lekss361
f4d43d1cfc
Hotfix для GlitchTip Issue #71 (PermissionError при чтении /var/log/caddy/gendsgn.ru.log). Changes: - ops/glitchtip-auth-forwarder/Dockerfile — убран USER nobody, форвардер под root - ops/glitchtip-auth-forwarder/forwarder.py — throttle capture_exception (300s) - .forgejo/workflows/deploy.yml — paths-filter + build + force-recreate sidecar - docs/runbooks/basic_auth_management.md — Deploy section Security: caddy_logs mount read-only, нет network listener, нет shell, auth_forwarder_state dedicated volume. Attack surface минимален. После merge deploy.yml автоматически rebuild+recreate sidecar на VPS.
15 lines
640 B
Docker
15 lines
640 B
Docker
FROM python:3.12-slim
|
|
|
|
WORKDIR /app
|
|
|
|
# Устанавливаем только sentry-sdk без лишних extras
|
|
RUN pip install --no-cache-dir "sentry-sdk==2.18.0"
|
|
|
|
COPY forwarder.py .
|
|
|
|
# Запускается под root — необходимо для чтения /var/log/caddy/gendsgn.ru.log
|
|
# (Caddy пишет лог под UID 0). Mounts: caddy_logs:ro + auth_forwarder_state (write).
|
|
# Attack surface минимален: нет network listener, нет shell, образ python:3.12-slim.
|
|
|
|
# -u для unbuffered stdout — docker logs виден сразу без буферизации
|
|
CMD ["python", "-u", "forwarder.py"]
|