Antigravity
711480f8f6
This pull request introduces the dedicated containerized infrastructure and configuration for deploying NexusReader's beta version in the Test environment. ### Summary of Changes 1. **Docker Infrastructure & Secrets**: - **`docker-compose.test.yml`**: Configured dedicated database and auxiliary services (PostgreSQL 17, Qdrant, Neo4j) on isolated, non-standard ports to ensure zero conflict with the existing server configurations. - **`.env.test.template`**: Provided an environment variable template showing required setups, including mandatory database passwords, API keys, and admin custom passwords. - **`.gitignore`**: Excluded local `.env` files to prevent accidental commits of production or staging secrets. 2. **Database Hardening**: - Configured Neo4j with basic authentication (`IDriver` instantiation uses basic auth when credentials are provided in configuration). - Configured PostgreSQL to use mandatory authentication. - Configured the admin seeder (`DbInitializer.cs`) to dynamically use `NEXUS_ADMIN_PASSWORD` from environment variables, falling back to a default password in local Development only. 3. **Feature-Flagged Restrictions**: - **`appsettings.Test.json`**: Implemented `Features:AllowRegistration` and `Features:AllowPasswordReset` flags set to `false`. - **Middleware Enforcement (`Program.cs`)**: Intercepts requests to `/identity/register` and `/identity/forgotPassword` (and their MVC/form variations) and rejects them with a `403 Forbidden` response in restricted environments. - **OAuth Provisioning Guard (`Program.cs`)**: Blocks new account provisioning via Google OAuth callback by checking the `Features:AllowRegistration` configuration, redirecting users to the login page with a descriptive error. - **UI Protection (`Login.razor`, `Register.razor`)**: Conditionally hides registration/password reset links and intercepts manual navigation attempts to `/account/register` by redirecting to login with a warning. --------- Co-authored-by: Marek Jasiński <jasins.marek@gmail.com> Reviewed-on: #56 Co-authored-by: Antigravity <antigravity@google.com> Co-committed-by: Antigravity <antigravity@google.com>
98 lines
2.9 KiB
YAML
98 lines
2.9 KiB
YAML
services:
|
|
db:
|
|
image: pgvector/pgvector:pg17
|
|
container_name: nexus-db-test
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-nexus_user}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
|
|
POSTGRES_DB: ${POSTGRES_DB:-nexus_test_db}
|
|
ports:
|
|
- "${POSTGRES_PORT:-5433}:5432"
|
|
volumes:
|
|
- pgdata_test:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-nexus_user} -d ${POSTGRES_DB:-nexus_test_db}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
networks:
|
|
- nexus-test
|
|
restart: unless-stopped
|
|
|
|
web:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: nexus-web-test
|
|
ports:
|
|
- "${WEB_PORT:-5050}:5000"
|
|
environment:
|
|
- ASPNETCORE_ENVIRONMENT=Test
|
|
- ConnectionStrings__PostgresConnection=Host=db;Database=${POSTGRES_DB:-nexus_test_db};Username=${POSTGRES_USER:-nexus_user};Password=${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
|
|
- ConnectionStrings__QdrantConnection=http://qdrant:6334
|
|
- ConnectionStrings__Neo4jConnection=bolt://neo4j:7687
|
|
- Neo4j__Username=${NEO4J_USERNAME:-neo4j}
|
|
- Neo4j__Password=${NEO4J_PASSWORD:?NEO4J_PASSWORD is required}
|
|
- Authentication__Google__ClientId=${GOOGLE_CLIENT_ID:-placeholder}
|
|
- Authentication__Google__ClientSecret=${GOOGLE_CLIENT_SECRET:-placeholder}
|
|
- Ai__Google__ApiKey=${GOOGLE_AI_API_KEY:-placeholder}
|
|
- NEXUS_ADMIN_PASSWORD=${NEXUS_ADMIN_PASSWORD:?NEXUS_ADMIN_PASSWORD is required}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
qdrant:
|
|
condition: service_healthy
|
|
neo4j:
|
|
condition: service_healthy
|
|
networks:
|
|
- nexus-test
|
|
restart: unless-stopped
|
|
|
|
qdrant:
|
|
image: qdrant/qdrant:latest
|
|
container_name: nexus-qdrant-test
|
|
environment:
|
|
- QDRANT__SERVICE__API_KEY=${QDRANT_API_KEY:-}
|
|
ports:
|
|
- "${QDRANT_HTTP_PORT:-6343}:6333"
|
|
- "${QDRANT_GRPC_PORT:-6344}:6334"
|
|
volumes:
|
|
- qdrant_test_data:/qdrant/storage
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -sf http://localhost:6333/healthz || exit 1"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
networks:
|
|
- nexus-test
|
|
restart: unless-stopped
|
|
|
|
neo4j:
|
|
image: neo4j:5-community
|
|
container_name: nexus-neo4j-test
|
|
environment:
|
|
- NEO4J_AUTH=${NEO4J_USERNAME:-neo4j}/${NEO4J_PASSWORD:?NEO4J_PASSWORD is required}
|
|
ports:
|
|
- "${NEO4J_HTTP_PORT:-7484}:7474"
|
|
- "${NEO4J_BOLT_PORT:-7697}:7687"
|
|
volumes:
|
|
- neo4j_test_data:/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -qO- http://localhost:7474 || exit 1"]
|
|
interval: 10s
|
|
timeout: 10s
|
|
retries: 10
|
|
start_period: 30s
|
|
networks:
|
|
- nexus-test
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
pgdata_test:
|
|
qdrant_test_data:
|
|
neo4j_test_data:
|
|
|
|
networks:
|
|
nexus-test:
|
|
driver: bridge
|