Merge dev to main: Security improvements and comprehensive test infrastructure #39

Merged
jimmy merged 195 commits from dev into main 2026-04-08 01:42:27 +08:00
3 changed files with 13 additions and 36 deletions
Showing only changes of commit 6c7af5dff6 - Show all commits
+6 -35
View File
@@ -63,45 +63,16 @@ jobs:
cd /volume1/docker/nas-dashboard cd /volume1/docker/nas-dashboard
# Stop and remove existing container if it exists # Clean up any legacy manual containers
docker compose -f docker-compose.dev.yml down --remove-orphans || true docker rm -f nas-dashboard-dev 2>/dev/null || true
docker rm -f nas-dashboard-dev || true
# Ensure network exists # Ensure network exists
docker network create nas-dashboard_internal 2>/dev/null || true docker network create nas-dashboard_internal 2>/dev/null || true
# Deploy with bridge networking to avoid port 4000 conflicts with Production # Use a dedicated project name to avoid killing production (which is project 'nas-dashboard')
docker run -d \ # and deploy using theSynced compose file.
--name nas-dashboard-dev \ docker compose -f docker-compose.dev.yml -p nas-dashboard-dev down --remove-orphans || true
--restart unless-stopped \ docker compose -f docker-compose.dev.yml -p nas-dashboard-dev up -d --build --pull never
-p 127.0.0.1:4001:4000 \
--network nas-dashboard_internal \
-v /volume1:/volume1 \
-v /volume1/docker/nas-dashboard/ssh/dashboard_terminal:/app/ssh/id_ed25519:ro \
-v /volume1/docker/nas-dashboard/ssh/vps_terminal:/app/ssh/vps_id_ed25519:ro \
-v /volume1/docker/nas-dashboard/ssh/mac_terminal:/app/ssh/mac_id_ed25519:ro \
-v /volume1/docker/nas-dashboard/ssh/known_hosts:/app/ssh/known_hosts:ro \
-v /volume1/docker/chat-summarizer/data:/app/data/chat-summarizer:ro \
--add-host host.docker.internal:host-gateway \
-e DOCKER_HOST=tcp://docker-socket-proxy:2375 \
-e GITEA_URL=http://gitea:3000 \
-e VOLUME_ROOT=/volume1 \
-e SSH_HOST=host.docker.internal \
-e SSH_USER=zjgump \
-e VPS_SSH_HOST=158.101.140.85 \
-e VPS_SSH_USER=jimmyg \
-e CADDY_VPS_SSH_HOST=161.33.182.109 \
-e CADDY_VPS_SSH_USER=ubuntu \
-e MAC_SSH_HOST=192.168.31.22 \
-e MAC_SSH_USER=jimmyg \
-e ADMIN_USER=jimmy \
-e CORS_ORIGINS=https://dev.nas.jimmygan.com,https://dev.nas.jimmygan.com:8443 \
-e WEBAUTHN_RP_ID=jimmygan.com \
-e WEBAUTHN_ORIGINS=https://dev.nas.jimmygan.com,https://dev.nas.jimmygan.com:8443,https://auth.jimmygan.com:8443 \
-e LITELLM_URL=http://litellm:4005 \
-e LITELLM_API_KEY=anything \
-e SECRET_KEY=c0e8dcd74b2d70c596dfa03928f2582ca8d88af04896a82ee6c2aeeaa6bd6199 \
nas-dashboard-dev:latest
# Connect to gitea_gitea network for database access (OPC_DB) # Connect to gitea_gitea network for database access (OPC_DB)
docker network connect gitea_gitea nas-dashboard-dev || true docker network connect gitea_gitea nas-dashboard-dev || true
+6 -1
View File
@@ -18,7 +18,7 @@ services:
- CADDY_VPS_SSH_USER=ubuntu - CADDY_VPS_SSH_USER=ubuntu
- MAC_SSH_HOST=192.168.31.22 - MAC_SSH_HOST=192.168.31.22
- MAC_SSH_USER=jimmyg - MAC_SSH_USER=jimmyg
- SECRET_KEY=${SECRET_KEY} - SECRET_KEY=${SECRET_KEY:-c0e8dcd74b2d70c596dfa03928f2582ca8d88af04896a82ee6c2aeeaa6bd6199}
- ADMIN_USER=jimmy - ADMIN_USER=jimmy
- ADMIN_PASSWORD_HASH=${ADMIN_PASSWORD_HASH} - ADMIN_PASSWORD_HASH=${ADMIN_PASSWORD_HASH}
- TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-} - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
@@ -31,6 +31,11 @@ services:
- LITELLM_API_KEY=anything - LITELLM_API_KEY=anything
- LITELLM_HEALTH_API_KEY=${LITELLM_HEALTH_API_KEY:-} - LITELLM_HEALTH_API_KEY=${LITELLM_HEALTH_API_KEY:-}
- GITEA_DB_PASSWORD=${GITEA_DB_PASSWORD} - GITEA_DB_PASSWORD=${GITEA_DB_PASSWORD}
deploy:
resources:
limits:
cpus: '0.5'
memory: 1G
volumes: volumes:
- /volume1:/volume1 - /volume1:/volume1
- /volume1/docker/nas-dashboard/ssh/dashboard_terminal:/app/ssh/id_ed25519:ro - /volume1/docker/nas-dashboard/ssh/dashboard_terminal:/app/ssh/id_ed25519:ro
+1
View File
@@ -14,6 +14,7 @@ services:
- /var/run/docker.sock:/var/run/docker.sock:ro - /var/run/docker.sock:/var/run/docker.sock:ro
networks: networks:
- internal - internal
- nas-dashboard_internal
logging: logging:
driver: json-file driver: json-file
options: options: