Simon Grüssing
d513992de7
docker-compose.yml lag mit allen Produktions-Secrets im Klartext im Repo (JWT_SECRET, Anthropic-API-Key, Azure-Client-Secret, SMTP/IMAP-Passwort, Proxmox-/GitHub-Token, Teams-Bot-Secret) — bereits vor diesem Repo in der GitHub-History vorhanden, jetzt auf ENV-Variablen umgestellt. Echte Werte liegen jetzt nur noch in einer .env auf dem Server (gitignored). JWT_SECRET wurde rotiert (rein intern, erzwingt einmaliges Neu-Login). AGENT_API_KEY und SCANNER_API_KEY bewusst NICHT rotiert, da das sofort die gesamte Agent-/Scanner-Fleet brechen würde — wird zusammen mit der geplanten Umstellung auf pro-Geräte-Keys gemacht. Externe Secrets (Anthropic, Azure, Proxmox, GitHub, M365-Mailbox) müssen von Simon manuell in den jeweiligen Portalen rotiert werden, da kein Tool-Zugriff von hier aus möglich ist. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
122 lines
3.7 KiB
YAML
122 lines
3.7 KiB
YAML
version: '3.8'
|
|
|
|
services:
|
|
# Backend Service
|
|
backend:
|
|
build:
|
|
context: ./backend
|
|
dockerfile: Dockerfile
|
|
container_name: it-nexus-backend
|
|
restart: unless-stopped
|
|
ports:
|
|
- "5000:5000"
|
|
environment:
|
|
- NODE_ENV=production
|
|
- PORT=5000
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- AGENT_API_KEY=${AGENT_API_KEY}
|
|
- SCANNER_API_KEY=${SCANNER_API_KEY}
|
|
- ENCRYPTION_KEY=${ENCRYPTION_KEY}
|
|
- TV_DASHBOARD_KEY=${TV_DASHBOARD_KEY}
|
|
- JWT_EXPIRATION=8h
|
|
- DATABASE_PATH=/app/data/database.sqlite
|
|
- FRONTEND_URL=https://it-nexus.cereda-systems.de
|
|
- BCRYPT_ROUNDS=12
|
|
# SMTP (ausgehende E-Mails)
|
|
- SMTP_HOST=smtp-mail.outlook.com
|
|
- SMTP_PORT=587
|
|
- SMTP_SECURE=false
|
|
- SMTP_USER=it-tool@cereda-systems.de
|
|
- SMTP_PASSWORD=${SMTP_PASSWORD}
|
|
- SMTP_FROM=IT Support Cereda <it-tool@cereda-systems.de>
|
|
# IMAP (eingehende E-Mails → Tickets)
|
|
- IMAP_HOST=outlook.office365.com
|
|
- IMAP_PORT=993
|
|
- IMAP_USER=it-tool@cereda-systems.de
|
|
- IMAP_PASSWORD=${IMAP_PASSWORD}
|
|
- IMAP_MAILBOX=INBOX
|
|
# Ticket-Links in E-Mails
|
|
- TICKET_BASE_URL=https://it-nexus.cereda-systems.de
|
|
# Monitoring-Mailbox (NetGo Alerts)
|
|
- MONITORING_MAILBOX=helpdesk@cereda-systems.de
|
|
# Microsoft Azure AD (OAuth2 + Graph API)
|
|
- AZURE_TENANT_ID=6a9a4382-ea6c-4e64-a09f-0905f83b3d64
|
|
- AZURE_CLIENT_ID=de5c4a83-d24d-4323-9f3b-9c3a2f6c709f
|
|
- AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET}
|
|
- AZURE_REDIRECT_URI=https://it-nexus.cereda-systems.de/api/auth/microsoft/callback
|
|
# Anthropic Claude API (KI-Integration)
|
|
- ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
|
|
# Teams Bot
|
|
- TEAMS_BOT_APP_ID=bd39de7e-1b85-4e0c-9301-a68cd5122523
|
|
- TEAMS_BOT_APP_SECRET=${TEAMS_BOT_APP_SECRET}
|
|
# Microsoft Planner Sync
|
|
- PLANNER_PLAN_ID=CFyoAifRzUi2ONlk01smWpcAHtm3
|
|
# Proxmox Monitoring
|
|
- PROXMOX_HOST=https://192.168.0.184:8006
|
|
- PROXMOX_TOKEN=${PROXMOX_TOKEN}
|
|
- PROXMOX_NODE=hve-01
|
|
# GitHub API (Feedback-System)
|
|
- GITHUB_TOKEN=${GITHUB_TOKEN}
|
|
volumes:
|
|
# Persistente Datenbank - bleibt auch nach Container-Neustart erhalten
|
|
- fido-data:/app/data
|
|
# Persistente Uploads (PDFs, Bilder) - bleibt auch nach Container-Neustart erhalten
|
|
- fido-uploads:/app/uploads
|
|
# Agent-Downloads (Installer, intunewin)
|
|
- fido-downloads:/app/downloads
|
|
# Agent-Skripte (PS1 + Installer) direkt vom Host eingebunden
|
|
- ./agent:/app/agent:ro
|
|
# Docker Socket für Docker-Management-Seite
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
privileged: true
|
|
security_opt:
|
|
- apparmor=unconfined
|
|
- seccomp=unconfined
|
|
networks:
|
|
- it-nexus-network
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:5000/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 40s
|
|
|
|
# Frontend Service
|
|
frontend:
|
|
build:
|
|
context: ./frontend
|
|
dockerfile: Dockerfile
|
|
container_name: it-nexus-frontend
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
- "8443:443"
|
|
depends_on:
|
|
- backend
|
|
privileged: true
|
|
security_opt:
|
|
- apparmor=unconfined
|
|
- seccomp=unconfined
|
|
networks:
|
|
- it-nexus-network
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pgrep -x nginx || nginx -t"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
|
|
# Volumes für persistente Daten
|
|
volumes:
|
|
fido-data:
|
|
driver: local
|
|
fido-uploads:
|
|
driver: local
|
|
fido-downloads:
|
|
driver: local
|
|
|
|
# Netzwerk für die Services
|
|
networks:
|
|
it-nexus-network:
|
|
driver: bridge
|