busya
8fd23f7ea1
Centralized SSL via one contract: CERTS_PATH=/opt/certs mounted into all containers.
Backend:
- NEW: backend/src/core/ssl.py — system_ssl_context(), httpx_verify(),
cert_dir_inventory()
- LLMClient._get_ssl_verify() → delegates to core.ssl
- _llm_async_http._get_verify() → delegates to core.ssl
- Removed LLM_SSL_VERIFY env reading from all runtime code
Docker:
- NEW: docker/certs.sh — shared cert installer (PEM/DER/cer to .crt conversion,
update-ca-certificates, hash symlinks, NSS import)
- NEW: docker/agent.entrypoint.sh — agent entrypoint with cert installation
- backend.entrypoint.sh → uses certs.sh instead of install_llm_ca_certs
- Dockerfile.agent → adds ca-certificates, openssl, entrypoint
Compose:
- Removed LLM_CA_CERT_URLS and LLM_SSL_VERIFY from all compose files
- Added CERTS_PATH volume mount to agent (dev + enterprise)
- Added certs volume mount to backend/agent in dev compose
Env examples:
- Removed LLM_SSL_VERIFY, LLM_CA_CERT_URLS from .env.example,
.env.enterprise-clean.example, .env.current.example, .env.master.example,
backend/.env.example
- Enhanced CERTS_PATH comments with accepted formats
Diagnostics:
- diag_container.py: removed LLM_* checks, added CERTS_PATH inventory,
uses core.ssl for context creation
Tests:
- Updated test_llm_analysis_service, test_llm_async_http,
test_client_headers to verify centralized ssl context (no env disable)
- 4/4 SSL tests pass
48 lines
2.9 KiB
Plaintext
48 lines
2.9 KiB
Plaintext
# ======================================================================
|
|
# superset-tools — backend .env.example
|
|
# Используется для прямого запуска бекенда (без docker compose).
|
|
# При использовании docker-compose — переменные задаются в compose/environment.
|
|
# ======================================================================
|
|
|
|
# ── Безопасность (ОБЯЗАТЕЛЬНО) ─────────────────────────────────────────
|
|
# JWT-ключ подписи токенов — единый для backend и agent.
|
|
# Сгенерировать: python3 -c "import secrets; print(secrets.token_urlsafe(32))"
|
|
AUTH_SECRET_KEY=change-me-to-a-random-secret-32-chars-min
|
|
|
|
# Fernet-ключ шифрования паролей подключений и API-ключей.
|
|
# Сгенерировать: python3 -c "import base64,os; print(base64.urlsafe_b64encode(os.urandom(32)).decode())"
|
|
ENCRYPTION_KEY=3YIxOr3_GFht9ZyjRQMqOdtuO1CKOj8Y9mpY89iMbZY=
|
|
|
|
# JWT audience / issuer (опционально)
|
|
# JWT_AUDIENCE=superset-tools-api
|
|
# JWT_ISSUER=superset-tools
|
|
|
|
# ── База данных (ОБЯЗАТЕЛЬНО) ──────────────────────────────────────────
|
|
DATABASE_URL=postgresql+psycopg2://postgres:postgres@localhost:5432/ss_tools
|
|
AUTH_DATABASE_URL=postgresql+psycopg2://postgres:postgres@localhost:5432/ss_tools
|
|
TASKS_DATABASE_URL=postgresql+psycopg2://postgres:postgres@localhost:5432/ss_tools
|
|
|
|
# ── Admin bootstrap ────────────────────────────────────────────────────
|
|
# INITIAL_ADMIN_CREATE=true
|
|
# INITIAL_ADMIN_USERNAME=admin
|
|
# INITIAL_ADMIN_PASSWORD=change-me
|
|
|
|
# ── LLM / провайдеры ───────────────────────────────────────────────────
|
|
OPENAI_API_KEY=
|
|
ANTHROPIC_API_KEY=
|
|
|
|
# ── CORS / Безопасность ────────────────────────────────────────────────
|
|
ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173
|
|
FORCE_HTTPS=false
|
|
APP_TIMEZONE=Europe/Moscow
|
|
|
|
# ── ADFS SSO (опционально) ─────────────────────────────────────────────
|
|
# ADFS_CLIENT_ID=
|
|
# ADFS_CLIENT_SECRET=
|
|
# ADFS_METADATA_URL=
|
|
|
|
# ── OpenRouter (опционально) ───────────────────────────────────────────
|
|
# OPENROUTER_SITE_URL=
|
|
# OPENROUTER_APP_NAME=
|
|
# APP_BASE_URL=
|