Zakaria
2db02ed369
- Key login throttling on the real peer address; read X-Forwarded-For only from FLOCI_UI_TRUSTED_PROXIES (right-most untrusted hop). Add a per-IP limit across usernames so one attacker can no longer lock out the admin. - Require an OIDC allow-list (FLOCI_UI_OIDC_ALLOWED_GROUPS / _EMAILS, or FLOCI_UI_OIDC_ALLOW_ALL_USERS=true); fall back to UserInfo for groups when the ID token omits them. Redirect IdP and token errors to /login instead of returning 500s; cache discovery and JWKS. - Sweep expired sessions, attempts and pending OIDC requests every 60s, cap each map, and throttle OIDC sign-in starts per IP. - Fix the .ts import extension that broke the API type-check. - Add auth.test.ts and document the new settings.
125 lines
3.9 KiB
YAML
125 lines
3.9 KiB
YAML
services:
|
|
floci-ui:
|
|
build:
|
|
context: ./packages/frontend
|
|
dockerfile: Dockerfile.dev
|
|
volumes:
|
|
- ./packages/frontend/src:/app/src
|
|
- ./packages/frontend/index.html:/app/index.html
|
|
- ./packages/frontend/vite.config.ts:/app/vite.config.ts
|
|
- ./packages/frontend/tsconfig.json:/app/tsconfig.json
|
|
- ./packages/frontend/tsconfig.node.json:/app/tsconfig.node.json
|
|
ports:
|
|
- "4500:4500"
|
|
environment:
|
|
API_TARGET: http://floci-api:4501
|
|
VITE_USE_POLLING: "true"
|
|
depends_on:
|
|
- floci-api
|
|
networks:
|
|
- floci_default
|
|
|
|
floci-api:
|
|
build:
|
|
context: ./packages/api
|
|
dockerfile: Dockerfile.dev
|
|
volumes:
|
|
- ./packages/api/src:/app/src
|
|
ports:
|
|
- "4501:4501"
|
|
environment:
|
|
FLOCI_ENDPOINT: http://floci:4566
|
|
FLOCI_EC2_SSH_HOST: host.docker.internal
|
|
FLOCI_AZURE_ENDPOINT: http://floci-az:4577
|
|
AWS_REGION: us-east-1
|
|
AWS_ACCESS_KEY_ID: test
|
|
AWS_SECRET_ACCESS_KEY: test
|
|
FLOCI_GCP_ENDPOINT: http://floci-gcp:4588
|
|
FLOCI_GCP_PROJECT: floci-local
|
|
PORT: "4501"
|
|
FLOCI_UI_ADMIN_USER: ${FLOCI_UI_ADMIN_USER:-}
|
|
FLOCI_UI_ADMIN_PASSWORD_HASH: ${FLOCI_UI_ADMIN_PASSWORD_HASH:-}
|
|
FLOCI_UI_SESSION_SECRET: ${FLOCI_UI_SESSION_SECRET:-}
|
|
FLOCI_UI_SECURE_COOKIES: ${FLOCI_UI_SECURE_COOKIES:-false}
|
|
FLOCI_UI_AUTH_MODE: ${FLOCI_UI_AUTH_MODE:-local}
|
|
FLOCI_UI_OIDC_ISSUER: ${FLOCI_UI_OIDC_ISSUER:-}
|
|
FLOCI_UI_OIDC_CLIENT_ID: ${FLOCI_UI_OIDC_CLIENT_ID:-}
|
|
FLOCI_UI_OIDC_CLIENT_SECRET: ${FLOCI_UI_OIDC_CLIENT_SECRET:-}
|
|
FLOCI_UI_PUBLIC_BASE_URL: ${FLOCI_UI_PUBLIC_BASE_URL:-}
|
|
FLOCI_UI_OIDC_ALLOWED_GROUPS: ${FLOCI_UI_OIDC_ALLOWED_GROUPS:-}
|
|
FLOCI_UI_OIDC_ALLOWED_EMAILS: ${FLOCI_UI_OIDC_ALLOWED_EMAILS:-}
|
|
FLOCI_UI_OIDC_ALLOW_ALL_USERS: ${FLOCI_UI_OIDC_ALLOW_ALL_USERS:-false}
|
|
FLOCI_UI_TRUSTED_PROXIES: ${FLOCI_UI_TRUSTED_PROXIES:-}
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
depends_on:
|
|
- floci
|
|
networks:
|
|
- floci_default
|
|
|
|
floci:
|
|
image: floci/floci:latest-compat
|
|
ports:
|
|
- "4566:4566"
|
|
# RDS data-plane proxies. CreateDBInstance allocates ports in 7001-7099.
|
|
- "7001-7099:7001-7099"
|
|
volumes:
|
|
# Floci runs Lambda functions in throwaway containers, so it needs the host
|
|
# Docker daemon. Without this, invoke fails with "Failed to start Lambda
|
|
# container". This grants the emulator control of host Docker — acceptable
|
|
# for a local dev stack, and the same mount the README's docker run uses.
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ./data:/app/data
|
|
- ./init/ready.d:/etc/floci/init/ready.d:ro
|
|
- ./init/files:/etc/floci/init/files:ro
|
|
environment:
|
|
FLOCI_STORAGE_MODE: persistent
|
|
networks:
|
|
floci_default:
|
|
aliases:
|
|
- localhost.floci.io
|
|
|
|
# Multi-cloud emulators — enabled with the "multicloud" profile:
|
|
# docker compose --profile multicloud up
|
|
floci-az:
|
|
image: floci/floci-az
|
|
profiles: ["multicloud"]
|
|
ports:
|
|
- "4577:4577"
|
|
networks:
|
|
- floci_default
|
|
|
|
floci-gcp:
|
|
image: floci/floci-gcp
|
|
profiles: ["multicloud"]
|
|
ports:
|
|
- "4588:4588"
|
|
volumes:
|
|
# Cloud SQL instances are real Postgres containers; see the note on `floci`.
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
networks:
|
|
- floci_default
|
|
|
|
floci-seed:
|
|
build:
|
|
context: ./init
|
|
dockerfile: Dockerfile.seed
|
|
profiles: ["multicloud"]
|
|
command: ["/bin/sh", "/etc/floci/init/seed-clouds.sh"]
|
|
volumes:
|
|
- ./init:/etc/floci/init:ro
|
|
environment:
|
|
FLOCI_AZURE_ENDPOINT: http://floci-az:4577
|
|
FLOCI_AZURE_ACCOUNT_NAME: devstoreaccount1
|
|
FLOCI_GCP_ENDPOINT: http://floci-gcp:4588
|
|
FLOCI_GCP_PROJECT: floci-local
|
|
depends_on:
|
|
- floci-az
|
|
- floci-gcp
|
|
networks:
|
|
- floci_default
|
|
|
|
networks:
|
|
floci_default:
|
|
name: floci_default
|