bruno
41a28dfccc
CI / build-and-test (push) Successful in 14m57s
P0 - Aucun secret servi au navigateur : /assets/config.local.js est généré par le serveur AVANT les montages statiques (il l'emporte sur le fichier local) et ne contient plus YOUTUBE_API_KEY(S) ; le fichier local n'est plus copié dans l'image Docker ni embarqué dans dist (angular ignore config.local.js) ; youtube-api.service n'appelle plus googleapis directement (fetchYouTube = /api/yt -> /proxy/api/yt), gardes « pas de clé => écran vide », rotation et carte de bans côté client supprimées ; readiness YouTube via /healthz (youtube.keys.count) ; messages d'erreur orientés configuration serveur. - CORS : origines pilotées par API_ALLOWED_ORIGINS (CSV), méthode PATCH ajoutée (requis par /user/preferences), header X-API-Key accepté. - Clés d'API longue durée : table api_keys (empreinte SHA-256 + préfixe affichable), routes GET/POST /api/keys et DELETE /api/keys/:id, jeton ntk_… affiché une seule fois, last_used_at à chaque usage ; X-API-Key accepté par authMiddleware ET authMiddlewareCookieAware. P1 - X-Request-Id renvoyé sur chaque réponse + journal JSON structuré en prod (ts, reqId, method, route, status, ms). - GET /metrics : exposition Prometheus sans dépendance (http_requests_total par route/code, somme+nombre de durées, uptime/mémoire ; METRICS_TOKEN verrouille l'accès si défini). - Rate-limit sur /api/details (DETAILS_RATE_LIMIT, 60/min, réponse JSON) — /transcript avait déjà le sien. - Version unique package.json : menu du compte, info.version de l'OpenAPI (+ schéma apiKeyAuth et chemins /keys / /metrics documentés). Tests : api_coverage +7 cas « production-ready » (sentinel de fuite de clé, X-Request-Id, /metrics, CORS PATCH, contrat/version, cycle complet des clés d'API), suggest, transcript, flags, filters, kind — verts. Build OK. Vérifs instance locale : config servie sans secret, /api/yt 200 avec la clé serveur, /metrics alimenté, menu 1.0.59 et 40 cartes rendues sans clé côté client.
67 lines
2.4 KiB
Docker
67 lines
2.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# -------------------- Build stage --------------------
|
|
FROM node:20-bookworm AS builder
|
|
WORKDIR /app
|
|
|
|
# Install dependencies
|
|
COPY package*.json ./
|
|
RUN npm ci
|
|
|
|
# Copy sources
|
|
COPY . .
|
|
|
|
# Build Angular app (outputs to ./dist)
|
|
RUN npx ng build --configuration=production
|
|
|
|
# Prune dev dependencies to keep only production deps for runtime copy
|
|
RUN npm prune --omit=dev
|
|
|
|
# -------------------- Runtime stage --------------------
|
|
FROM node:20-bookworm-slim AS runner
|
|
ENV NODE_ENV=production \
|
|
YOUTUBE_DL_SKIP_PYTHON_CHECK=1
|
|
WORKDIR /app
|
|
|
|
# Create required runtime directories
|
|
RUN mkdir -p /app/db /app/tmp/downloads
|
|
|
|
# youtube-dl-exec (yt-dlp) requires Python at runtime.
|
|
# curl_cffi is required by yt-dlp impersonation AND by the Rumble provider's
|
|
# Cloudflare bypass helper (server/providers/rumble_fetch.py).
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends python3 python-is-python3 python3-pip ca-certificates curl \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& python3 -m pip install --no-cache-dir --break-system-packages curl_cffi 2>/dev/null \
|
|
|| python3 -m pip install --no-cache-dir curl_cffi
|
|
|
|
# Copy runtime server and built frontend
|
|
COPY --from=builder /app/server ./server
|
|
COPY --from=builder /app/dist ./dist
|
|
# Copy the DB schema AND migrations; the actual DB file will be created on first run
|
|
COPY --from=builder /app/db/schema.sql ./db/schema.sql
|
|
COPY --from=builder /app/db/migrations ./db/migrations
|
|
## Also copy schema+migrations to an immutable location that won't be shadowed
|
|
## by a bind/named volume mounted on /app/db
|
|
RUN mkdir -p /app/db-schema /app/db-migrations
|
|
COPY --from=builder /app/db/schema.sql /app/db-schema/schema.sql
|
|
COPY --from=builder /app/db/migrations /app/db-migrations/
|
|
|
|
# Copy production dependencies from builder
|
|
COPY --from=builder /app/node_modules ./node_modules
|
|
COPY --from=builder /app/package*.json ./
|
|
|
|
# Copy config (browser-safe only). config.local.js is intentionally NOT shipped:
|
|
# the server generates /assets/config.local.js from its env, and any local copy
|
|
# may contain secrets that must never reach the browser.
|
|
|
|
# Expose API/web port
|
|
EXPOSE 4000
|
|
|
|
# Healthcheck against API
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
|
|
CMD curl -fsS http://localhost:4000/api/health || exit 1
|
|
|
|
# Start the API server (serves the Angular build from ./dist)
|
|
CMD ["node", "./server/index.mjs"]
|