FileCodeBox Go 重写版 v2.5.6（安全审计修复版）
Go 1.27.1 (Gin+GORM) + Vue 3 文件快传服务： - 安全审计全部修复（docs/security-audit-2026-09-05.md）： bcrypt 密码哈希与自动升级、presign 直传服务端大小/内容校验、 全局请求体上限、依赖升级（govulncheck 0 命中）、janitor 后台清理、 管理端审计动作落库、/admin CORS 收紧、通知内容白名单净化、 会话默认 7 天、限流缓存故障降级、robots.txt 端点等 - 前端：取件链接复制修复（不再重复拼接提取码）、markdown 净化器加固 - Redis 支持库号（FCB_REDIS_DB / redis://…/db URL） - 文档：docs/api/* 与 openapi.yaml 同步最新行为（robots.txt、 提码 5 位起、chunk 32MiB 上限、admin 审计动作等） 验证：gofmt/go vet/go test 全绿；二进制端到端冒烟通过
This commit is contained in:
@@ -0,0 +1,144 @@
|
||||
# 文件快传 Go 版部署编排（v2，需求 ⑧）：
|
||||
# docker compose up -d --build # 默认：SQLite 零依赖（仅 server 容器）
|
||||
# docker compose --profile postgres up -d --build # 可选：Postgres 模式（自动注入 FCB_DB_DSN）
|
||||
# docker compose --profile redis up -d # 可选：Redis 缓存增强
|
||||
# docker compose --profile minio up -d # 可选：S3 引擎冒烟（FCB_STORAGE_ENGINE=s3）
|
||||
# docker compose --profile webdav up -d # 可选：WebDAV 引擎冒烟（FCB_STORAGE_ENGINE=webdav）
|
||||
#
|
||||
# 数据库默认 SQLite（modernc.org/sqlite 纯 Go 驱动，数据落 serverdata 卷 /app/data/filecodebox.db）；
|
||||
# postgres 为可选 profile 服务，启用时 server 经 FCB_DB_DRIVER/FCB_DB_DSN 自动接入；
|
||||
# Redis 同为可选，未配置时服务端内存降级。
|
||||
name: filecodebox
|
||||
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:16-alpine
|
||||
restart: unless-stopped
|
||||
# 可选服务（需求 ⑧）：默认 SQLite 模式不会启动 postgres；
|
||||
# 需要时 docker compose --profile postgres up -d --build
|
||||
profiles: ["postgres"]
|
||||
environment:
|
||||
POSTGRES_USER: ${POSTGRES_USER:-filecodebox}
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-filecodebox}
|
||||
POSTGRES_DB: ${POSTGRES_DB:-filecodebox}
|
||||
volumes:
|
||||
- pgdata:/var/lib/postgresql/data
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-filecodebox}"]
|
||||
interval: 5s
|
||||
timeout: 3s
|
||||
retries: 20
|
||||
|
||||
server:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: deploy/Dockerfile
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
# postgres 为可选 profile 服务：--profile postgres 启用时等它健康，
|
||||
# 默认 SQLite 模式不启用该 profile，不阻塞启动
|
||||
postgres:
|
||||
condition: service_healthy
|
||||
required: false
|
||||
# redis 为可选 profile 服务：启用时等它健康，未启用不阻塞启动
|
||||
redis:
|
||||
condition: service_healthy
|
||||
required: false
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-sf", "http://127.0.0.1:8466/api/v1/health"]
|
||||
interval: 5s
|
||||
timeout: 3s
|
||||
retries: 30
|
||||
start_period: 5s
|
||||
environment:
|
||||
# 需求 ⑧：数据库驱动 sqlite（默认，零依赖）| postgres（需 --profile postgres）
|
||||
# 默认 SQLite：DSN 留空 → 数据库文件落 /app/data/filecodebox.db（serverdata 卷）
|
||||
# postgres 模式：在 .env 设 FCB_DB_DRIVER=postgres 与 FCB_DB_DSN（模板见 deploy/.env.example）
|
||||
FCB_DB_DRIVER: ${FCB_DB_DRIVER:-sqlite}
|
||||
FCB_DB_DSN: ${FCB_DB_DSN:-}
|
||||
FCB_LISTEN: ":8466"
|
||||
