backend}
|
|
healthcheck:
|
|
test: ["CMD", "curl", "--fail", "http://localhost:3100/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 40s
|
|
|
|
frontend:
|
|
image: darkraise/flashpoint-frontend:${IMAGE_TAG:-latest}
|
|
container_name: flashpoint-frontend
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${WEB_PORT:-80}:8080"
|
|
environment:
|
|
- PUID=${PUID:-1000}
|
|
- PGID=${PGID:-1000}
|
|
- TZ=${TZ:-UTC}
|
|
- BACKEND_HOST=${BACKEND_HOST:-backend}
|
|
- BACKEND_PORT=${BACKEND_PORT:-3100}
|
|
depends_on:
|
|
backend:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--spider", "http://localhost:8080/"]
|
|
interval: 30s
|
|
timeout: 3s
|
|
retries: 3
|
|
start_period: 10s
|