mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-15 04:30:55 +08:00
GRAB Racem
2aab3e8210
POST /api/auth/init accepted any caller while auth.password_hash was empty, so whoever reached port 8787 first could set the admin password and take the instance. When no password is set at startup, the server now generates a random one-time setup token and writes it to the server log. authInit compares it in constant time, rejects a missing or wrong token with 403, and clears it once the password is stored. The setup page has a field for the token and api.initPassword sends it. docker-compose publishes 8787 on 127.0.0.1 only, like 8788. README says where to find the token.
51 lines
1.8 KiB
YAML
51 lines
1.8 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-artex}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Please set POSTGRES_PASSWORD in .env}
|
|
POSTGRES_DB: ${POSTGRES_DB:-artex}
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-artex} -d ${POSTGRES_DB:-artex}"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
restart: unless-stopped
|
|
|
|
artex:
|
|
# Built from this checkout. The previous reference was a third-party
|
|
# namespace whose repository is gone: whoever controls that name could
|
|
# publish the tag this file would pull.
|
|
build:
|
|
context: .
|
|
args:
|
|
ARTEX_VERSION: ${ARTEX_VERSION:-dev}
|
|
image: artex:local
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
ARTEX_PG_DSN: postgres://${POSTGRES_USER:-artex}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-artex}?sslmode=disable
|
|
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
|
|
OPENAI_API_KEY: ${OPENAI_API_KEY:-}
|
|
ARTEX_LLM_PROVIDER: ${ARTEX_LLM_PROVIDER:-}
|
|
ARTEX_LLM_MODEL: ${ARTEX_LLM_MODEL:-}
|
|
ARTEX_LLM_BASE_URL: ${ARTEX_LLM_BASE_URL:-}
|
|
ARTEX_LLM_PROXY: ${ARTEX_LLM_PROXY:-}
|
|
ports:
|
|
- "127.0.0.1:8787:8787"
|
|
- "127.0.0.1:8788:8788"
|
|
volumes:
|
|
# Bind the data directory (jwt.key, SQLite, etc.) to data/ in the project root,
|
|
# so it is easy to inspect/back up on the host and survives container rebuilds.
|
|
- ./data:/app/data
|
|
# Mount skills/ from the project root into the container (overriding the image's built-in /app/skills);
|
|
# skill changes require no image rebuild — the container reads the host copy.
|
|
- ./skills:/app/skills
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
pgdata:
|