google-labs-jules[bot]
d22175310a
🚨 Severity: HIGH 💡 Vulnerability: User-provided IMAP `host` in `_test_imap_connection` and `pull_inbox` was not validated against private IPs, creating an SSRF risk. 🎯 Impact: Attackers could abuse the endpoints to port-scan or interact with internal/private network services. 🔧 Fix: Integrated `is_private_ip` from `app.utils.network` to block connections resolving to private, loopback, link-local, or reserved IPs. ✅ Verification: Ran `test_imap_tasks.py` and `test_api_imap_accounts.py` successfully. Checked `ruff` output and diffs. Removed all scratch files from the commit. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
94 lines
2.4 KiB
YAML
94 lines
2.4 KiB
YAML
services:
|
|
api:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: document_api
|
|
restart: always
|
|
|
|
# We'll keep the code in /app, but set working_dir to the shared data directory
|
|
working_dir: /workdir
|
|
|
|
# We'll run uvicorn from the container's /app code
|
|
command: ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--proxy-headers"]
|
|
|
|
# Environment variables
|
|
environment:
|
|
- PYTHONPATH=/app
|
|
env_file:
|
|
- .env
|
|
|
|
# Expose container's 8000 -> Host's 8000
|
|
ports:
|
|
- "8000:8000"
|
|
|
|
depends_on:
|
|
- redis
|
|
- worker
|
|
|
|
# Mount the shared working directory for data
|
|
volumes:
|
|
- /var/docparse/workdir:/workdir
|
|
|
|
worker:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: document_worker
|
|
restart: always
|
|
|
|
# same shared working directory
|
|
working_dir: /workdir
|
|
|
|
command: ["celery", "-A", "app.celery_worker", "worker", "-B", "--loglevel=info", "-Q", "document_processor,default,celery"]
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
- PYTHONPATH=/app
|
|
|
|
depends_on:
|
|
- redis
|
|
- gotenberg
|
|
|
|
# Mount the shared directory
|
|
volumes:
|
|
- /var/docparse/workdir:/workdir
|
|
|
|
gotenberg:
|
|
image: gotenberg/gotenberg:latest
|
|
container_name: gotenberg
|
|
restart: always
|
|
|
|
meilisearch:
|
|
image: getmeili/meilisearch:latest
|
|
container_name: document_meilisearch
|
|
restart: always
|
|
environment:
|
|
- MEILI_NO_ANALYTICS=true
|
|
volumes:
|
|
- /var/docparse/meilisearch:/meili_data
|
|
|
|
redis:
|
|
image: redis:alpine
|
|
container_name: document_redis
|
|
restart: always
|
|
|
|
# Optional: standalone docs server using MkDocs Material (live-reload during development).
|
|
# Start with: docker compose --profile docs up docs
|
|
# Access at: http://localhost:8001
|
|
# Note: The /help route in the main app serves pre-built docs from the Docker image.
|
|
# This service is for content authors who want live preview while editing documentation.
|
|
docs:
|
|
image: squidfunk/mkdocs-material:latest
|
|
container_name: docuelevate_docs
|
|
restart: "no"
|
|
profiles:
|
|
- docs
|
|
volumes:
|
|
- ./docs:/docs/docs
|
|
- ./mkdocs.yml:/docs/mkdocs.yml
|
|
working_dir: /docs
|
|
command: ["serve", "--dev-addr=0.0.0.0:8000", "--config-file=/docs/mkdocs.yml"]
|
|
ports:
|
|
- "8001:8000"
|