Skip to content

fix: update docker-compose for Portainer #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Andr3Dav1d wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix: update docker-compose for Portainer #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6da9d69
fix: update docker-compose for Portainer
Andr3Dav1d May 20, 2026
5182b08
Potential fix for pull request finding
Andr3Dav1d May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -360,15 +360,17 @@ services:
deepsproxy:
build: .
ports:
- "3000:3000"
- "${PORT:-3000}:${PORT:-3000}"
environment:
- PORT=3000
- PLAYWRIGHT_HEADLESS=true
PORT: ${PORT:-3000}
API_KEY: ${API_KEY:-}
volumes:
- ./deepseek_profile:/app/deepseek_profile
restart: unless-stopped
```

No Portainer, use este arquivo como Stack e defina as variáveis `PORT` e `API_KEY` na seção de environment da Stack. **Aviso de segurança:** se `API_KEY` ficar vazia, a autenticação permanecerá desativada e o serviço ficará exposto sem autenticação por padrão. Se a porta estiver publicada em uma interface pública, qualquer cliente com acesso à rede poderá usar a API; portanto, defina uma `API_KEY` antes de expor o serviço.

### Build e Execução

```bash
Expand Down
7 changes: 3 additions & 4 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,11 @@
version: '3.8'
services:
deepsproxy:
build: .
Comment on lines 1 to 3
ports:
- "3000:3000"
- "${PORT:-3000}:${PORT:-3000}"
environment:
- PORT=3000
- API_KEY=sua_api_key_aqui
PORT: ${PORT:-3000}
API_KEY: ${API_KEY:-}

@coderabbitai coderabbitai Bot May 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Avoid insecure-by-default auth configuration (Line 8).

API_KEY defaulting to empty disables authentication implicitly. In Portainer/public deployments, this can expose the API without protection. Prefer failing closed by requiring API_KEY, or gate unauthenticated mode behind an explicit opt-in flag.

Suggested hardening 
 environment:
   PORT: ${PORT:-3000}
-  API_KEY: ${API_KEY:-}
+  API_KEY: ${API_KEY:?API_KEY must be set}
+  # Optional alternative:
+  # AUTH_DISABLED: ${AUTH_DISABLED:-false}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
API_KEY: ${API_KEY:-}
API_KEY: ${API_KEY:?API_KEY must be set}
# Optional alternative:
# AUTH_DISABLED: ${AUTH_DISABLED:-false}
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker-compose.yml` at line 8, The compose snippet currently defaults API_KEY
to empty (API_KEY: ${API_KEY:-}), which allows unsigned/unauthenticated runs;
change the deployment so API_KEY must be provided (remove the empty default) and
implement a startup/entry check (e.g., in your service's entrypoint or main
init) that fails fast if env var API_KEY is missing, or alternatively add an
explicit opt-in flag (e.g., ALLOW_NO_AUTH) and require it to be set true before
allowing a blank API_KEY; reference the API_KEY environment variable and the
service entrypoint/startup initialization logic (where authentication is
enforced) when making these changes.

volumes:
- ./deepseek_profile:/app/deepseek_profile
restart: unless-stopped