ericoalmeida/rastro-deploy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

compose: rastro-node v3.1 + certificado A1 por variável secreta (DFE_CERT_PFX_BASE64)

Browse Source 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hpjc1TdaRAHoYC6wCFw19E
This commit is contained in:
Erico Mac
2026-09-16 18:11:29 -03:00
co-authored by Claude Opus 5
parent cfdf9346af
commit b449031b24
3 changed files with 26 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+2
View File
@@ -60,6 +60,8 @@ ONE_IND_RESUMO=0
# ---- Certificado A1 (o .pfx precisa ir para a máquina nova — ver runbook) ---- # ---- Certificado A1 (o .pfx precisa ir para a máquina nova — ver runbook) ----
CERT_HOST_DIR=/data/rastro/certificado CERT_HOST_DIR=/data/rastro/certificado
DFE_CERT_PFX_CONTAINER_PATH=/certs/11de260603452f3c.pfx DFE_CERT_PFX_CONTAINER_PATH=/certs/11de260603452f3c.pfx
# Sem acesso ao disco do servidor: o .pfx em base64 (base64 -i xxx.pfx | tr -d '\n')
DFE_CERT_PFX_BASE64=
DFE_CERT_PASSPHRASE= # copie do .env antigo DFE_CERT_PASSPHRASE= # copie do .env antigo
DFE_TLS_REJECT_UNAUTHORIZED=false DFE_TLS_REJECT_UNAUTHORIZED=false
docker-compose.yaml
+12 -7
View File
@@ -10,8 +10,8 @@
# • Teradata SEFAZ (processor, backend, analytics): nós COP por IP — o DNS da UTIC não # • Teradata SEFAZ (processor, backend, analytics): nós COP por IP — o DNS da UTIC não
# resolve trdtdbcopN. TERADATA_ENABLED/USER/PASSWORD e EVIDENCE_KEYS em Environment # resolve trdtdbcopN. TERADATA_ENABLED/USER/PASSWORD e EVIDENCE_KEYS em Environment
# Variables do Coolify. EVIDENCE_KEYS: "1:<openssl rand -base64 32>" (guarde cópia!). # Variables do Coolify. EVIDENCE_KEYS: "1:<openssl rand -base64 32>" (guarde cópia!).
# • Este servidor não monta o certificado A1: XML sob demanda da SEFAZ fica desligado # • Certificado A1 (XML sob demanda no backend): DFE_CERT_PFX_BASE64 + DFE_CERT_PASSPHRASE
# aqui (o visualizador mostra o motivo); o restante funciona. # como variáveis secretas no Coolify — sem montar arquivo no servidor.
# ============================================================================ # ============================================================================
x-app-env: x-app-env:
DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public' DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public'
@@ -70,7 +70,7 @@ services:
- '--chromium-disable-javascript=false' - '--chromium-disable-javascript=false'
- '--api-timeout=60s' - '--api-timeout=60s'
migrate: migrate:
image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3' image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
restart: 'no' restart: 'no'
depends_on: depends_on:
db: db:
@@ -84,7 +84,7 @@ services:
DB_CONNECTION_LIMIT: '5' DB_CONNECTION_LIMIT: '5'
command: 'sh -c "wait-for-db && pnpm --filter @rastro/db migrate && pnpm --filter @rastro/db postgis && pnpm --filter @rastro/db timescale && pnpm --filter @rastro/db intel && pnpm --filter @rastro/db analyze && pnpm --filter @rastro/db restore-users"' command: 'sh -c "wait-for-db && pnpm --filter @rastro/db migrate && pnpm --filter @rastro/db postgis && pnpm --filter @rastro/db timescale && pnpm --filter @rastro/db intel && pnpm --filter @rastro/db analyze && pnpm --filter @rastro/db restore-users"'
processor: processor:
image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3' image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
restart: unless-stopped restart: unless-stopped
depends_on: depends_on:
db: db:
@@ -130,7 +130,7 @@ services:
TERADATA_USER: '${TERADATA_USER}' TERADATA_USER: '${TERADATA_USER}'
TERADATA_PASSWORD: '${TERADATA_PASSWORD}' TERADATA_PASSWORD: '${TERADATA_PASSWORD}'
backend: backend:
image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3' image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
restart: unless-stopped restart: unless-stopped
depends_on: depends_on:
db: db:
@@ -161,6 +161,11 @@ services:
TD_DOC_CACHE_HOURS: '24' TD_DOC_CACHE_HOURS: '24'
EVIDENCE_KEYS: '${EVIDENCE_KEYS}' EVIDENCE_KEYS: '${EVIDENCE_KEYS}'
