Max Ronzhin
5e42f6d11b
Redis without a password was the root cause of the security incident (cron miner via unauthenticated replication RCE, see .forcc/deploy/SESSION2-FINDINGS.md). Loopback binding alone doesn't protect against a compromised container inside the same compose network, so wire REDIS_PASSWORD as a required secret everywhere redis is used: backend/worker/worker-transcriber(-gpu), redis-exporter, livekit and egress (via rendered templates). docker compose now refuses to start without it instead of silently running unauthenticated.
53 lines
954 B
Plaintext
53 lines
954 B
Plaintext
# Python
|
|
.venv/
|
|
venv/
|
|
__pycache__/
|
|
*.py[cod]
|
|
*.egg-info/
|
|
.mypy_cache/
|
|
.ruff_cache/
|
|
.pytest_cache/
|
|
.coverage
|
|
htmlcov/
|
|
# uv
|
|
.uv/
|
|
uv.lock.bak
|
|
|
|
# Node / frontend
|
|
node_modules/
|
|
dist/
|
|
.vite/
|
|
frontend/coverage/
|
|
|
|
# Env / secrets
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
|
|
# Models
|
|
*.gguf
|
|
|
|
# Editors / OS
|
|
.DS_Store
|
|
.idea/
|
|
.vscode/
|
|
|
|
# Docker
|
|
deploy/**/*.local.yml
|
|
|
|
# Сгенерированные из *.template скриптом deploy/render-templates.sh —
|
|
# содержат реальные секреты/IP, рендерятся перед `docker compose up`.
|
|
deploy/coturn/turnserver.conf
|
|
deploy/livekit/livekit.yaml
|
|
deploy/egress/egress.yaml
|
|
|
|
# Артефакты Celery beat
|
|
celerybeat-schedule*.db
|
|
celerybeat-schedule
|
|
|
|
# Загруженные медиа-файлы (аватары) — dev-каталог backend/media
|
|
backend/media/
|
|
|
|
# Рабочая папка Claude Code (промпты, агенты, заметки) — не в репозиторий
|
|
.forcc/
|