archetecture security fix

2026-06-11 03:22:12 -04:00
parent 6def9993da
commit 9483750161
3126 changed files with 177194 additions and 37211 deletions
@@ -0,0 +1,292 @@
+name: rentaldrivego-prod
+
+x-node-runtime-hardening: &node-runtime-hardening
+  init: true
+  security_opt:
+    - no-new-privileges:true
+  tmpfs:
+    - /tmp:size=64m,mode=1777
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    networks:
+      - internal
+    environment:
+      POSTGRES_DB: rentaldrivego
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d rentaldrivego"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    volumes:
+      - postgres_prod_data:/var/lib/postgresql/data
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    networks:
+      - internal
+    environment:
+      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set}
+    command: >
+      sh -ec 'exec redis-server --appendonly yes --requirepass "$${REDIS_PASSWORD}" --maxmemory "$${REDIS_MAXMEMORY:-256mb}" --maxmemory-policy allkeys-lru'
+    healthcheck:
+      test: ["CMD-SHELL", 'redis-cli -a "$${REDIS_PASSWORD}" ping | grep PONG']
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    volumes:
+      - redis_prod_data:/data
+
+  migrate:
+    <<: *node-runtime-hardening
+    cap_drop:
+      - ALL
+    image: ${APP_IMAGE:-rentaldrivego-prod-app}:${APP_VERSION:-latest}
+    build:
+      context: .
+      dockerfile: Dockerfile.production
+      args:
+        API_INTERNAL_URL: ${API_INTERNAL_URL:-http://api:4000/api/v1}
+        DASHBOARD_INTERNAL_URL: ${DASHBOARD_INTERNAL_URL:-http://dashboard:3001}
+        ADMIN_INTERNAL_URL: ${ADMIN_INTERNAL_URL:-http://admin:3002}
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
+        NEXT_PUBLIC_MARKETPLACE_URL: ${NEXT_PUBLIC_MARKETPLACE_URL}
+        NEXT_PUBLIC_DASHBOARD_URL: ${NEXT_PUBLIC_DASHBOARD_URL}
+        NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL}
+    command: ["npm", "run", "db:deploy"]
+    networks:
+      - internal
+    depends_on:
+      postgres:
+        condition: service_healthy
+    env_file:
+      - .env.docker.production
+    environment:
+      DATABASE_URL_FROM_POSTGRES: ${DATABASE_URL_FROM_POSTGRES:-true}
+      POSTGRES_HOST: ${POSTGRES_HOST:-postgres}
+      POSTGRES_PORT: ${POSTGRES_PORT:-5432}
+      POSTGRES_DB: ${POSTGRES_DB:-rentaldrivego}
+      POSTGRES_USER: ${POSTGRES_USER:-postgres}
+    restart: "no"
+
+  api:
+    <<: *node-runtime-hardening
+    image: ${APP_IMAGE:-rentaldrivego-prod-app}:${APP_VERSION:-latest}
+    build:
+      context: .
+      dockerfile: Dockerfile.production
+      args:
+        API_INTERNAL_URL: ${API_INTERNAL_URL:-http://api:4000/api/v1}
+        DASHBOARD_INTERNAL_URL: ${DASHBOARD_INTERNAL_URL:-http://dashboard:3001}
+        ADMIN_INTERNAL_URL: ${ADMIN_INTERNAL_URL:-http://admin:3002}
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
+        NEXT_PUBLIC_MARKETPLACE_URL: ${NEXT_PUBLIC_MARKETPLACE_URL}
+        NEXT_PUBLIC_DASHBOARD_URL: ${NEXT_PUBLIC_DASHBOARD_URL}
+        NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL}
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:4000/health', (r) => process.exit(r.statusCode < 400 ? 0 : 1)).on('error', () => process.exit(1))\""]
+      interval: 15s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    command: ["npm", "run", "start", "--workspace", "@rentaldrivego/api"]
+    networks:
+      - internal
+      - traefik-proxy
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    env_file:
