mirror of
https://github.com/BigBodyCobain/Shadowbroker.git
synced 2026-06-03 04:48:03 +02:00
anoracleofra-code
fc9eff865e
New features: - In-app auto-updater with confirmation dialog, manual download fallback, restart polling, and protected file safety net - Ship layers split into 4 independent toggles (Military/Carriers, Cargo/Tankers, Civilian, Cruise/Passenger) with per-category counts - Stable entity IDs using MMSI/callsign instead of volatile array indices - Dismissible threat alert bubbles (session-scoped, survives data refresh) Performance: - GDELT title fetching is now non-blocking (background enrichment) - Removed duplicate startup fetch jobs - Docker healthcheck start_period 15s → 90s Bug fixes: - Removed fake intelligence assessment generator (OSINT-only policy) - Fixed carrier tracker GDELT 429/TypeError crash - Fixed ETag collision (full payload hash) - Added concurrent /api/refresh guard Contributors: @imqdcr (ship split + stable IDs), @csysp (dismissible alerts, PR #48) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Former-commit-id: a2c4c67da54345393f70a9b33b52e7e4fd6c049f
61 lines
2.0 KiB
Markdown
61 lines
2.0 KiB
Markdown
# Docker Secrets
|
|
|
|
The backend supports [Docker Swarm secrets](https://docs.docker.com/engine/swarm/secrets/)
|
|
so you never have to put API keys in environment variables or `.env` files.
|
|
|
|
## How it works
|
|
|
|
At startup (before any service modules are imported), `main.py` checks a
|
|
list of secret-capable variables. For each variable `VAR`, if the
|
|
environment variable `VAR_FILE` is set (typically `/run/secrets/VAR`),
|
|
the file is read, its content is trimmed, and the result is injected into
|
|
`os.environ[VAR]`. All downstream code sees a normal environment variable.
|
|
|
|
## Supported variables
|
|
|
|
| Variable | Purpose |
|
|
|---|---|
|
|
| `AIS_API_KEY` | AISStream.io WebSocket key |
|
|
| `OPENSKY_CLIENT_ID` | OpenSky Network client ID |
|
|
| `OPENSKY_CLIENT_SECRET` | OpenSky Network client secret |
|
|
| `LTA_ACCOUNT_KEY` | Singapore LTA DataMall key |
|
|
| `CORS_ORIGINS` | Allowed CORS origins (comma-separated) |
|
|
|
|
## docker-compose.yml example
|
|
|
|
```yaml
|
|
services:
|
|
backend:
|
|
build:
|
|
context: ./backend
|
|
environment:
|
|
- AIS_API_KEY_FILE=/run/secrets/AIS_API_KEY
|
|
- OPENSKY_CLIENT_ID_FILE=/run/secrets/OPENSKY_CLIENT_ID
|
|
- OPENSKY_CLIENT_SECRET_FILE=/run/secrets/OPENSKY_CLIENT_SECRET
|
|
- LTA_ACCOUNT_KEY_FILE=/run/secrets/LTA_ACCOUNT_KEY
|
|
secrets:
|
|
- AIS_API_KEY
|
|
- OPENSKY_CLIENT_ID
|
|
- OPENSKY_CLIENT_SECRET
|
|
- LTA_ACCOUNT_KEY
|
|
|
|
secrets:
|
|
AIS_API_KEY:
|
|
file: ./secrets/ais_api_key.txt
|
|
OPENSKY_CLIENT_ID:
|
|
file: ./secrets/opensky_client_id.txt
|
|
OPENSKY_CLIENT_SECRET:
|
|
file: ./secrets/opensky_client_secret.txt
|
|
LTA_ACCOUNT_KEY:
|
|
file: ./secrets/lta_account_key.txt
|
|
```
|
|
|
|
Each secret file should contain only the raw key value (whitespace is trimmed).
|
|
|
|
## Notes
|
|
|
|
- The secrets loop runs **before** any FastAPI service imports, so modules
|
|
that read `os.environ` at import time see the injected values.
|
|
- Missing or empty secret files log a warning; the backend still starts.
|
|
- You can mix approaches: use `_FILE` for some keys and plain env vars for others.
|