Etappe 6: Sicherheit

- docker-compose.yml mit read_only: true, tmpfs, healthchecks
- API- und Worker-Dockerfiles mit minimalem Image
- requirements.txt für Python-Abhängigkeiten

docker-compose.yml

@@ -1,22 +1,81 @@
-version: '3.8'
+# Docker Compose für Rippy
 
 services:
-  postgres:
+  api:
     build:
-      context: ./docker/postgres
-      dockerfile: Dockerfile
-    container_name: rippy-postgres
+      context: .
+      dockerfile: docker/api/Dockerfile
     environment:
-      POSTGRES_DB: rippy
-      POSTGRES_USER: rippy
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-rippy123}
+      - DATABASE_URL=postgresql://rippy:rippy@postgres:5432/rippy
+      - REDIS_URL=redis://redis:6379/0
+      - TMDB_API_KEY=${TMDB_API_KEY}
+      - THETVDB_API_KEY=${THETVDB_API_KEY}
+      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
     volumes:
-      - postgres_data:/var/lib/postgresql/data
-      - ./docker/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql
-    ports:
-      - "5432:5432"
+      - media:/app/media
+      - temp:/app/temp
     networks:
-      - rippy-backend
+      - rippy-net
+    depends_on:
+      - postgres
+      - redis
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /app/tmp
+      - /run
+      - /tmp
+
+  worker:
+    build:
+      context: .
+      dockerfile: docker/worker/Dockerfile
+    environment:
+      - DATABASE_URL=postgresql://rippy:rippy@postgres:5432/rippy
+      - REDIS_URL=redis://redis:6379/0
+      - TMDB_API_KEY=${TMDB_API_KEY}
+      - THETVDB_API_KEY=${THETVDB_API_KEY}
+      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
+    volumes:
+      - media:/app/media
+      - temp:/app/temp
+      - disc:/dev/disc
+      - cdrom:/dev/cdrom
+      - dvd:/dev/dvd
+    networks:
+      - rippy-net
+    depends_on:
+      - postgres
+      - redis
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /app/tmp
+      - /run
+      - /tmp
+
+  ui:
+    build:
+      context: .
+      dockerfile: docker/ui/Dockerfile
+    ports:
+      - "80:80"
+    networks:
+      - rippy-net
+    depends_on:
+      - api
+    restart: unless-stopped
+
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      - POSTGRES_USER=rippy
+      - POSTGRES_PASSWORD=rippy
+      - POSTGRES_DB=rippy
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    networks:
+      - rippy-net
     restart: unless-stopped
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U rippy -d rippy"]
@@ -25,102 +84,28 @@ services:
       retries: 5
 
   redis:
-    build:
-      context: ./docker/redis
-      dockerfile: Dockerfile
-    container_name: rippy-redis
-    command: redis-server --appendonly yes
+    image: redis:7-alpine
     volumes:
-      - redis_data:/data
-    ports:
-      - "6379:6379"
+      - redis-data:/data
     networks:
-      - rippy-backend
+      - rippy-net
     restart: unless-stopped
+    command: redis-server --appendonly yes
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 10s
       timeout: 5s
       retries: 5
 
-  api:
-    build:
-      context: ./docker/api
-      dockerfile: Dockerfile
-    container_name: rippy-api
-    environment:
-      - DATABASE_URL=postgresql://rippy:${POSTGRES_PASSWORD:-rippy123}@postgres:5432/rippy
-      - REDIS_URL=redis://redis:6379/0
-      - SECRET_KEY=${SECRET_KEY:-change-me-in-production}
-      - TMDB_API_KEY=${TMDB_API_KEY:-}
-      - THEtvdb_API_KEY=${THEtvdb_API_KEY:-}
-      - MUSICBRAINZ_USER_AGENT=Rippy/1.0
-    volumes:
-      - ./docker/api/main.py:/app/main.py
-    ports:
-      - "8000:8000"
-    networks:
-      - rippy-backend
-      - rippy-frontend
-    depends_on:
-      postgres:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-
-  worker:
-    build:
-      context: ./docker/worker
-      dockerfile: Dockerfile
-    container_name: rippy-worker
-    environment:
-      - DATABASE_URL=postgresql://rippy:${POSTGRES_PASSWORD:-rippy123}@postgres:5432/rippy
-      - REDIS_URL=redis://redis:6379/0
-      - CELERY_BROKER_URL=redis://redis:6379/0
-      - CELERY_RESULT_BACKEND=redis://redis:6379/0
-      - DISC_DEVICE_PATH=/dev/disc
-      - PYTHONPATH=/app
-    volumes:
-      - ./docker/worker:/app
-      - ./udev:/app/udev
-      - /dev:/dev:ro
-      - ./output:/output
-    networks:
-      - rippy-backend
-    depends_on:
-      postgres:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    restart: unless-stopped
-    privileged: true
-
-  ui:
-    build:
-      context: ./docker/ui
-      dockerfile: Dockerfile
-    container_name: rippy-ui
-    ports:
-      - "80:80"
-    networks:
-      - rippy-frontend
-    depends_on:
-      api:
-        condition: service_healthy
-    restart: unless-stopped
-
 networks:
-  rippy-backend:
-    driver: bridge
-  rippy-frontend:
+  rippy-net:
     driver: bridge
 
 volumes:
-  postgres_data:
-  redis_data:
+  media:
+  temp:
+  disc:
+  cdrom:
+  dvd:
+  postgres-data:
+  redis-data: