yangzhaohan
fb2c3a6cae
- Tool 接口 + Registry 注册中心，工具模块化插拔 - system 工具：health / info - database 工具：db_query / db_tables / db_table_info / db_explain（四层 SQL 安全） - docker 工具：docker_ps / docker_logs / docker_inspect（白名单 + 大小限制） - middleware：auth（JWT+APIKey）/ ratelimit（令牌桶）/ audit（slog 结构化） - stdio / SSE 双传输模式，Viper 多环境配置 - Dockerfile 多阶段构建（golang:alpine → scratch），~15MB 镜像 - docker-compose.yml 一键部署 + 安全加固（read_only / no-new-privileges / cap_drop） - go build ./... / go vet ./... / go test ./... 全部通过 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
58 lines
1.5 KiB
YAML
58 lines
1.5 KiB
YAML
version: "3.8"
|
|
|
|
services:
|
|
ops-mcp:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
image: ops-mcp:latest
|
|
container_name: ops-mcp
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${OPS_MCP_PORT:-8080}:8080"
|
|
environment:
|
|
- OPS_MCP_ENV=${OPS_MCP_ENV:-prod}
|
|
# 数据库密码通过环境变量注入，不写在配置文件里
|
|
- OPS_MCP_DATABASES_MAIN_DB_DSN=postgres://ops_readonly:${DB_PASSWORD}@db:5432/ops?sslmode=disable&default_transaction_read_only=on
|
|
- JWT_SECRET=${JWT_SECRET}
|
|
volumes:
|
|
# 只读挂载 Docker socket，允许查询容器信息但无法执行写操作
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
# 挂载自定义配置文件（可选）
|
|
- ./config/prod.yaml:/config/prod.yaml:ro
|
|
# 安全加固
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=10M,mode=1777
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
# 健康检查
|
|
healthcheck:
|
|
test: ["CMD", "/server", "-env=prod"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
# 可选：本地开发用的 PostgreSQL
|
|
db:
|
|
image: postgres:17-alpine
|
|
container_name: ops-mcp-db
|
|
restart: unless-stopped
|
|
environment:
|
|
- POSTGRES_USER=ops_readonly
|
|
- POSTGRES_PASSWORD=${DB_PASSWORD:-devpassword}
|
|
- POSTGRES_DB=ops
|
|
ports:
|
|
- "5432:5432"
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
profiles:
|
|
- dev
|
|
- full
|
|
|
|
volumes:
|
|
pgdata:
|