megaproxy
fe4e69b9ad
Phase 3 — Investments: - Multi-currency support: holdings track purchase currency, FX rates convert to base for totals - Capital gains report using UK Section 104 pool method, grouped by tax year - Capital Gains tab added to Reports page Phase 5 — Polish & Hardening: - Mobile-responsive layout: bottom nav, sidebar hidden on mobile, logo in TopBar, compact header buttons, hover-only actions now always visible on touch - Backup system: encrypted GPG backups via backup.sh, nightly scheduler job, admin API (list/trigger/download/restore), Settings UI with drag-to-restore confirmation - Docker entrypoint with gosu privilege drop to fix bind-mount ownership on fresh deployments - OWASP fixes: refresh token now bound to its session (new refresh_token_hash column + migration), CSRF secure flag tied to environment, IP-level rate limiting on login, TOTPEnableRequest Pydantic schema replaces raw dict - AES-256-GCM key rotation script (rotate_keys.py) with dry-run mode and atomic DB transaction - CLAUDE.md added for AI-assisted development context - README updated: correct reverse proxy port, accurate backup/restore commands, key rotation instructions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
29 lines
860 B
Docker
29 lines
860 B
Docker
FROM python:3.12-slim AS base
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libmagic1 \
|
|
postgresql-client \
|
|
gnupg \
|
|
gzip \
|
|
gosu \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
RUN pip install --no-cache-dir uv
|
|
WORKDIR /app
|
|
COPY pyproject.toml ./
|
|
|
|
FROM base AS deps
|
|
RUN uv pip install --system --no-cache -e .
|
|
|
|
FROM deps AS production
|
|
COPY app/ ./app/
|
|
COPY alembic/ ./alembic/
|
|
COPY alembic.ini ./
|
|
COPY scripts/ ./scripts/
|
|
RUN useradd -r -s /bin/false -u 1001 appuser \
|
|
&& chown -R appuser /app \
|
|
&& mkdir -p /app/uploads /app/backups \
|
|
&& chown appuser /app/uploads /app/backups
|
|
COPY scripts/entrypoint.sh /entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh
|
|
EXPOSE 8000
|
|
ENTRYPOINT ["/entrypoint.sh"]
|
|
CMD ["sh", "-c", "python -m alembic upgrade head && uvicorn app.main:app --host 0.0.0.0 --port 8000 --workers 2 --proxy-headers"]
|