Dennis
1c545c93b4
Security: - Add CRON_SECRET auth to /api/cron/* endpoints - Add admin role verification to /api/admin/* routes - Add org membership check to /api/billing/usage - Add security headers (HSTS, X-Frame-Options, CSP, etc.) - Add env variable validation at startup - Add rate limiting to backend API (30 req/min per IP) Infrastructure: - Multi-stage Dockerfiles with non-root user + healthchecks - Updated cron workflow to pass CRON_SECRET header - Updated .env.example with all optional vars Smart subpage scanning: - Crawler now computes template_hash (DOM structure without content) - Scanner scans ALL unique-layout pages, not just main page - Pages with same layout (e.g. product pages) scanned only once - Deduplication by template_hash, fallback to content_hash - Main page always scanned with high priority - Re-checks subscription limits before each page scan Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
37 lines
908 B
Docker
37 lines
908 B
Docker
# --- Stage 1: Build ---
|
|
FROM node:20-slim AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package*.json ./
|
|
RUN npm ci
|
|
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
# --- Stage 2: Production ---
|
|
FROM node:20-slim AS runtime
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends chromium \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
ENV CHROME_BIN=/usr/bin/chromium
|
|
ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true
|
|
|
|
WORKDIR /app
|
|
|
|
RUN groupadd -r app && useradd -r -g app -d /app app
|
|
|
|
COPY --from=builder --chown=app:app /app/dist ./dist
|
|
COPY --from=builder --chown=app:app /app/node_modules ./node_modules
|
|
COPY --from=builder --chown=app:app /app/package.json ./
|
|
|
|
USER app
|
|
|
|
EXPOSE 5000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD node -e "const h=require('http');h.get('http://localhost:5000/health',(r)=>{process.exit(r.statusCode===200?0:1)}).on('error',()=>process.exit(1))"
|
|
|
|
CMD ["node", "dist/index.js"]
|