Реализация на отдельных двух машинах с протестированным взаимодействием по проверке сообщений

VM1_app/codebase/backend/redis/Dockerfile

@@ -5,6 +5,7 @@ COPY redis.conf /etc/han-redis/redis.conf
 COPY users.acl.template /etc/han-redis/users.acl.template
 COPY scripts/entrypoint.sh /usr/local/lib/han/entrypoint.sh
 RUN sed -i 's/\r$//' /usr/local/lib/han/entrypoint.sh \
+    && /bin/sh -n /usr/local/lib/han/entrypoint.sh \
     && chmod 0555 /usr/local/lib/han/entrypoint.sh \
     && chmod 0444 /etc/han-redis/*
 USER redis

VM1_app/codebase/backend/redis/docker-compose.yml

@@ -1,14 +1,11 @@
 services:
   redis:
-    build:
-      context: .
-    image: han-chat-redis:${RELEASE_VERSION:-local}
+    image: ${REDIS_IMAGE:?REDIS_IMAGE must be pinned by digest}
     environment:
       REDIS_MAXMEMORY: ${REDIS_MAXMEMORY:-384mb}
       REDIS_EVICTION_POLICY: ${REDIS_EVICTION_POLICY:-volatile-lru}
     secrets:
       - redis_api_password
-      - redis_safety_password
       - redis_health_password
     expose: ["6379"]
     volumes:
@@ -27,7 +24,9 @@ services:
       - /tmp:size=8m,mode=1777
     security_opt: ["no-new-privileges:true"]
     cap_drop: ["ALL"]
+    pids_limit: 128
     mem_limit: 512m
+    cpus: 0.5
     ulimits:
       core: {soft: 0, hard: 0}
       nofile: {soft: 65536, hard: 65536}
@@ -38,7 +37,5 @@ services:
 secrets:
   redis_api_password:
     file: ${HAN_SECRETS_DIR:-/run/han-chat/secrets}/REDIS_API_PASSWORD
-  redis_safety_password:
-    file: ${HAN_SECRETS_DIR:-/run/han-chat/secrets}/REDIS_SAFETY_PASSWORD
   redis_health_password:
     file: ${HAN_SECRETS_DIR:-/run/han-chat/secrets}/REDIS_HEALTH_PASSWORD

VM1_app/codebase/backend/redis/scripts/entrypoint.sh

@@ -3,7 +3,6 @@ set -eu
 
 for item in \
   REDIS_API_PASSWORD:redis_api_password \
-  REDIS_SAFETY_PASSWORD:redis_safety_password \
   REDIS_HEALTH_PASSWORD:redis_health_password
 do
   name=${item%%:*}
@@ -21,9 +20,9 @@ do
 done
 
 umask 077
-envsubst '${REDIS_API_PASSWORD} ${REDIS_SAFETY_PASSWORD} ${REDIS_HEALTH_PASSWORD}' \
+envsubst '${REDIS_API_PASSWORD} ${REDIS_HEALTH_PASSWORD}' \
   < /etc/han-redis/users.acl.template > /tmp/users.acl
-unset REDIS_API_PASSWORD REDIS_SAFETY_PASSWORD REDIS_HEALTH_PASSWORD
+unset REDIS_API_PASSWORD REDIS_HEALTH_PASSWORD
 
 exec redis-server /etc/han-redis/redis.conf \
   --aclfile /tmp/users.acl \

VM1_app/codebase/backend/redis/users.acl.template

@@ -1,4 +1,3 @@
 user default off
 user api_backend on >${REDIS_API_PASSWORD} ~han:api:* ~han:rt:* ~han:coord:* &han:rt:* +@read +@write +@connection +@scripting +publish +subscribe +psubscribe -flushall -flushdb -config -module -keys
-user message_safety on >${REDIS_SAFETY_PASSWORD} ~han:safety:* +@read +@write +@connection +@scripting -flushall -flushdb -config -module -keys -publish -subscribe -psubscribe
 user ops_health on >${REDIS_HEALTH_PASSWORD} +ping +info +client|id -select