cesnimda
626a9f8454
Backend security fixes from the Phase 1 register / Phase 2 roadmap (PR1 + V-01): - V-01 SSRF: new SafeHttpGuard validates outbound unsubscribe URLs (scheme allowlist + DNS-resolve-and-block private/loopback/link-local/ULA/metadata ranges), wired into UnsubscribeService; the "unsubscribe" HttpClient now disables auto-redirect so a validated external URL can't 3xx into an internal target. +33 unit tests. - V-04: session cookie SecurePolicy=Always in non-dev (SameAsRequest in dev). - V-06: UseExceptionHandler/ProblemDetails in prod; Cleanup/Unsubscribe no longer echo ex.Message to clients (logged server-side, generic message returned). - V-08: ForwardedHeaders trusted only from configurable KnownNetworks (default private ranges) + ForwardLimit, instead of trusting any client. New ForwardedHeaders config. - V-09: returnUrl validated with Url.IsLocalUrl (no open redirect via OAuth flow). - V-10: SearchService clamps Page/PageSize (<=200); Analytics clamps take/days. - V-11: baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, COOP) + HSTS in prod. - V-13: /app/info discloses only devMode to anonymous callers unless dev mode is on. - V-12: API container runs as non-root 'app' user (keys dir pre-owned). - V-03: Postgres + API ports bound to 127.0.0.1; POSTGRES_PASSWORD now required (no weak default fallback). API compatibility preserved (clamps not rejections; error-body shape changes only on failure paths). No DB migrations. Build + all 33 unit tests green. V-15 (MailKit NU1902) persists across versions and the SMTP path is default-off — tracked, not bumped. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
75 lines
2.5 KiB
YAML
75 lines
2.5 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_DB: inboxintel
|
|
POSTGRES_USER: inboxintel
|
|
# V-03: require an explicit strong password (fail fast if POSTGRES_PASSWORD is unset)
|
|
# rather than silently defaulting to a guessable one.
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in deploy/.env}
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
# V-03: bind to loopback only so the database is reachable from the host for local
|
|
# tooling but NOT from other machines on the network. The api container reaches it
|
|
# over the internal compose network regardless of this published port.
|
|
ports:
|
|
- "127.0.0.1:5432:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U inboxintel"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
api:
|
|
build:
|
|
context: .
|
|
dockerfile: src/InboxIntel.Api/Dockerfile
|
|
environment:
|
|
ASPNETCORE_ENVIRONMENT: Production
|
|
ASPNETCORE_URLS: http://+:8080
|
|
ConnectionStrings__Postgres: "Host=postgres;Port=5432;Database=inboxintel;Username=inboxintel;Password=${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in deploy/.env}"
|
|
DataProtection__KeyPath: /keys
|
|
GoogleOAuth__ClientId: ${GOOGLE_CLIENT_ID:-}
|
|
GoogleOAuth__ClientSecret: ${GOOGLE_CLIENT_SECRET:-}
|
|
Ai__Mode: ${AI_MODE:-Disabled}
|
|
# Dev mode shows the dev banner and caps the initial sync. Set DEV_MODE=true
|
|
# and MAX_MESSAGES=1000 in deploy/.env to exercise it in this Docker setup.
|
|
App__DevMode: ${DEV_MODE:-false}
|
|
GmailSync__MaxMessages: ${MAX_MESSAGES:-0}
|
|
Cors__Origins__0: ${FRONTEND_ORIGIN:-http://localhost:8081}
|
|
volumes:
|
|
- keys:/keys
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
# V-08: bind to loopback so the API is not directly reachable from the network
|
|
# (only via the frontend/nginx proxy over the internal compose network). This
|
|
# prevents external clients from bypassing the proxy to spoof X-Forwarded-* headers.
|
|
ports:
|
|
- "127.0.0.1:8080:8080"
|
|
|
|
frontend:
|
|
build:
|
|
context: ./frontend
|
|
dockerfile: Dockerfile
|
|
depends_on:
|
|
- api
|
|
ports:
|
|
- "8081:80"
|
|
|
|
# Optional reverse proxy. Enable with: docker compose --profile proxy up
|
|
nginx:
|
|
image: nginx:alpine
|
|
profiles: ["proxy"]
|
|
volumes:
|
|
- ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
|
|
depends_on:
|
|
- api
|
|
- frontend
|
|
ports:
|
|
- "80:80"
|
|
|
|
volumes:
|
|
pgdata:
|
|
keys:
|