etalon
c1cc781279
- argon2id (t=3, m=64MiB, p=2) PHC hashing honoring embedded params - token-bucket rate limiting (10/15min per IP+email) on login/register - opaque 32B session tokens in Mongo, 30-day sliding expiry, logout-all - CSRF double-submit cookie/header on authenticated mutations - bootstrap admin from env with forced first-login password change - requireAuth/requireRole middleware with disabled-account enforcement - OIDC code flow with PKCE: lazy discovery, account linking only on verified email, auto-created developer accounts - unit tests (RBAC matrix, CSRF, password, rate limiter) + integration suite covering the full auth matrix incl. an in-test fake IdP Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
38 lines
940 B
YAML
38 lines
940 B
YAML
services:
|
|
mongo:
|
|
image: mongo:7
|
|
restart: unless-stopped
|
|
# modest cache so the whole stack fits comfortably on small hosts
|
|
command: ["mongod", "--wiredTigerCacheSizeGB", "0.5"]
|
|
# Mongo is reachable only on the compose network; never published to the
|
|
# host (§12).
|
|
volumes:
|
|
- mongo-data:/data/db
|
|
healthcheck:
|
|
test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 15s
|
|
|
|
app:
|
|
build: .
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
environment:
|
|
MONGO_URI: mongodb://mongo:27017
|
|
ports:
|
|
- "127.0.0.1:${APP_PORT:-8787}:8787"
|
|
depends_on:
|
|
mongo:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8787/healthz"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
volumes:
|
|
mongo-data:
|