1d9e7e0fab
- sms/auth.py: verify_api_key dependency (Bearer/X-API-Key, SHA-256 hash compare via secrets.compare_digest, fail-closed 503 if no hash). All routes gated via a protected router; /health stays open for probes. - config.py: new sms_api_key_hash setting (VOIPMS_SMS_API_KEY_HASH). - Dockerfile + .dockerignore + docker-compose.yml: lean python:3.13-slim image; secrets injected via env_file, never baked in; host-localhost-only port mapping (SMS_PORT override); /health healthcheck. - .env.example: committed template (placeholders only, no secrets). - sms/docs/sms-facade.dokuwiki.txt: abstraction API reference (published to the apidoc wiki at voipms:sms-facade). - README: Authentication section, Docker section, 401/503 error rows. Co-Authored-By: Claude <noreply@anthropic.com>
20 lines
708 B
Docker
20 lines
708 B
Docker
# voip.ms SMS/MMS API façade — container image.
|
|
# Secrets are injected at runtime via env_file (docker-compose) / -e; they are
|
|
# NEVER copied into the image (see .dockerignore).
|
|
FROM python:3.13-slim
|
|
|
|
WORKDIR /app
|
|
|
|
# Install deps first for better layer caching.
|
|
COPY sms/requirements.txt ./requirements.txt
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
|
|
# Application package only.
|
|
COPY sms/ ./sms/
|
|
|
|
EXPOSE 8000
|
|
|
|
# Bind 0.0.0.0 inside the container; the compose port mapping restricts host
|
|
# exposure to 127.0.0.1. Adjust the mapping if you need broader exposure
|
|
# (the API key in VOIPMS_SMS_API_KEY_HASH gates access either way).
|
|
CMD ["uvicorn", "sms.app:app", "--host", "0.0.0.0", "--port", "8000"] |