Проект разделен на два репозитория

2026-08-14 15:42:45 +03:00
parent e06a77ee1d
commit bbef7a30c9
521 changed files with 2597 additions and 2302 deletions
@@ -0,0 +1,11 @@
+FROM redis:7.4.2-alpine
+RUN apk add --no-cache gettext \
+    && mkdir -p /etc/han-redis /usr/local/lib/han
+COPY redis.conf /etc/han-redis/redis.conf
+COPY users.acl.template /etc/han-redis/users.acl.template
+COPY scripts/entrypoint.sh /usr/local/lib/han/entrypoint.sh
+RUN sed -i 's/\r$//' /usr/local/lib/han/entrypoint.sh \
+    && chmod 0555 /usr/local/lib/han/entrypoint.sh \
+    && chmod 0444 /etc/han-redis/*
+USER redis
+ENTRYPOINT ["/usr/local/lib/han/entrypoint.sh"]
@@ -0,0 +1,44 @@
+services:
+  redis:
+    build:
+      context: .
+    image: han-chat-redis:${RELEASE_VERSION:-local}
+    environment:
+      REDIS_MAXMEMORY: ${REDIS_MAXMEMORY:-384mb}
+      REDIS_EVICTION_POLICY: ${REDIS_EVICTION_POLICY:-volatile-lru}
+    secrets:
+      - redis_api_password
+      - redis_safety_password
+      - redis_health_password
+    expose: ["6379"]
+    volumes:
+      - redis-data:/data
+    networks: [backend]
+    healthcheck:
+      test: ["CMD-SHELL", "REDISCLI_AUTH=\"$$(cat /run/secrets/redis_health_password)\" redis-cli --user ops_health PING | grep -qx PONG"]
+      interval: 10s
+      timeout: 3s
+      retries: 10
+      start_period: 10s
+    restart: unless-stopped
+    stop_grace_period: 30s
+    read_only: true
+    tmpfs:
+      - /tmp:size=8m,mode=1777
+    security_opt: ["no-new-privileges:true"]
+    cap_drop: ["ALL"]
+    mem_limit: 512m
+    ulimits:
+      core: {soft: 0, hard: 0}
+      nofile: {soft: 65536, hard: 65536}
+    logging:
+      driver: json-file
+      options: {max-size: "50m", max-file: "5"}
+
+secrets:
+  redis_api_password:
+    file: ${HAN_SECRETS_DIR:-/run/han-chat/secrets}/REDIS_API_PASSWORD
+  redis_safety_password:
+    file: ${HAN_SECRETS_DIR:-/run/han-chat/secrets}/REDIS_SAFETY_PASSWORD
+  redis_health_password:
+    file: ${HAN_SECRETS_DIR:-/run/han-chat/secrets}/REDIS_HEALTH_PASSWORD
@@ -0,0 +1,32 @@
+bind 0.0.0.0
+port 6379
+protected-mode yes
+daemonize no
+supervised no
+dir /data
+dbfilename dump.rdb
+appendonly yes
+appendfilename appendonly.aof
+appendfsync everysec
+aof-use-rdb-preamble yes
+auto-aof-rewrite-percentage 100
+auto-aof-rewrite-min-size 64mb
+save 900 1
+save 300 100
+save 60 10000
+stop-writes-on-bgsave-error yes
+maxmemory-policy volatile-lru
+timeout 0
+tcp-keepalive 300
+databases 3
+loglevel notice
+logfile ""
+latency-monitor-threshold 100
+slowlog-log-slower-than 10000
+slowlog-max-len 128
+client-output-buffer-limit pubsub 32mb 8mb 60
+rename-command FLUSHALL ""
+rename-command FLUSHDB ""
+rename-command CONFIG ""
+rename-command MODULE ""
+rename-command KEYS ""
@@ -0,0 +1,31 @@
+#!/bin/sh
+set -eu
+
+for item in \
+  REDIS_API_PASSWORD:redis_api_password \
+  REDIS_SAFETY_PASSWORD:redis_safety_password \
+  REDIS_HEALTH_PASSWORD:redis_health_password
+do
+  name=${item%%:*}
+  file=/run/secrets/${item#*:}
+  if [ ! -r "$file" ]; then
+    echo "redis bootstrap: missing secret file for $name" >&2
+    exit 66
+  fi
+  value=$(cat "$file")
+  if [ "${#value}" -lt 16 ] || printf '%s' "$value" | grep -Eq '[[:space:]]'; then
+    echo "redis bootstrap: $name must be at least 16 characters without whitespace" >&2
+    exit 64
+  fi
+  export "$name=$value"
+done
+
+umask 077
+envsubst '${REDIS_API_PASSWORD} ${REDIS_SAFETY_PASSWORD} ${REDIS_HEALTH_PASSWORD}' \
+  < /etc/han-redis/users.acl.template > /tmp/users.acl
+unset REDIS_API_PASSWORD REDIS_SAFETY_PASSWORD REDIS_HEALTH_PASSWORD
+
+exec redis-server /etc/han-redis/redis.conf \
+  --aclfile /tmp/users.acl \
+  --maxmemory "${REDIS_MAXMEMORY:-384mb}" \
+  --maxmemory-policy "${REDIS_EVICTION_POLICY:-volatile-lru}"
@@ -0,0 +1,4 @@
+user default off
+user api_backend on >${REDIS_API_PASSWORD} ~han:api:* ~han:rt:* ~han:coord:* &han:rt:* +@read +@write +@connection +@scripting +publish +subscribe +psubscribe -flushall -flushdb -config -module -keys
+user message_safety on >${REDIS_SAFETY_PASSWORD} ~han:safety:* +@read +@write +@connection +@scripting -flushall -flushdb -config -module -keys -publish -subscribe -psubscribe
+user ops_health on >${REDIS_HEALTH_PASSWORD} +ping +info +client|id -select