02b81f0113
Security (fail-secure for production): - Refuse to start without PPM_PASSWORD/PPM_PASSWORD_HASH unless PPM_ALLOW_NO_AUTH=1 (local dev only) - Add login rate limiting (5 failures / 60s per client), enforced inside SessionManager.login so it cannot be bypassed at the endpoint layer - compose defaults PPM_COOKIE_SECURE=true for HTTPS behind reverse proxy - Add .dockerignore to keep runtime data/out of the image Features: - Task timeline gantt on home page (week/month zoom, horizontal scroll, infinite-arrow for open-ended dates, CSS Grid layout) - Duration metrics gain a second/minute/hour unit for input & display (canonical storage stays integer seconds) - Per-metric progress bars on home page (no more merged average) - Backfill historical records via date picker in the today-record card - Admin panel: stats overview, JSON import/restore, full task list mgmt Fixes: - Nullable task startDate; summarize handles missing start date - Task dialog cancel/close no longer submits the form - Import validates whole backup first, rejects path traversal, rebuilds archives, and replaces stale files Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
28 lines
859 B
YAML
28 lines
859 B
YAML
services:
|
||
progress-monitor:
|
||
build: .
|
||
restart: unless-stopped
|
||
ports:
|
||
- "127.0.0.1:${PPM_PORT:-8000}:8000"
|
||
environment:
|
||
PPM_DATA_DIR: /app/data
|
||
PPM_LAYOUT_DIR: /app/config/layouts
|
||
PPM_PASSWORD_HASH: ${PPM_PASSWORD_HASH:-}
|
||
PPM_PASSWORD: ${PPM_PASSWORD:-}
|
||
PPM_COOKIE_SECURE: ${PPM_COOKIE_SECURE:-true}
|
||
# 生产默认 fail-secure：不配置密码则拒绝启动。
|
||
# 不要在生产环境打开 PPM_ALLOW_NO_AUTH，仅本地联调可用。
|
||
PPM_ALLOW_NO_AUTH: ${PPM_ALLOW_NO_AUTH:-false}
|
||
volumes:
|
||
- ppm-data:/app/data
|
||
- ./config/layouts:/app/config/layouts:ro
|
||
healthcheck:
|
||
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/api/health')"]
|
||
interval: 30s
|
||
timeout: 5s
|
||
retries: 3
|
||
|
||
volumes:
|
||
ppm-data:
|
||
|