mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-30 16:47:01 +09:00
Juan Denis
b4f5a466ce
Introduce fallback audit logging and enrich audit tooling; add builtin extension discovery/install; and update default launcher ports and related docs/config. Key changes: - New middleware app.middleware.audit registers an after-request fallback that records authenticated mutating API requests when routes don't emit explicit audit logs. - Audit model/action constants extended and AuditService enhanced (request context handling, redaction for sensitive settings, optional commit flag, sets g.audit_logged, emits events). - Routes/services updated to create explicit audit entries for marketplace and plugin operations (create/update/publish/install/uninstall/enable/disable) and SSO/settings flows switched to use AuditService. - Added tests for audit logging behavior and redaction (backend/tests/test_audit_log.py). - Plugin service: added BUILTIN_EXTENSIONS_DIR, list_builtin_extensions and install_builtin_extension; plugin API endpoints to list/install builtin extensions. - Contribution system extended to support layouts and route layout metadata; frontend wiring updated to surface standalone/custom layouts and extension routes. - Launcher port defaults changed (backend -> 47927, frontend -> 41921). Updated backend .env.example, config CORS defaults, Dockerfiles and docker-compose to use SERVERKIT_BACKEND_PORT, and many docs/README files and frontend envs to reflect new ports. - Minor frontend cleanups and new builtin extension example (serverkit-git) plus associated manifest and frontend re-export. These changes improve observability/security for mutating APIs, enable opt-in builtin plugins, and align local dev/run ports with the launcher defaults.
64 lines
1.8 KiB
Docker
64 lines
1.8 KiB
Docker
# Backend Dockerfile for ServerKit
|
|
FROM python:3.11-slim-bookworm
|
|
|
|
# Set environment variables
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
FLASK_ENV=production \
|
|
SERVERKIT_BACKEND_PORT=5000
|
|
|
|
# Set working directory
|
|
WORKDIR /app
|
|
|
|
# Install system dependencies including ClamAV for security scanning
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
# Build dependencies
|
|
gcc \
|
|
python3-dev \
|
|
libpq-dev \
|
|
libffi-dev \
|
|
libssl-dev \
|
|
libevent-dev \
|
|
# ClamAV antivirus
|
|
clamav \
|
|
clamav-daemon \
|
|
clamav-freshclam \
|
|
# Utilities
|
|
curl \
|
|
procps \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& apt-get clean
|
|
|
|
# Create directories for ServerKit
|
|
RUN mkdir -p /etc/serverkit /var/serverkit/apps /app/logs /var/quarantine /app/instance /var/backups/serverkit
|
|
|
|
# Copy requirements first for caching
|
|
COPY requirements.txt .
|
|
|
|
# Install Python dependencies
|
|
RUN pip install --no-cache-dir -r requirements.txt \
|
|
&& pip install --no-cache-dir gunicorn gevent gevent-websocket
|
|
|
|
# Copy application code
|
|
COPY . .
|
|
|
|
# Create non-root user and set permissions
|
|
RUN useradd --create-home appuser \
|
|
&& chown -R appuser:appuser /app \
|
|
&& chown -R appuser:appuser /app/instance \
|
|
&& chown -R appuser:appuser /etc/serverkit \
|
|
&& chown -R appuser:appuser /var/quarantine \
|
|
&& chown -R appuser:appuser /var/backups/serverkit
|
|
|
|
USER appuser
|
|
|
|
# Expose port
|
|
EXPOSE 5000
|
|
|
|
# Health check
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
|
CMD curl -f "http://localhost:${SERVERKIT_BACKEND_PORT:-5000}/api/v1/system/health" || exit 1
|
|
|
|
# Run with gunicorn + gevent for WebSocket support
|
|
CMD ["sh", "-c", "exec gunicorn -k geventwebsocket.gunicorn.workers.GeventWebSocketWorker -w 1 -b 0.0.0.0:${SERVERKIT_BACKEND_PORT:-5000} --timeout 120 --access-logfile - --error-logfile - run:app"]
|