pratapalakshmiandGitHub
da321d0eb7
- Added support for AWS Secrets Manager in the database configuration to fetch credentials for the follower database and Plane PI database. - Updated connection methods to utilize secrets when available and AWS credentials are present. - Introduced new utility functions for fetching secrets from AWS Secrets Manager. - Enhanced the Celery configuration to support AWS Secrets Manager for message broker credentials. - Updated example environment file to include new AWS Secrets Manager configuration options. - Added support for AWS Secrets Manager to retrieve model API keys in LLMConfig. - Updated .env.example to include new environment variables for AWS Secrets Manager. - Modified S3 client configuration to use default credential chain when explicit credentials are not provided. - Improved handling of AWS Bedrock embedding model credentials. - Updated OpenSearch client to support AWS IAM authentication using SigV4 when AWS credentials are available. - Modified Celery configuration to allow for dynamic construction of the broker URL using AWS Secrets Manager for credentials. - Enhanced environment configuration examples to reflect new AWS-related options for OpenSearch and message broker. - Improved handling of authentication methods in the vector database client, prioritizing AWS credentials when available. - Updated documentation to clarify the use of AWS Secrets Manager for credential injection in the Celery setup. - Updated database connection URL methods to use URL encoding for user and password fields, ensuring special characters are handled correctly. - Modified Alembic configuration to escape '%' in the SQLAlchemy URL to preserve URL-encoded passwords. - Improved the `test_ml_model` method in the VectorStore class to support both single and batch input formats based on model capabilities. - Adjusted embedding model validation to respect batch processing capabilities when testing model inference. - Updated the Alembic configuration to remove URL encoding for the SQLAlchemy connection URL, ensuring it uses the correct format. - Enhanced error logging in the database migration command to provide clearer messages regarding migration failures, specifically addressing database connectivity and credential issues. - Introduced asynchronous authentication methods for the OpenSearch client, allowing for improved performance in handling requests. - Added a new function to build authentication kwargs specifically for the asynchronous client, utilizing AWS SigV4 async signer when AWS credentials are available. - Updated the VectorStore class to utilize both synchronous and asynchronous authentication methods for OpenSearch connections. - Added `su-exec` to the Dockerfile for user switching to enhance security. - Created a new user group and user for the Plane application in the Dockerfile. - Updated entrypoint scripts to switch to the `plane` user if executed as root, improving security during execution. - Ensured proper ownership of the application directory for the new user. - Modified entrypoint scripts for the FastAPI application, Celery beat scheduler, and Celery worker to use `exec` for starting processes. This change ensures that the Python processes replace the shell process, allowing for better signal handling and resource management. - Added a new user group and user for the Plane application in the Dockerfiles for both admin and web apps to improve security. - Updated ownership of relevant directories and files to ensure proper permissions for the new user. - Configured Nginx to use a PID file for better process management.
102 lines
2.9 KiB
Docker
102 lines
2.9 KiB
Docker
FROM node:22-alpine AS base
|
|
|
|
WORKDIR /app
|
|
|
|
ENV TURBO_TELEMETRY_DISABLED=1
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PATH"
|
|
ENV CI=1
|
|
|
|
RUN corepack enable pnpm
|
|
|
|
# =========================================================================== #
|
|
|
|
FROM base AS builder
|
|
|
|
ARG TURBO_VERSION=2.8.13
|
|
RUN pnpm add -g turbo@${TURBO_VERSION}
|
|
|
|
COPY . .
|
|
|
|
# Create a pruned workspace for just the admin app
|
|
RUN turbo prune --scope=admin --docker
|
|
|
|
# =========================================================================== #
|
|
|
|
FROM base AS installer
|
|
|
|
# Public envs required at build time (pick up via process.env)
|
|
ARG VITE_API_BASE_URL=""
|
|
ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
|
|
ARG VITE_API_BASE_PATH="/api"
|
|
ENV VITE_API_BASE_PATH=$VITE_API_BASE_PATH
|
|
|
|
ARG VITE_ADMIN_BASE_URL=""
|
|
ENV VITE_ADMIN_BASE_URL=$VITE_ADMIN_BASE_URL
|
|
ARG VITE_ADMIN_BASE_PATH="/god-mode/"
|
|
ENV VITE_ADMIN_BASE_PATH=$VITE_ADMIN_BASE_PATH
|
|
|
|
ARG VITE_SPACE_BASE_URL=""
|
|
ENV VITE_SPACE_BASE_URL=$VITE_SPACE_BASE_URL
|
|
ARG VITE_SPACE_BASE_PATH="/spaces"
|
|
ENV VITE_SPACE_BASE_PATH=$VITE_SPACE_BASE_PATH
|
|
|
|
ARG VITE_LIVE_BASE_URL=""
|
|
ENV VITE_LIVE_BASE_URL=$VITE_LIVE_BASE_URL
|
|
ARG VITE_LIVE_BASE_PATH="/live"
|
|
ENV VITE_LIVE_BASE_PATH=$VITE_LIVE_BASE_PATH
|
|
|
|
ARG VITE_WEB_BASE_URL=""
|
|
ENV VITE_WEB_BASE_URL=$VITE_WEB_BASE_URL
|
|
ARG VITE_WEB_BASE_PATH=""
|
|
ENV VITE_WEB_BASE_PATH=$VITE_WEB_BASE_PATH
|
|
|
|
ARG VITE_WEBSITE_URL="https://plane.so"
|
|
ENV VITE_WEBSITE_URL=$VITE_WEBSITE_URL
|
|
ARG VITE_SUPPORT_EMAIL="[email protected]"
|
|
ENV VITE_SUPPORT_EMAIL=$VITE_SUPPORT_EMAIL
|
|
|
|
COPY .gitignore .gitignore
|
|
COPY --from=builder /app/out/json/ .
|
|
COPY --from=builder /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
|
|
|
|
# Copy full directory structure before fetch to ensure all package.json files are available
|
|
COPY --from=builder /app/out/full/ .
|
|
COPY turbo.json turbo.json
|
|
|
|
# Fetch dependencies to cache store, then install offline with dev deps
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm fetch --store-dir=/pnpm/store
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store CI=true pnpm install --offline --frozen-lockfile --store-dir=/pnpm/store --prod=false
|
|
|
|
# Build only the admin package
|
|
RUN pnpm turbo run build --filter=admin
|
|
|
|
# =========================================================================== #
|
|
|
|
FROM nginx:1.29-alpine AS production
|
|
|
|
COPY apps/admin/nginx/nginx.conf /etc/nginx/nginx.conf
|
|
COPY --from=installer /app/apps/admin/build/client /usr/share/nginx/html/god-mode
|
|
|
|
COPY LICENSE.txt .
|
|
RUN mkdir -p /usr/share/licenses/plane/
|
|
COPY LICENSE.txt /usr/share/licenses/plane/LICENSE.txt
|
|
|
|
RUN addgroup -g 1000 plane && adduser -u 1000 -G plane -s /bin/sh -D plane
|
|
|
|
RUN chown -R plane:plane \
|
|
/usr/share/nginx/html \
|
|
/var/cache/nginx \
|
|
/var/log/nginx \
|
|
/etc/nginx/conf.d && \
|
|
touch /var/run/nginx.pid && \
|
|
chown plane:plane /var/run/nginx.pid
|
|
|
|
USER plane
|
|
|
|
EXPOSE 3000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD curl -fsS http://127.0.0.1:3000/ >/dev/null || exit 1
|
|
|
|
CMD ["nginx", "-g", "daemon off;"] |