- Clear default passwords in all service configs, require env vars
- Add JWT auth + role middleware to WebSocket endpoints
- Add origin whitelist to WebSocket upgrader (CORS protection)
- Fix goroutine leak in WS proxy (double errCh read)
- Update docker-compose to require secrets via ${VAR:?...} syntax
- Mark deprecated k8s configmap passwords as REPLACE_AT_DEPLOY_TIME
Co-Authored-By: Claude <noreply@anthropic.com>
DinD containers can't reach external services due to DNS/networking
issues. Fix by:
- Passing --dns 10.43.0.10 (CoreDNS) and --dns 223.5.5.5 (Alibaba)
to DinD daemon
- Using --network host for docker build to use pod networking
Co-Authored-By: Claude <noreply@anthropic.com>
Alpine CDN (dl-cdn.alpinelinux.org) unreachable from DinD containers.
Switch to mirrors.aliyun.com for apk package downloads.
Co-Authored-By: Claude <noreply@anthropic.com>
Split 5 parallel build jobs into 3 stages (2+2+1) to avoid
overwhelming Harbor with concurrent image pulls. Add retry: 2
for transient failures.
Co-Authored-By: Claude <noreply@anthropic.com>
Docker Hub and proxy.golang.org are unreachable from k3s cluster
(GFW). Switch all Dockerfiles to pull base images from Harbor
(harbor-in-k3s.cheverjohn.me/library/) and use goproxy.cn for
Go module downloads.
Co-Authored-By: Claude <noreply@anthropic.com>
Set DOCKER_HOST, DOCKER_TLS_VERIFY, DOCKER_CERT_PATH for k8s runner
DinD sidecar communication. Add 'until docker info' wait loop to
ensure daemon is ready before build starts.
Co-Authored-By: Claude <noreply@anthropic.com>
Build all 5 iloom services (gateway, auth, purchaser, textile, washing)
as Docker images and push to Harbor registry.
- main branch: tagged as main-<sha>
- git tag v*: tagged with version number
Co-Authored-By: Claude <noreply@anthropic.com>
