busya
12118ac4ec
P0 — CRITICAL (CWE-798): JWT_SECRET crash-early
Replace hardcoded super-secret-key fallback with os.environ["JWT_SECRET"]
and ${JWT_SECRET:?} syntax in app.py + docker-compose files
P1 — HIGH: Frontend dependency CVEs
Upgrade svelte 5.43.8 → 5.56.4 — resolves devalue DoS (GHSA-g2pg-6438-jwpf)
and svelte XSS (GHSA-crpf-4hrx-3jrp, GHSA-m56q-vw4c-c2cp, GHSA-rcqx-6q8c-2c42)
P2 — MEDIUM: Logging hygiene + contract gaps + tool resolver refactor
Apply _redact_sensitive_fields() in middleware + event streaming
Truncate LLM error body to 100 chars
Add @RATIONALE/@REJECTED to HandleResume + SaveConversation
Refactor deterministic intent matching → LLM-driven tool resolution
P3 — LOW: Translate logging hardening
Move _sanitize_url() to _utils.py (shared, no circular imports)
Sanitize base_url before logging in _llm_call.py and _llm_async_http.py
Emit EXPLORE warning when LLM_SSL_VERIFY=false disables TLS
superset_client module: passed clean — no changes needed
81 lines
2.4 KiB
YAML
81 lines
2.4 KiB
YAML
services:
|
|
db:
|
|
image: ${POSTGRES_IMAGE:-postgres:16-alpine}
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: ss_tools
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: postgres
|
|
ports:
|
|
- "${POSTGRES_HOST_PORT:-5432}:5432"
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U postgres -d ss_tools"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
backend:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/backend.Dockerfile
|
|
restart: unless-stopped
|
|
env_file:
|
|
- ./backend/.env
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
environment:
|
|
POSTGRES_URL: postgresql+psycopg2://postgres:postgres@db:5432/ss_tools
|
|
DATABASE_URL: postgresql+psycopg2://postgres:postgres@db:5432/ss_tools
|
|
TASKS_DATABASE_URL: postgresql+psycopg2://postgres:postgres@db:5432/ss_tools
|
|
AUTH_DATABASE_URL: postgresql+psycopg2://postgres:postgres@db:5432/ss_tools
|
|
BACKEND_PORT: 8000
|
|
INITIAL_ADMIN_CREATE: ${INITIAL_ADMIN_CREATE:-false}
|
|
INITIAL_ADMIN_USERNAME: ${INITIAL_ADMIN_USERNAME:-admin}
|
|
INITIAL_ADMIN_PASSWORD: ${INITIAL_ADMIN_PASSWORD:-}
|
|
FEATURES__DATASET_REVIEW: ${FEATURES__DATASET_REVIEW:-true}
|
|
FEATURES__HEALTH_MONITOR: ${FEATURES__HEALTH_MONITOR:-true}
|
|
LLM_CA_CERT_URLS: ${LLM_CA_CERT_URLS:-}
|
|
LLM_SSL_VERIFY: ${LLM_SSL_VERIFY:-true}
|
|
ports:
|
|
- "${BACKEND_HOST_PORT:-8001}:8000"
|
|
volumes:
|
|
- ./storage:/app/storage
|
|
|
|
agent:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/Dockerfile.agent
|
|
restart: unless-stopped
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
backend:
|
|
condition: service_started
|
|
environment:
|
|
LLM_API_KEY: ${LLM_API_KEY:-}
|
|
LLM_BASE_URL: ${LLM_BASE_URL:-https://api.openai.com/v1}
|
|
LLM_MODEL: ${LLM_MODEL:-gpt-4o}
|
|
FASTAPI_URL: http://backend:8000
|
|
JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set — crash-early, no default fallback}
|
|
SERVICE_JWT: ${SERVICE_JWT:-agent-service-secret}
|
|
DATABASE_URL: postgresql+psycopg2://postgres:postgres@db:5432/ss_tools
|
|
GRADIO_SERVER_PORT: 7860
|
|
ports:
|
|
- "7860" # internal only, proxied through nginx
|
|
|
|
frontend:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/frontend.Dockerfile
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- backend
|
|
ports:
|
|
- "${FRONTEND_HOST_PORT:-8000}:80"
|
|
|
|
volumes:
|
|
postgres_data:
|