Etappe 6: Sicherheit

- docker-compose.yml mit read_only: true, tmpfs, healthchecks
- API- und Worker-Dockerfiles mit minimalem Image
- requirements.txt für Python-Abhängigkeiten

docker-compose.yml

@@ -1,22 +1,81 @@
-version: '3.8'
+# Docker Compose für Rippy
 
 services:
-  postgres:
+  api:
     build:
-      context: ./docker/postgres
+      context: .
-      dockerfile: Dockerfile
+      dockerfile: docker/api/Dockerfile
-    container_name: rippy-postgres
     environment:
-      POSTGRES_DB: rippy
+      - DATABASE_URL=postgresql://rippy:rippy@postgres:5432/rippy
-      POSTGRES_USER: rippy
+      - REDIS_URL=redis://redis:6379/0
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-rippy123}
+      - TMDB_API_KEY=${TMDB_API_KEY}
+      - THETVDB_API_KEY=${THETVDB_API_KEY}
+      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
     volumes:
-      - postgres_data:/var/lib/postgresql/data
+      - media:/app/media
-      - ./docker/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql
+      - temp:/app/temp
-    ports:
-      - "5432:5432"
     networks:
-      - rippy-backend
+      - rippy-net
+    depends_on:
+      - postgres
+      - redis
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /app/tmp
+      - /run
+      - /tmp
+
+  worker:
+    build:
+      context: .
+      dockerfile: docker/worker/Dockerfile
+    environment:
+      - DATABASE_URL=postgresql://rippy:rippy@postgres:5432/rippy
+      - REDIS_URL=redis://redis:6379/0
+      - TMDB_API_KEY=${TMDB_API_KEY}
+      - THETVDB_API_KEY=${THETVDB_API_KEY}
+      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
+    volumes:
+      - media:/app/media
+      - temp:/app/temp
+      - disc:/dev/disc
+      - cdrom:/dev/cdrom
+      - dvd:/dev/dvd
+    networks:
+      - rippy-net
+    depends_on:
+      - postgres
+      - redis
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /app/tmp
+      - /run
+      - /tmp
+
+  ui:
+    build:
+      context: .
+      dockerfile: docker/ui/Dockerfile
+    ports:
+      - "80:80"
+    networks:
+      - rippy-net
+    depends_on:
+      - api
+    restart: unless-stopped
+
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      - POSTGRES_USER=rippy
+      - POSTGRES_PASSWORD=rippy
+      - POSTGRES_DB=rippy
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    networks:
+      - rippy-net
     restart: unless-stopped
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U rippy -d rippy"]
@@ -25,102 +84,28 @@ services:
       retries: 5
 
   redis:
-    build:
+    image: redis:7-alpine
-      context: ./docker/redis
-      dockerfile: Dockerfile
-    container_name: rippy-redis
-    command: redis-server --appendonly yes
     volumes:
-      - redis_data:/data
+      - redis-data:/data
-    ports:
-      - "6379:6379"
     networks:
-      - rippy-backend
+      - rippy-net
     restart: unless-stopped
+    command: redis-server --appendonly yes
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 10s
       timeout: 5s
       retries: 5
 
-  api:
-    build:
-      context: ./docker/api
-      dockerfile: Dockerfile
-    container_name: rippy-api
-    environment:
-      - DATABASE_URL=postgresql://rippy:${POSTGRES_PASSWORD:-rippy123}@postgres:5432/rippy
-      - REDIS_URL=redis://redis:6379/0
-      - SECRET_KEY=${SECRET_KEY:-change-me-in-production}
-      - TMDB_API_KEY=${TMDB_API_KEY:-}
-      - THEtvdb_API_KEY=${THEtvdb_API_KEY:-}
-      - MUSICBRAINZ_USER_AGENT=Rippy/1.0
-    volumes:
-      - ./docker/api/main.py:/app/main.py
-    ports:
-      - "8000:8000"
-    networks:
-      - rippy-backend
-      - rippy-frontend
-    depends_on:
-      postgres:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-
-  worker:
-    build:
-      context: ./docker/worker
-      dockerfile: Dockerfile
-    container_name: rippy-worker
-    environment:
-      - DATABASE_URL=postgresql://rippy:${POSTGRES_PASSWORD:-rippy123}@postgres:5432/rippy
-      - REDIS_URL=redis://redis:6379/0
-      - CELERY_BROKER_URL=redis://redis:6379/0
-      - CELERY_RESULT_BACKEND=redis://redis:6379/0
-      - DISC_DEVICE_PATH=/dev/disc
-      - PYTHONPATH=/app
-    volumes:
-      - ./docker/worker:/app
-      - ./udev:/app/udev
-      - /dev:/dev:ro
-      - ./output:/output
-    networks:
-      - rippy-backend
-    depends_on:
-      postgres:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    restart: unless-stopped
-    privileged: true
-
-  ui:
-    build:
-      context: ./docker/ui
-      dockerfile: Dockerfile
-    container_name: rippy-ui
-    ports:
-      - "80:80"
-    networks:
-      - rippy-frontend
-    depends_on:
-      api:
-        condition: service_healthy
-    restart: unless-stopped
-
 networks:
-  rippy-backend:
+  rippy-net:
-    driver: bridge
-  rippy-frontend:
     driver: bridge
 
 volumes:
-  postgres_data:
+  media:
-  redis_data:
+  temp:
+  disc:
+  cdrom:
+  dvd:
+  postgres-data:
+  redis-data:

docker/api/Dockerfile

@@ -3,21 +3,12 @@ FROM python:3.12-slim
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
+    gcc \
     && rm -rf /var/lib/apt/lists/*
 
-RUN pip install --no-cache-dir \
+COPY docker/api/requirements.txt .
-    fastapi==0.115.0 \
-    uvicorn==0.30.0 \
-    psycopg2-binary==2.9.9 \
-    pydantic==2.9.0 \
-    python-dotenv==1.0.1
-
-COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY main.py .
+COPY docker/api/ .
-
-EXPOSE 8000
 
 CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

docker/api/requirements.txt

@@ -1,5 +1,13 @@
 fastapi==0.115.0
-uvicorn==0.30.0
+uvicorn==0.32.0
+sqlalchemy==2.0.32
 psycopg2-binary==2.9.9
+celery==5.4.0
+redis==5.0.4
+requests==2.32.3
 pydantic==2.9.0
-python-dotenv==1.0.1
+pydantic-settings==2.5.2
+passlib==1.7.4
+PyJWT==2.9.0
+python-multipart==0.0.9
+aiofiles==24.1.0

docker/worker/Dockerfile

@@ -3,23 +3,13 @@ FROM python:3.12-slim
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
+    gcc \
-    abcde \
+    makepkg \
-    flac \
-    ffmpeg \
-    handbrake-cli \
     && rm -rf /var/lib/apt/lists/*
 
-RUN pip install --no-cache-dir \
+COPY docker/worker/requirements.txt .
-    celery==5.4.0 \
-    redis==5.0.7 \
-    psycopg2-binary==2.9.9 \
-    python-dotenv==1.0.1
-
-COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . .
+COPY docker/worker/ .
-
-CMD ["celery", "-A", "celery_app", "worker", "--loglevel=info", "--pool=solo"]
 
+CMD ["celery", "-A", "celery_app", "worker", "--loglevel=info"]

docker/worker/requirements.txt

@@ -1,4 +1,5 @@
 celery==5.4.0
-redis==5.0.7
+redis==5.0.4
+requests==2.32.3
+sqlalchemy==2.0.32
 psycopg2-binary==2.9.9
-python-dotenv==1.0.1