+      - .env.docker.production
+    environment:
+      DATABASE_URL_FROM_POSTGRES: ${DATABASE_URL_FROM_POSTGRES:-true}
+      FILE_STORAGE_ROOT: /var/lib/rentaldrivego/storage
+      POSTGRES_HOST: ${POSTGRES_HOST:-postgres}
+      POSTGRES_PORT: ${POSTGRES_PORT:-5432}
+      POSTGRES_DB: ${POSTGRES_DB:-rentaldrivego}
+      POSTGRES_USER: ${POSTGRES_USER:-postgres}
+    volumes:
+      - api_uploads:/var/lib/rentaldrivego/storage
+    restart: unless-stopped
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.api.rule=Host(`${API_DOMAIN}`) && !HeadersRegexp(`x-middleware-subrequest`, `.+`)
+      - traefik.http.routers.api.entrypoints=websecure
+      - traefik.http.routers.api.tls=true
+      - traefik.http.routers.api.tls.certresolver=letsencrypt
+      - traefik.http.services.api.loadbalancer.server.port=4000
+      - traefik.http.routers.api.middlewares=rdg-security-headers@docker
+      - traefik.http.middlewares.rdg-security-headers.headers.stsSeconds=31536000
+      - traefik.http.middlewares.rdg-security-headers.headers.stsIncludeSubdomains=true
+      - traefik.http.middlewares.rdg-security-headers.headers.contentTypeNosniff=true
+      - traefik.http.middlewares.rdg-security-headers.headers.frameDeny=true
+      - traefik.http.middlewares.rdg-security-headers.headers.referrerPolicy=strict-origin-when-cross-origin
+      - traefik.http.middlewares.rdg-security-headers.headers.permissionsPolicy=camera=(), microphone=(), geolocation=()
+
+  marketplace:
+    <<: *node-runtime-hardening
+    cap_drop:
+      - ALL
+    image: ${APP_IMAGE:-rentaldrivego-prod-app}:${APP_VERSION:-latest}
+    build:
+      context: .
+      dockerfile: Dockerfile.production
+      args:
+        API_INTERNAL_URL: ${API_INTERNAL_URL:-http://api:4000/api/v1}
+        DASHBOARD_INTERNAL_URL: ${DASHBOARD_INTERNAL_URL:-http://dashboard:3001}
+        ADMIN_INTERNAL_URL: ${ADMIN_INTERNAL_URL:-http://admin:3002}
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
+        NEXT_PUBLIC_MARKETPLACE_URL: ${NEXT_PUBLIC_MARKETPLACE_URL}
+        NEXT_PUBLIC_DASHBOARD_URL: ${NEXT_PUBLIC_DASHBOARD_URL}
+        NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL}
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3000/', (r) => process.exit(r.statusCode < 400 ? 0 : 1)).on('error', () => process.exit(1))\""]
+      interval: 15s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    command: ["npm", "run", "start", "--workspace", "@rentaldrivego/marketplace"]
+    networks:
+      - internal
+      - traefik-proxy
+    depends_on:
+      api:
+        condition: service_healthy
+    env_file:
+      - .env.docker.production
+    restart: unless-stopped
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.marketplace.rule=(Host(`${PUBLIC_SITE_DOMAIN}`) || Host(`www.${PUBLIC_SITE_DOMAIN}`)) && !HeadersRegexp(`x-middleware-subrequest`, `.+`)
+      - traefik.http.routers.marketplace.entrypoints=websecure
+      - traefik.http.routers.marketplace.tls=true
+      - traefik.http.routers.marketplace.tls.certresolver=letsencrypt
+      - traefik.http.routers.marketplace.service=marketplace-svc
+      - traefik.http.routers.marketplace.priority=10
+      - traefik.http.services.marketplace-svc.loadbalancer.server.port=3000
+      - traefik.http.routers.marketplace.middlewares=rdg-security-headers@docker
+
+  dashboard:
+    <<: *node-runtime-hardening
+    cap_drop:
+      - ALL
+    image: ${APP_IMAGE:-rentaldrivego-prod-app}:${APP_VERSION:-latest}
+    build:
+      context: .
