mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-09 05:24:49 +09:00
Juan Denis
f6f08ae9d1
Adds cross-server Fleet Monitor endpoints and models, plus broad security and robustness improvements across agent, backend, and tooling. Key changes: - New fleet monitor API (endpoints for heatmap, comparison, alerts, thresholds, anomalies, forecast, search, exports, and Prometheus) and service skeleton. - New DB models for ServerAlertThreshold and MetricAlert to support metric alerts. - Agent discovery/registration hardening: HMAC-signed discovery requests, signature/timestamp validation, minimal discovery responses, HMAC-based unregister headers, and enforced command timeout cap in agent command handling. - WebSocket and agent client TLS handling gated by SERVERKIT_INSECURE_TLS env var; added auth rate limiting on agent gateway. - Docker-compose: parameterize agent image via AGENT_VERSION and avoid running as root by adding docker group access. - Backend security & policy: tightened CSP script/style sources, request size limit, 2FA pending-token rejection on non-2FA endpoints, registration flow/guards, admin-only SSO admin routes via middleware, rate limits on sensitive endpoints, and logging for auth/2FA events. - Database service hardening: identifier validation, avoid passing passwords on CLI (use env vars), safer subprocess usage, and docker exec handling improvements. - CronService: command validation to prevent shell injection and run commands without shell=True; build_service and other subprocess usages updated similarly. - Misc: .env.example notes clarified for encryption key generation, invitation token generation improved, agent registry timestamp window reduced, various logging and input validations added, frontend FleetMonitor page and styles stubbed in, and Vite/config/style updates. Overall this commit implements fleet monitoring scaffolding and a set of security, validation, and operational improvements to make agent discovery, registration, command execution, and backend services safer and more robust.
70 lines
1.5 KiB
YAML
70 lines
1.5 KiB
YAML
# ServerKit Agent - Docker Compose Configuration
|
|
#
|
|
# Usage:
|
|
# 1. Register first (one-time setup):
|
|
# docker compose run --rm agent register -s https://your-serverkit.com -t YOUR_TOKEN
|
|
#
|
|
# 2. Start the agent:
|
|
# docker compose up -d
|
|
#
|
|
# 3. View logs:
|
|
# docker compose logs -f
|
|
#
|
|
# 4. Stop the agent:
|
|
# docker compose down
|
|
|
|
services:
|
|
agent:
|
|
image: jhd3197/serverkit-agent:${AGENT_VERSION:-1.0.0}
|
|
container_name: serverkit-agent
|
|
restart: unless-stopped
|
|
|
|
# Use docker group for socket access instead of running as root
|
|
group_add:
|
|
- docker
|
|
|
|
volumes:
|
|
# Docker socket for container management
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
|
|
# Persist configuration between restarts
|
|
- serverkit-config:/etc/serverkit-agent
|
|
|
|
# Persist logs
|
|
- serverkit-logs:/var/log/serverkit-agent
|
|
|
|
environment:
|
|
# Optional: Set timezone
|
|
- TZ=UTC
|
|
|
|
# Optional: Resource limits
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.5'
|
|
memory: 256M
|
|
reservations:
|
|
cpus: '0.1'
|
|
memory: 64M
|
|
|
|
# Health check
|
|
healthcheck:
|
|
test: ["CMD", "serverkit-agent", "status"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
# Logging configuration
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
volumes:
|
|
serverkit-config:
|
|
name: serverkit-agent-config
|
|
serverkit-logs:
|
|
name: serverkit-agent-logs
|