xfy
b5c3c0954f
Security: - Enforce client_max_body_size in HTTP/2 and HTTP/3 adapters before buffering - Use trusted-proxy-aware client IP extraction for access control and rate limiting - Include Host and Vary headers in proxy cache key to prevent cache poisoning - Harden static file path traversal check with filepath.Clean + prefix validation - Honor proxy_ssl config for WebSocket upstream TLS Proxy/handler bugs: - Decrement WebSocket connection count immediately on return (not deferred in retry loop) - Remove ineffective headersPool - Coalesce concurrent background cache refreshes with singleflight Dev/build: - Fix Makefile run and test-config targets - Remove broken wget healthcheck from docker-compose - Add missing integration build tags - Fix go vet warnings in tests CI: - Run golangci-lint and integration tests in Gitea Actions Refs: docs/superpowers/plans/2026-06-17-fix-review-issues.md
42 lines
1.1 KiB
YAML
42 lines
1.1 KiB
YAML
services:
|
||
lolly:
|
||
build: .
|
||
# 防止僵尸进程（lolly 无 PID 1 处理）
|
||
init: true
|
||
ports:
|
||
- "8080:8080"
|
||
# HTTP/3 (QUIC) - 需要 SSL 证书
|
||
# - "443:443/tcp"
|
||
# - "443:443/udp"
|
||
volumes:
|
||
- ./lolly.yaml:/etc/lolly/lolly.yaml:ro
|
||
# 静态文件目录
|
||
- ./html:/var/www/html:ro
|
||
# SSL 证书（可选）
|
||
# - ./certs:/etc/lolly/certs:ro
|
||
# 日志持久化（可选）
|
||
# - ./logs:/var/log/lolly
|
||
environment:
|
||
# 配合容器内存限制设置 GC 目标
|
||
- GOMEMLIMIT=750MiB
|
||
# 资源限制（可选）
|
||
# deploy:
|
||
# resources:
|
||
# limits:
|
||
# memory: 1G
|
||
# reservations:
|
||
# memory: 256M
|
||
restart: unless-stopped
|
||
# Scratch 镜像没有 wget/curl，如需健康检查请使用外部 HTTP 探针或挂载包含工具的 sidecar。
|
||
# healthcheck:
|
||
# test: ["CMD", "/lolly", "--healthcheck"]
|
||
# interval: 30s
|
||
# timeout: 10s
|
||
# retries: 3
|
||
# start_period: 10s
|
||
|
||
# 示例后端服务（用于反向代理测试）
|
||
# backend:
|
||
# image: nginx:alpine
|
||
# ports:
|
||
# - "8000:80" |