+      dockerfile: Dockerfile.production
+      args:
+        API_INTERNAL_URL: ${API_INTERNAL_URL:-http://api:4000/api/v1}
+        DASHBOARD_INTERNAL_URL: ${DASHBOARD_INTERNAL_URL:-http://dashboard:3001}
+        ADMIN_INTERNAL_URL: ${ADMIN_INTERNAL_URL:-http://admin:3002}
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
+        NEXT_PUBLIC_MARKETPLACE_URL: ${NEXT_PUBLIC_MARKETPLACE_URL}
+        NEXT_PUBLIC_DASHBOARD_URL: ${NEXT_PUBLIC_DASHBOARD_URL}
+        NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL}
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3001/dashboard', (r) => process.exit(r.statusCode < 400 ? 0 : 1)).on('error', () => process.exit(1))\""]
+      interval: 15s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    command: ["npm", "run", "start", "--workspace", "@rentaldrivego/dashboard"]
+    networks:
+      - internal
+      - traefik-proxy
+    depends_on:
+      api:
+        condition: service_healthy
+    env_file:
+      - .env.docker.production
+    restart: unless-stopped
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.dashboard.rule=(Host(`${PUBLIC_SITE_DOMAIN}`) || Host(`www.${PUBLIC_SITE_DOMAIN}`)) && PathPrefix(`/dashboard`) && !HeadersRegexp(`x-middleware-subrequest`, `.+`)
+      - traefik.http.routers.dashboard.entrypoints=websecure
+      - traefik.http.routers.dashboard.tls=true
+      - traefik.http.routers.dashboard.tls.certresolver=letsencrypt
+      - traefik.http.routers.dashboard.service=dashboard-svc
+      - traefik.http.routers.dashboard.priority=20
+      - traefik.http.services.dashboard-svc.loadbalancer.server.port=3001
+      - traefik.http.routers.dashboard.middlewares=rdg-security-headers@docker
+
+  admin:
+    <<: *node-runtime-hardening
+    cap_drop:
+      - ALL
+    image: ${APP_IMAGE:-rentaldrivego-prod-app}:${APP_VERSION:-latest}
+    build:
+      context: .
+      dockerfile: Dockerfile.production
+      args:
+        API_INTERNAL_URL: ${API_INTERNAL_URL:-http://api:4000/api/v1}
+        DASHBOARD_INTERNAL_URL: ${DASHBOARD_INTERNAL_URL:-http://dashboard:3001}
+        ADMIN_INTERNAL_URL: ${ADMIN_INTERNAL_URL:-http://admin:3002}
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
+        NEXT_PUBLIC_MARKETPLACE_URL: ${NEXT_PUBLIC_MARKETPLACE_URL}
+        NEXT_PUBLIC_DASHBOARD_URL: ${NEXT_PUBLIC_DASHBOARD_URL}
+        NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL}
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3002/admin', (r) => process.exit(r.statusCode < 400 ? 0 : 1)).on('error', () => process.exit(1))\""]
+      interval: 15s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    command: ["npm", "run", "start", "--workspace", "@rentaldrivego/admin"]
+    networks:
+      - internal
+      - traefik-proxy
+    depends_on:
+      api:
+        condition: service_healthy
+    env_file:
+      - .env.docker.production
+    restart: unless-stopped
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.admin.rule=(Host(`${PUBLIC_SITE_DOMAIN}`) || Host(`www.${PUBLIC_SITE_DOMAIN}`)) && PathPrefix(`/admin`) && !HeadersRegexp(`x-middleware-subrequest`, `.+`)
+      - traefik.http.routers.admin.entrypoints=websecure
+      - traefik.http.routers.admin.tls=true
+      - traefik.http.routers.admin.tls.certresolver=letsencrypt
+      - traefik.http.routers.admin.service=admin-svc
+      - traefik.http.routers.admin.priority=20
+      - traefik.http.services.admin-svc.loadbalancer.server.port=3002
+      - traefik.http.routers.admin.middlewares=rdg-security-headers@docker
+
+  pgmanage:
+    image: cmdpromptinc/pgmanage-enterprise:latest
+    profiles:
+      - private-tools
+    restart: unless-stopped
+    networks:
+      - internal
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      PGMANAGE_LISTEN_PORT: "8000"
+      PGMANAGE_DEFAULT_USERNAME: ${PGMANAGE_DEFAULT_USERNAME:-}
+      PGMANAGE_DEFAULT_PASSWORD: ${PGMANAGE_DEFAULT_PASSWORD:-}
+      PGMANAGE_LICENSE_KEY: ${PGMANAGE_LICENSE_KEY:-}
+      PGMANAGE_SECURE_COOKIES: ${PGMANAGE_SECURE_COOKIES:-True}
+    volumes:
+      - pgmanage_prod_data:/appdata
+      - ./docker/pgmanage/override.py:/appdata/override.py:ro
+
+networks:
+  internal:
+    driver: bridge
+  traefik-proxy:
+    external: true
+
+volumes:
+  postgres_prod_data:
+  redis_prod_data:
+  pgmanage_prod_data:
+  api_uploads: