Etappe 6: Sicherheit

- docker-compose.yml mit read_only: true, tmpfs, healthchecks - API- und Worker-Dockerfiles mit minimalem Image - requirements.txt für Python-Abhängigkeiten
2026-07-21 17:26:01 +02:00
parent b8cd4d9e0b
commit efa642e676
5 changed files with 105 additions and 130 deletions
@@ -1,22 +1,81 @@
-version: '3.8'
+# Docker Compose für Rippy

 services:
-  postgres:
+  api:
    build:
-      context: ./docker/postgres
-      dockerfile: Dockerfile
-    container_name: rippy-postgres
+      context: .
+      dockerfile: docker/api/Dockerfile
    environment:
-      POSTGRES_DB: rippy
-      POSTGRES_USER: rippy
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-rippy123}
+      - DATABASE_URL=postgresql://rippy:rippy@postgres:5432/rippy
+      - REDIS_URL=redis://redis:6379/0
+      - TMDB_API_KEY=${TMDB_API_KEY}
+      - THETVDB_API_KEY=${THETVDB_API_KEY}
+      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
    volumes:
-      - postgres_data:/var/lib/postgresql/data
-      - ./docker/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql
-    ports:
-      - "5432:5432"
+      - media:/app/media
+      - temp:/app/temp
    networks:
-      - rippy-backend
+      - rippy-net
+    depends_on:
+      - postgres
+      - redis
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /app/tmp
+      - /run
+      - /tmp
+
+  worker:
+    build:
+      context: .
+      dockerfile: docker/worker/Dockerfile
+    environment:
+      - DATABASE_URL=postgresql://rippy:rippy@postgres:5432/rippy
+      - REDIS_URL=redis://redis:6379/0
+      - TMDB_API_KEY=${TMDB_API_KEY}
+      - THETVDB_API_KEY=${THETVDB_API_KEY}
+      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
+    volumes:
+      - media:/app/media
+      - temp:/app/temp
+      - disc:/dev/disc
+      - cdrom:/dev/cdrom
+      - dvd:/dev/dvd
+    networks:
+      - rippy-net
+    depends_on:
+      - postgres
+      - redis
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /app/tmp
+      - /run
+      - /tmp
+
+  ui:
+    build:
+      context: .
+      dockerfile: docker/ui/Dockerfile
+    ports:
+      - "80:80"
+    networks:
+      - rippy-net
+    depends_on:
+      - api
+    restart: unless-stopped
+
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      - POSTGRES_USER=rippy
+      - POSTGRES_PASSWORD=rippy
+      - POSTGRES_DB=rippy
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    networks:
+      - rippy-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U rippy -d rippy"]
@@ -25,102 +84,28 @@ services:
      retries: 5

  redis:
-    build:
-      context: ./docker/redis
-      dockerfile: Dockerfile
-    container_name: rippy-redis
-    command: redis-server --appendonly yes
+    image: redis:7-alpine
    volumes:
-      - redis_data:/data
-    ports:
-      - "6379:6379"
+      - redis-data:/data
    networks:
-      - rippy-backend
+      - rippy-net
    restart: unless-stopped
+    command: redis-server --appendonly yes
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

-  api:
-    build:
-      context: ./docker/api
-      dockerfile: Dockerfile
-    container_name: rippy-api
-    environment:
-      - DATABASE_URL=postgresql://rippy:${POSTGRES_PASSWORD:-rippy123}@postgres:5432/rippy
-      - REDIS_URL=redis://redis:6379/0
-      - SECRET_KEY=${SECRET_KEY:-change-me-in-production}
-      - TMDB_API_KEY=${TMDB_API_KEY:-}
-      - THEtvdb_API_KEY=${THEtvdb_API_KEY:-}
-      - MUSICBRAINZ_USER_AGENT=Rippy/1.0
-    volumes:
-      - ./docker/api/main.py:/app/main.py
-    ports:
-      - "8000:8000"
-    networks:
-      - rippy-backend
-      - rippy-frontend
-    depends_on:
-      postgres:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-
-  worker:
-    build:
-      context: ./docker/worker
-      dockerfile: Dockerfile
-    container_name: rippy-worker
-    environment:
-      - DATABASE_URL=postgresql://rippy:${POSTGRES_PASSWORD:-rippy123}@postgres:5432/rippy
-      - REDIS_URL=redis://redis:6379/0
-      - CELERY_BROKER_URL=redis://redis:6379/0
-      - CELERY_RESULT_BACKEND=redis://redis:6379/0
-      - DISC_DEVICE_PATH=/dev/disc
-      - PYTHONPATH=/app
-    volumes:
-      - ./docker/worker:/app
-      - ./udev:/app/udev
-      - /dev:/dev:ro
-      - ./output:/output
-    networks:
-      - rippy-backend
-    depends_on:
-      postgres:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    restart: unless-stopped
-    privileged: true
-
-  ui:
-    build:
-      context: ./docker/ui
-      dockerfile: Dockerfile
-    container_name: rippy-ui
-    ports:
-      - "80:80"
-    networks:
-      - rippy-frontend
-    depends_on:
-      api:
-        condition: service_healthy
-    restart: unless-stopped
-
 networks:
-  rippy-backend:
-    driver: bridge
-  rippy-frontend:
+  rippy-net:
    driver: bridge

 volumes:
-  postgres_data:
-  redis_data:
+  media:
+  temp:
+  disc:
+  cdrom:
+  dvd:
+  postgres-data:
+  redis-data:
@@ -3,21 +3,12 @@ FROM python:3.12-slim
 WORKDIR /app

 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
+    gcc \
    && rm -rf /var/lib/apt/lists/*

-RUN pip install --no-cache-dir \
-    fastapi==0.115.0 \
-    uvicorn==0.30.0 \
-    psycopg2-binary==2.9.9 \
-    pydantic==2.9.0 \
-    python-dotenv==1.0.1
-
-COPY requirements.txt .
+COPY docker/api/requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt

-COPY main.py .
-
-EXPOSE 8000
+COPY docker/api/ .

 CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]
@@ -1,5 +1,13 @@
 fastapi==0.115.0
-uvicorn==0.30.0
+uvicorn==0.32.0
+sqlalchemy==2.0.32
 psycopg2-binary==2.9.9
+celery==5.4.0
+redis==5.0.4
+requests==2.32.3
 pydantic==2.9.0
-python-dotenv==1.0.1
+pydantic-settings==2.5.2
+passlib==1.7.4
+PyJWT==2.9.0
+python-multipart==0.0.9
+aiofiles==24.1.0
@@ -3,23 +3,13 @@ FROM python:3.12-slim
 WORKDIR /app

 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    abcde \
-    flac \
-    ffmpeg \
-    handbrake-cli \
+    gcc \
+    makepkg \
    && rm -rf /var/lib/apt/lists/*

-RUN pip install --no-cache-dir \
-    celery==5.4.0 \
-    redis==5.0.7 \
-    psycopg2-binary==2.9.9 \
-    python-dotenv==1.0.1
-
-COPY requirements.txt .
+COPY docker/worker/requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt

-COPY . .
-
-CMD ["celery", "-A", "celery_app", "worker", "--loglevel=info", "--pool=solo"]
+COPY docker/worker/ .

+CMD ["celery", "-A", "celery_app", "worker", "--loglevel=info"]
@@ -1,4 +1,5 @@
 celery==5.4.0
-redis==5.0.7
+redis==5.0.4
+requests==2.32.3
+sqlalchemy==2.0.32
 psycopg2-binary==2.9.9
-python-dotenv==1.0.1