EVIDENCE_BUCKET: rastro-evidence EVIDENCE_BUCKET: rastro-evidence
# Certificado A1 para o XML sob demanda: o .pfx em base64 numa variável secreta
# (base64 -i certificado.pfx | tr -d '\n'). Vazio = XML sob demanda desligado.
DFE_CERT_PFX_BASE64: '${DFE_CERT_PFX_BASE64}'
DFE_CERT_PASSPHRASE: '${DFE_CERT_PASSPHRASE}'
DFE_TLS_REJECT_UNAUTHORIZED: 'false'
command: 'sh -c "wait-for-db schema && pnpm --filter @rastro/backend start"' command: 'sh -c "wait-for-db schema && pnpm --filter @rastro/backend start"'
expose: expose:
- '39010' - '39010'
@@ -172,7 +177,7 @@ services:
- traefik.http.routers.rastroapi.priority=1000 - traefik.http.routers.rastroapi.priority=1000
- traefik.http.services.rastroapi.loadbalancer.server.port=39010 - traefik.http.services.rastroapi.loadbalancer.server.port=39010
web: web:
image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3' image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
restart: unless-stopped restart: unless-stopped
environment: environment:
DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public' DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public'
@@ -185,7 +190,7 @@ services:
expose: expose:
- '39000' - '39000'
admin: admin:
image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3' image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
restart: unless-stopped restart: unless-stopped
environment: environment:
DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public' DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public'
docker-compose.yml
+12 -7
View File
@@ -10,8 +10,8 @@
# • Teradata SEFAZ (processor, backend, analytics): nós COP por IP — o DNS da UTIC não # • Teradata SEFAZ (processor, backend, analytics): nós COP por IP — o DNS da UTIC não
# resolve trdtdbcopN. TERADATA_ENABLED/USER/PASSWORD e EVIDENCE_KEYS em Environment # resolve trdtdbcopN. TERADATA_ENABLED/USER/PASSWORD e EVIDENCE_KEYS em Environment
# Variables do Coolify. EVIDENCE_KEYS: "1:<openssl rand -base64 32>" (guarde cópia!). # Variables do Coolify. EVIDENCE_KEYS: "1:<openssl rand -base64 32>" (guarde cópia!).
# • Este servidor não monta o certificado A1: XML sob demanda da SEFAZ fica desligado # • Certificado A1 (XML sob demanda no backend): DFE_CERT_PFX_BASE64 + DFE_CERT_PASSPHRASE
# aqui (o visualizador mostra o motivo); o restante funciona. # como variáveis secretas no Coolify — sem montar arquivo no servidor.
# ============================================================================ # ============================================================================
x-app-env: x-app-env:
DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public' DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public'
@@ -70,7 +70,7 @@ services:
- '--chromium-disable-javascript=false' - '--chromium-disable-javascript=false'
- '--api-timeout=60s' - '--api-timeout=60s'
migrate: migrate:
image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3' image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
restart: 'no' restart: 'no'
depends_on: depends_on:
db: db:
@@ -84,7 +84,7 @@ services:
DB_CONNECTION_LIMIT: '5' DB_CONNECTION_LIMIT: '5'
command: 'sh -c "wait-for-db && pnpm --filter @rastro/db migrate && pnpm --filter @rastro/db postgis && pnpm --filter @rastro/db timescale && pnpm --filter @rastro/db intel && pnpm --filter @rastro/db analyze && pnpm --filter @rastro/db restore-users"' command: 'sh -c "wait-for-db && pnpm --filter @rastro/db migrate && pnpm --filter @rastro/db postgis && pnpm --filter @rastro/db timescale && pnpm --filter @rastro/db intel && pnpm --filter @rastro/db analyze && pnpm --filter @rastro/db restore-users"'
processor: processor:
image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3' image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
restart: unless-stopped restart: unless-stopped
depends_on: depends_on:
db: db:
@@ -130,7 +130,7 @@ services:
TERADATA_USER: '${TERADATA_USER}' TERADATA_USER: '${TERADATA_USER}'
TERADATA_PASSWORD: '${TERADATA_PASSWORD}' TERADATA_PASSWORD: '${TERADATA_PASSWORD}'
backend: backend:
image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3' image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
restart: unless-stopped restart: unless-stopped
depends_on: depends_on:
db: db:
@@ -161,6 +161,11 @@ services:
TD_DOC_CACHE_HOURS: '24' TD_DOC_CACHE_HOURS: '24'
EVIDENCE_KEYS: '${EVIDENCE_KEYS}' EVIDENCE_KEYS: '${EVIDENCE_KEYS}'
EVIDENCE_BUCKET: rastro-evidence EVIDENCE_BUCKET: rastro-evidence
# Certificado A1 para o XML sob demanda: o .pfx em base64 numa variável secreta
# (base64 -i certificado.pfx | tr -d '\n'). Vazio = XML sob demanda desligado.
DFE_CERT_PFX_BASE64: '${DFE_CERT_PFX_BASE64}'
DFE_CERT_PASSPHRASE: '${DFE_CERT_PASSPHRASE}'
DFE_TLS_REJECT_UNAUTHORIZED: 'false'
command: 'sh -c "wait-for-db schema && pnpm --filter @rastro/backend start"' command: 'sh -c "wait-for-db schema && pnpm --filter @rastro/backend start"'
expose: expose:
- '39010' - '39010'
@@ -172,7 +177,7 @@ services:
- traefik.http.routers.rastroapi.priority=1000 - traefik.http.routers.rastroapi.priority=1000
- traefik.http.services.rastroapi.loadbalancer.server.port=39010 - traefik.http.services.rastroapi.loadbalancer.server.port=39010
web: web:
image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3' image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
restart: unless-stopped restart: unless-stopped
environment: environment:
DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public' DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public'
@@ -185,7 +190,7 @@ services:
expose: expose:
- '39000' - '39000'
admin: admin:
image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3' image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
restart: unless-stopped restart: unless-stopped
environment: environment:
DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public' DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public'