mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 09:23:25 +00:00
1a929e3e24
- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests. - Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401. - Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion. - Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning. - Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base. - Update manifests, production checklist, architecture/security docs and add an SSO preflight script. BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
41 lines
1.5 KiB
Plaintext
41 lines
1.5 KiB
Plaintext
# Reference environment names for local runs. Nothing sources this file
|
|
# automatically: export the values or pass them with `docker run -e/--env-file`.
|
|
# Copy it to .env if you prefer --env-file. Never commit a real key.
|
|
#
|
|
# The version values below are documentation only: versions.env is the single
|
|
# source of truth, and scripts/check-versions.sh fails if they drift.
|
|
|
|
# --- Main DSH Web image (root Dockerfile) ---
|
|
DEEPSEEK_API_KEY=
|
|
# Optional additional provider keys consumed by DSH. For Docker, pass them with
|
|
# -e; the Kubernetes examples inject them through the optional
|
|
# dsh-provider-keys-extra Secret.
|
|
OPENROUTER_API_KEY=
|
|
GEMINI_API_KEY=
|
|
NVIDIA_API_KEY=
|
|
OPENAI_API_KEY=
|
|
ANTHROPIC_API_KEY=
|
|
GROQ_API_KEY=
|
|
XAI_API_KEY=
|
|
MISTRAL_API_KEY=
|
|
TOGETHER_API_KEY=
|
|
CEREBRAS_API_KEY=
|
|
AI_GATEWAY_API_KEY=
|
|
HF_TOKEN=
|
|
DSH_VERSION=dsh-v0.2.1-rc.5
|
|
# Full upstream commit SHA that DSH_VERSION resolves to; the main image build
|
|
# fails if the clone's HEAD differs (guards against a moved tag).
|
|
DSH_COMMIT=b830ec950faba0a46dda564be3e2d854afed94f1
|
|
RELEASE_REVISION=
|
|
PNPM_VERSION=11.28.5
|
|
# Container port, and the host port published by "make run".
|
|
DSH_PORT=3080
|
|
# Comma/space separated extra Host allow-list entries for DSH (for a proxy or
|
|
# public hostname). localhost and 127.0.0.1 are always trusted.
|
|
DSH_TRUSTED_HOSTS=
|
|
|
|
# The example gateway's runtime settings (NAMESPACE, POOL, IDLE_TIMEOUT,
|
|
# WAKE_TIMEOUT, COOKIE_*, AUTH_PROXY_HEADER, ...) are documented in
|
|
# examples/dsh-agents-as-a-service/gateway/README.md and set in
|
|
# examples/dsh-agents-as-a-service/manifests/50-gateway.yaml.
|