FCB_STORAGE_ENGINE: ${FCB_STORAGE_ENGINE:-local}
|
||||
# Redis 可选增强：.env 设 FCB_REDIS_ADDR=redis:6379 且 --profile redis 启用时接入；
|
||||
# 默认留空=内存缓存（需求 ⑧）
|
||||
FCB_REDIS_ADDR: ${FCB_REDIS_ADDR:-}
|
||||
FCB_REDIS_DB: ${FCB_REDIS_DB:-0}
|
||||
FCB_TRUSTED_PROXIES: ${FCB_TRUSTED_PROXIES:-}
|
||||
# 本地引擎根目录（容器内）
|
||||
FCB_LOCAL_STORAGE_PATH: /app/data
|
||||
# S3 引擎（MinIO profile）
|
||||
FCB_S3_ENDPOINT_URL: ${FCB_S3_ENDPOINT_URL:-}
|
||||
FCB_S3_BUCKET_NAME: ${FCB_S3_BUCKET_NAME:-filecodebox}
|
||||
FCB_S3_ACCESS_KEY_ID: ${FCB_S3_ACCESS_KEY_ID:-minioadmin}
|
||||
FCB_S3_SECRET_ACCESS_KEY: ${FCB_S3_SECRET_ACCESS_KEY:-minioadmin}
|
||||
FCB_S3_REGION_NAME: ${FCB_S3_REGION_NAME:-us-east-1}
|
||||
# WebDAV 引擎（dufs profile）
|
||||
FCB_WEBDAV_URL: ${FCB_WEBDAV_URL:-}
|
||||
FCB_WEBDAV_USERNAME: ${FCB_WEBDAV_USERNAME:-admin}
|
||||
FCB_WEBDAV_PASSWORD: ${FCB_WEBDAV_PASSWORD:-admin123}
|
||||
FCB_WEBDAV_ROOT_PATH: ${FCB_WEBDAV_ROOT_PATH:-filebox_storage}
|
||||
ports:
|
||||
- "${WEB_PORT:-8466}:8466"
|
||||
volumes:
|
||||
- serverdata:/app/data
|
||||
|
||||
redis:
|
||||
image: redis:7-alpine
|
||||
restart: unless-stopped
|
||||
profiles: ["redis"]
|
||||
volumes:
|
||||
- redisdata:/data
|
||||
healthcheck:
|
||||
test: ["CMD", "redis-cli", "ping"]
|
||||
interval: 5s
|
||||
timeout: 3s
|
||||
retries: 20
|
||||
|
||||
minio:
|
||||
image: minio/minio:latest
|
||||
restart: unless-stopped
|
||||
profiles: ["minio"]
|
||||
command: server /data --console-address ":9001"
|
||||
environment:
|
||||
MINIO_ROOT_USER: ${FCB_S3_ACCESS_KEY_ID:-minioadmin}
|
||||
MINIO_ROOT_PASSWORD: ${FCB_S3_SECRET_ACCESS_KEY:-minioadmin}
|
||||
ports:
|
||||
- "${MINIO_API_PORT:-9000}:9000"
|
||||
- "${MINIO_CONSOLE_PORT:-9001}:9001"
|
||||
volumes:
|
||||
- miniodata:/data
|
||||
healthcheck:
|
||||
test: ["CMD", "mc", "ready", "local"]
|
||||
interval: 5s
|
||||
timeout: 3s
|
||||
retries: 20
|
||||
|
||||
# MinIO 建桶初始化（mc；一次性任务）
|
||||
minio-init:
|
||||
image: minio/mc:latest
|
||||
profiles: ["minio"]
|
||||
depends_on:
|
||||
minio:
|
||||
condition: service_healthy
|
||||
entrypoint: >
|
||||
/bin/sh -c "
|
||||
mc alias set local http://minio:9000 ${FCB_S3_ACCESS_KEY_ID:-minioadmin} ${FCB_S3_SECRET_ACCESS_KEY:-minioadmin} &&
|
||||
mc mb --ignore-existing local/${FCB_S3_BUCKET_NAME:-filecodebox} &&
|
||||
echo 'MinIO 桶已就绪'"
|
||||
|
||||
# WebDAV 冒烟服务器（dufs，简单读写 + Basic 认证）
|
||||
webdav:
|
||||
image: sigoden/dufs:latest
|
||||
restart: unless-stopped
|
||||
profiles: ["webdav"]
|
||||
command: /data -A -a admin:admin123@/:rw
|
||||
ports:
|
||||
- "${WEBDAV_PORT:-5005}:5000"
|
||||
volumes:
|
||||
- webdavdata:/data
|
||||
|
||||
volumes:
|
||||
pgdata:
|
||||
redisdata:
|
||||
miniodata:
|
||||
webdavdata:
|
||||
serverdata:
|
||||
Reference in New Issue
Block a user