wangchuanli
02e83f5b73
实现服务端解密的 KeePass 网页查看器，包含登录门户口令与验证码、RSA+会话级 AES 加密通道、审计日志持久化、HTTPS 自动证书、Docker 部署配置及端到端测试。
43 行
1.9 KiB
YAML
43 行
1.9 KiB
YAML
services:
|
||
kdbx-viewer:
|
||
build: .
|
||
image: kdbx-viewer:latest
|
||
container_name: kdbx-viewer
|
||
restart: unless-stopped
|
||
ports:
|
||
# 仅绑本地，由前置 Nginx/Caddy 做 HTTPS 转发更稳妥；
|
||
# 若需直开公网，改成 "8080:3000" 并确保已配置 HTTPS + 强口令。
|
||
# 容器默认会自动生成自签证书启用 HTTPS（证书缺失时），亦可挂载受信任证书到 SSL_KEY/SSL_CERT。
|
||
- "127.0.0.1:8080:3000"
|
||
volumes:
|
||
# 默认只读，原库绝不会被改动。WRITABLE=true 时必须改成 :rw
|
||
- ./vault:/app/vault:ro
|
||
# 审计日志持久化（含审计索引文件），便于长期留存与排查
|
||
- ./logs:/app/logs
|
||
# 若使用自签证书持久化（避免容器重建后证书变化），可挂载 ssl 目录
|
||
- ./ssl:/app/ssl:rw
|
||
environment:
|
||
# 以下变量从同目录 .env 文件注入（docker compose 自动读取 .env）
|
||
APP_PW_MODE: ${APP_PW_MODE:-dynamic}
|
||
APP_PW_DATE_FMT: ${APP_PW_DATE_FMT:-yyyymmdd}
|
||
APP_PW_DATE_POS: ${APP_PW_DATE_POS:-prefix}
|
||
APP_PW_DYNAMIC: ${APP_PW_DYNAMIC:-}
|
||
APP_PW_STATIC: ${APP_PW_STATIC:-}
|
||
KDBX_PATH: ${KDBX_PATH:-/app/vault/vault.kdbx}
|
||
KEYFILE_PATH: ${KEYFILE_PATH:-/app/vault/vault.key}
|
||
WRITABLE: ${WRITABLE:-false}
|
||
SESSION_SECRET: ${SESSION_SECRET:-}
|
||
SESSION_MAX_AGE: ${SESSION_MAX_AGE:-1800000}
|
||
LOG_DIR: ${LOG_DIR:-/app/logs}
|
||
AUDIT_FILE_MAX: ${AUDIT_FILE_MAX:-100M}
|
||
AUDIT_FILE_KEEP: ${AUDIT_FILE_KEEP:-10}
|
||
SSL_KEY: ${SSL_KEY:-/app/ssl/key.pem}
|
||
SSL_CERT: ${SSL_CERT:-/app/ssl/cert.pem}
|
||
PORT: ${PORT:-3000}
|
||
healthcheck:
|
||
test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:'+(process.env.PORT||3000)+'/api/status',r=>process.exit(r.statusCode<500?0:1)).on('error',()=>process.exit(1))"]
|
||
interval: 30s
|
||
timeout: 5s
|
||
retries: 3
|
||
start_period: 10s
|