irrlicht
50be342899
- http.Server mit Timeouts (Slowloris) und Graceful Shutdown (SIGTERM) - Adresse und DB-Pfad per Env (KVER_ADDR, KVER_DB) - Security-Header global: nosniff, X-Frame-Options, Referrer-Policy, CSP - Upload-Requests hart auf 17 MB gedeckelt (MaxBytesReader statt nur Multipart-Speichergrenze) - Indizes für Feed-, Thread- und Vote-Queries - middleware.RealIP für Logging/Rate-Limit hinter dem Reverse-Proxy - Containerfile (Multi-Stage, Alpine, non-root) + Deploy-Doku in notes/ Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
26 lines
889 B
Docker
26 lines
889 B
Docker
# Build-Stage: statisches Binary, CGO aus (modernc.org/sqlite ist pures Go).
|
|
FROM docker.io/library/golang:1.26-alpine AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY *.go ./
|
|
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /kver .
|
|
|
|
# Laufzeit-Stage: minimales Alpine, eigener unprivilegierter Nutzer.
|
|
FROM docker.io/library/alpine:3.22
|
|
RUN adduser -D -u 1000 kver
|
|
WORKDIR /app
|
|
COPY --from=build /kver /usr/local/bin/kver
|
|
COPY web/ web/
|
|
COPY static/ static/
|
|
# data: SQLite-DB; static/media: Uploads. Beide als Volume persistieren.
|
|
RUN mkdir -p data static/media && chown kver:kver data static/media
|
|
USER kver
|
|
ENV KVER_DB=/app/data/kver.db
|
|
ENV KVER_ADDR=:8080
|
|
EXPOSE 8080
|
|
VOLUME ["/app/data", "/app/static/media"]
|
|
HEALTHCHECK --interval=30s --timeout=3s \
|
|
CMD wget -qO /dev/null http://localhost:8080/entry/feed/0 || exit 1
|
|
ENTRYPOINT ["/usr/local/bin/kver"]
|