Разработана первая версия приложений

codebase/backend/redis/Dockerfile

@@ -0,0 +1,11 @@
+FROM redis:7.4.2-alpine
+RUN apk add --no-cache gettext \
+    && mkdir -p /etc/han-redis /usr/local/lib/han
+COPY redis.conf /etc/han-redis/redis.conf
+COPY users.acl.template /etc/han-redis/users.acl.template
+COPY scripts/entrypoint.sh /usr/local/lib/han/entrypoint.sh
+RUN sed -i 's/\r$//' /usr/local/lib/han/entrypoint.sh \
+    && chmod 0555 /usr/local/lib/han/entrypoint.sh \
+    && chmod 0444 /etc/han-redis/*
+USER redis
+ENTRYPOINT ["/usr/local/lib/han/entrypoint.sh"]

codebase/backend/redis/docker-compose.yml

@@ -0,0 +1,34 @@
+services:
+  redis:
+    build:
+      context: .
+    image: han-chat-redis:${RELEASE_VERSION:-local}
+    environment:
+      REDIS_API_PASSWORD: ${REDIS_API_PASSWORD}
+      REDIS_SAFETY_PASSWORD: ${REDIS_SAFETY_PASSWORD}
+      REDIS_HEALTH_PASSWORD: ${REDIS_HEALTH_PASSWORD}
+      REDIS_MAXMEMORY: ${REDIS_MAXMEMORY:-384mb}
+      REDIS_EVICTION_POLICY: ${REDIS_EVICTION_POLICY:-volatile-lru}
+    expose: ["6379"]
+    volumes:
+      - redis-data:/data
+    networks: [backend]
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli --no-auth-warning --user ops_health --pass \"$$REDIS_HEALTH_PASSWORD\" PING | grep -qx PONG"]
+      interval: 10s
+      timeout: 3s
+      retries: 10
+      start_period: 10s
+    restart: unless-stopped
+    stop_grace_period: 30s
+    read_only: true
+    tmpfs:
+      - /tmp:size=8m,mode=1777
+    security_opt: ["no-new-privileges:true"]
+    cap_drop: ["ALL"]
+    mem_limit: 512m
+    ulimits:
+      nofile: {soft: 65536, hard: 65536}
+    logging:
+      driver: json-file
+      options: {max-size: "50m", max-file: "5"}

codebase/backend/redis/redis.conf

@@ -0,0 +1,32 @@
+bind 0.0.0.0
+port 6379
+protected-mode yes
+daemonize no
+supervised no
+dir /data
+dbfilename dump.rdb
+appendonly yes
+appendfilename appendonly.aof
+appendfsync everysec
+aof-use-rdb-preamble yes
+auto-aof-rewrite-percentage 100
+auto-aof-rewrite-min-size 64mb
+save 900 1
+save 300 100
+save 60 10000
+stop-writes-on-bgsave-error yes
+maxmemory-policy volatile-lru
+timeout 0
+tcp-keepalive 300
+databases 3
+loglevel notice
+logfile ""
+latency-monitor-threshold 100
+slowlog-log-slower-than 10000
+slowlog-max-len 128
+client-output-buffer-limit pubsub 32mb 8mb 60
+rename-command FLUSHALL ""
+rename-command FLUSHDB ""
+rename-command CONFIG ""
+rename-command MODULE ""
+rename-command KEYS ""

codebase/backend/redis/scripts/entrypoint.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+for name in REDIS_API_PASSWORD REDIS_SAFETY_PASSWORD REDIS_HEALTH_PASSWORD; do
+  eval "value=\${$name:-}"
+  if [ "${#value}" -lt 16 ] || printf '%s' "$value" | grep -Eq '[[:space:]]'; then
+    echo "redis bootstrap: $name must be at least 16 characters without whitespace" >&2
+    exit 64
+  fi
+done
+
+umask 077
+envsubst '${REDIS_API_PASSWORD} ${REDIS_SAFETY_PASSWORD} ${REDIS_HEALTH_PASSWORD}' \
+  < /etc/han-redis/users.acl.template > /tmp/users.acl
+
+exec redis-server /etc/han-redis/redis.conf \
+  --aclfile /tmp/users.acl \
+  --maxmemory "${REDIS_MAXMEMORY:-384mb}" \
+  --maxmemory-policy "${REDIS_EVICTION_POLICY:-volatile-lru}"

codebase/backend/redis/users.acl.template

@@ -0,0 +1,4 @@
+user default off
+user api_backend on >${REDIS_API_PASSWORD} ~han:api:* ~han:rt:* ~han:coord:* &han:rt:* +@read +@write +@connection +@scripting +publish +subscribe +psubscribe -flushall -flushdb -config -module -keys
+user message_safety on >${REDIS_SAFETY_PASSWORD} ~han:safety:* +@read +@write +@connection +@scripting -flushall -flushdb -config -module -keys -publish -subscribe -psubscribe
+user ops_health on >${REDIS_HEALTH_PASSWORD} +ping +info +client|id -select