pi-agent
0c3521ba4c
CI / test (push) Successful in 1m58s
- Rotate 5 exposed production secrets (JWT, ENCRYPTION, ADMIN, POSTGRES, REDIS) - Fix MOCK_PAYMENTS opt-in (now defaults to disabled) - HMAC-SHA256 webhook verification with timing-safe comparison - Purge dangling git blobs (git gc --prune=now) - Rate limiting on auth routes (10/15min per IP) - CORS middleware restricted to falahos.my - Fix walletBalance → flhBalance (Prisma schema mismatch)
42 lines
1.3 KiB
YAML
42 lines
1.3 KiB
YAML
version: "3.8"
|
|
services:
|
|
falah-mobile-staging:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
image: falah-mobile:staging
|
|
ports:
|
|
- "4014:3000"
|
|
environment:
|
|
- NODE_ENV=production
|
|
- HOSTNAME=0.0.0.0
|
|
- NEXT_PUBLIC_APP_URL=https://falahos.my/mobile-staging
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
- DATABASE_URL=file:/app/data/staging.db
|
|
- LLM_API_KEY=${LLM_API_KEY:-}
|
|
- LLM_BASE_URL=${LLM_BASE_URL:-}
|
|
- LLM_MODEL=${LLM_MODEL:-qwen3.6-plus}
|
|
- GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}
|
|
- GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
|
|
- GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID:-}
|
|
- GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET:-}
|
|
# Polar.sh payments (optional — mock mode used when unset)
|
|
- POLAR_ACCESS_TOKEN=${POLAR_ACCESS_TOKEN:-}
|
|
- POLAR_FLH_500=${POLAR_FLH_500:-}
|
|
- POLAR_FLH_1000=${POLAR_FLH_1000:-}
|
|
- POLAR_FLH_5000=${POLAR_FLH_5000:-}
|
|
- POLAR_FLH_10000=${POLAR_FLH_10000:-}
|
|
- POLAR_FLH_50000=${POLAR_FLH_50000:-}
|
|
- POLAR_WEBHOOK_SECRET=${POLAR_WEBHOOK_SECRET:-}
|
|
volumes:
|
|
- falah-mobile-staging-data:/app/data
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:3000/mobile/api/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
|
|
volumes:
|
|
falah-mobile-staging-data:
|