Bakhtiyar Issakhmetov
5b44cbda2f
- Bump github.com/rabbitmq/amqp091-go 1.12.0 -> 1.13.0 (3 Critical, 7 High,
reachable via rabbitmq.Connect) and golang.org/x/{text,net,crypto},
klauspost/compress; toolchain go1.26.8, builder image pinned to
golang:1.26.8-alpine3.24.
- Build Content-Disposition per RFC 6266/8187 (ASCII fallback +
filename*=UTF-8''), stripping CR/LF, quotes and backslashes (CWE-113).
- Cap request bodies with MaxBytesReader (HTTP_MAX_UPLOAD_BYTES, default
2 GiB); multipart uploads over the limit return 413 (CWE-400).
- /readyz reports "unavailable" instead of raw backend errors (CWE-209).
- Drop deprecated middleware.RealIP; add X-Content-Type-Options: nosniff.
- docker-compose credentials come from ${VAR:-default}.
- Check the RegisterValidation error; annotate verified gosec false
positives with #nosec and a reason.
Re-scan: govulncheck 0 reachable, trivy fs/image 0 High/Critical,
gosec High 0. go test -race passes against PostGIS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
107 lines
2.7 KiB
YAML
107 lines
2.7 KiB
YAML
# Credentials below default to well-known development values so that
|
|
# `docker compose up` works out of the box. They MUST be overridden on any
|
|
# shared or reachable host: put strong values for POSTGRES_PASSWORD,
|
|
# MINIO_ROOT_USER, MINIO_ROOT_PASSWORD, RABBITMQ_DEFAULT_USER and
|
|
# RABBITMQ_DEFAULT_PASS in deployments/.env (not committed).
|
|
x-app-common: &app-common
|
|
build:
|
|
context: ..
|
|
dockerfile: build/package/Dockerfile
|
|
environment: &app-environment
|
|
PORT: 8080
|
|
DB_URL: postgres://gis:${POSTGRES_PASSWORD:-gis}@postgres:5432/gis?sslmode=disable
|
|
S3_ENDPOINT: minio:9000
|
|
S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
|
|
S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
|
|
S3_BUCKET: geofiles
|
|
S3_USE_SSL: "false"
|
|
RABBITMQ_URL: amqp://${RABBITMQ_DEFAULT_USER:-guest}:${RABBITMQ_DEFAULT_PASS:-guest}@rabbitmq:5672/
|
|
RABBITMQ_EXCHANGE: gis.events
|
|
RABBITMQ_QUEUE: gis.events.example
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
minio:
|
|
condition: service_healthy
|
|
rabbitmq:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
|
|
services:
|
|
app:
|
|
<<: *app-common
|
|
command: ["serve"]
|
|
ports:
|
|
- "8080:8080"
|
|
volumes:
|
|
- ../stubs:/stubs
|
|
depends_on:
|
|
- postgres
|
|
- minio
|
|
- rabbitmq
|
|
|
|
worker:
|
|
<<: *app-common
|
|
command: ["worker"]
|
|
depends_on:
|
|
- postgres
|
|
- minio
|
|
- rabbitmq
|
|
|
|
postgres:
|
|
image: postgis/postgis:17-3.5
|
|
environment:
|
|
POSTGRES_USER: gis
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-gis}
|
|
POSTGRES_DB: gis
|
|
ports:
|
|
- "${DB_PORT:-5432}:5432"
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U gis -d gis"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
|
|
minio:
|
|
image: minio/minio:latest
|
|
command: server /data --console-address ":9001"
|
|
ports:
|
|
- "9000:9000"
|
|
- "9001:9001"
|
|
environment:
|
|
MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
|
|
MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
|
|
volumes:
|
|
- minio_data:/data
|
|
healthcheck:
|
|
test: ["CMD", "mc", "ready", "local"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
|
|
rabbitmq:
|
|
image: rabbitmq:3-management
|
|
ports:
|
|
- "5672:5672"
|
|
- "15672:15672"
|
|
environment:
|
|
RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER:-guest}
|
|
RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:-guest}
|
|
volumes:
|
|
- rabbitmq_data:/var/lib/rabbitmq
|
|
healthcheck:
|
|
test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
postgres_data:
|
|
minio_data:
|
|
rabbitmq_data:
|