vitya
1712538722
Shared-token auth was off on prod (no MAPPA_API_TOKEN) — anyone with network access could call /admin/purge_secrets and all mutations. Token generated, stored in pass mappa/full-env, wired into stack env + agent MCP configs (~/.claude.json). Redeployed via Portainer (stack 27). Verify: /inbox without token → 401, with token → 200.
37 lines
1.3 KiB
YAML
37 lines
1.3 KiB
YAML
# mappa — единый meta-сервис цеха (решения 1, 6, 17 спеки)
|
||
# Прод: VDS рядом с общей БД (postgres:16, отдельная база mappa, свой role — решение 1).
|
||
# HTTP-ядро + MCP-адаптер одним контейнером (dist). Endpoint: https://mappa.vds.kzntsv.site
|
||
# Deploy: Portainer-managed (см. portainer-stack-management-vds). Env через Portainer (не env_file).
|
||
|
||
services:
|
||
mappa:
|
||
image: registry.kzntsv.site/mappa:0.5.1
|
||
container_name: mappa
|
||
restart: unless-stopped
|
||
mem_limit: 512m
|
||
networks:
|
||
- shared-dbs
|
||
- proxy
|
||
environment:
|
||
DATABASE_URL: postgres://mappa:${MAPPA_DB_PASS}@postgres:5432/mappa
|
||
MAPPA_GITEA_TOKEN: ${MAPPA_GITEA_TOKEN}
|
||
MAPPA_API_TOKEN: ${MAPPA_API_TOKEN}
|
||
healthcheck:
|
||
test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8731/health"]
|
||
interval: 15s
|
||
timeout: 5s
|
||
retries: 3
|
||
start_period: 10s
|
||
labels:
|
||
traefik.enable: "true"
|
||
traefik.http.routers.mappa.entrypoints: websecure
|
||
traefik.http.routers.mappa.rule: Host(`mappa.vds.kzntsv.site`)
|
||
traefik.http.routers.mappa.tls.certresolver: letsEncrypt
|
||
traefik.http.services.mappa.loadbalancer.server.port: "8731"
|
||
|
||
networks:
|
||
shared-dbs:
|
||
external: true
|
||
proxy:
|
||
external: true
|