Audit fixes: VIP self-grant, draft leak, onboarding flag, hero personalization, gated downloads

2026-10-09 16:20:55 +03:00
parent c34611dc36
commit 5ee706ebd6
150 changed files with 24054 additions and 0 deletions
@@ -0,0 +1,68 @@
+services:
+  db:
+    image: postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: anwarpi
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_DB: anwarpi
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U anwarpi -d anwarpi"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  web:
+    build:
+      context: .
+      args:
+        NEXT_PUBLIC_SITE_URL: https://anwarpy.ai
+    restart: unless-stopped
+    expose:
+      - "3000"
+    volumes:
+      - media-uploads:/app/media
+      - files-uploads:/app/files-private
+    environment:
+      DATABASE_URI: postgres://anwarpi:${DB_PASSWORD}@db:5432/anwarpi
+      PAYLOAD_SECRET: ${PAYLOAD_SECRET}
+      AGENT_API_KEY: ${AGENT_API_KEY}
+      NEXT_PUBLIC_SITE_URL: https://anwarpy.ai
+      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
+      CLOUDFLARE_ACCOUNT_ID: ${CLOUDFLARE_ACCOUNT_ID}
+      MAIL_FROM: noreply@anwarpy.ai
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.anwarpi.rule=Host(`anwarpy.ai`) || Host(`www.anwarpy.ai`)
+      - traefik.http.routers.anwarpi.entrypoints=websecure
+      - traefik.http.routers.anwarpi.tls.certresolver=mytlschallenge
+      - traefik.http.services.anwarpi.loadbalancer.server.port=3000
+      - traefik.http.routers.anwarpi-api.rule=PathPrefix(`/api`) && (Host(`anwarpy.ai`) || Host(`www.anwarpy.ai`))
+      - traefik.http.routers.anwarpi-api.entrypoints=websecure
+      - traefik.http.routers.anwarpi-api.tls=true
+      - traefik.http.routers.anwarpi-api.tls.certresolver=mytlschallenge
+      - traefik.http.routers.anwarpi-api.service=anwarpi
+      - traefik.http.routers.anwarpi-api.middlewares=apilimit@docker
+      - traefik.http.routers.anwarpi-api.priority=100
+      - traefik.http.middlewares.apilimit.ratelimit.average=90
+      - traefik.http.middlewares.apilimit.ratelimit.burst=180
+      - traefik.http.middlewares.apilimit.ratelimit.period=1m
+      - traefik.docker.network=proxy
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - default
+      - proxy
+
+volumes:
+  db-data:
+  media-uploads:
+  files-uploads:
+
+networks:
+  default:
+  proxy:
+    external: true