From c4f14b0cdf1d2247ff096dab0449ab5de0e851c3 Mon Sep 17 00:00:00 2001 From: lunanting Date: Sat, 12 Sep 2026 17:21:05 +0800 Subject: [PATCH] fix: label Redis certificate mount for SELinux --- deploy/production/README.md | 2 +- deploy/production/docker-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/deploy/production/README.md b/deploy/production/README.md index 5d79b3e..ca1e2af 100644 --- a/deploy/production/README.md +++ b/deploy/production/README.md @@ -13,4 +13,4 @@ SSH 隧道账号只接受由注册服务 CA 签发的短期证书，只允许转发到服务器 `127.0.0.1:3307`，并关闭终端、TTY、代理转发和密码认证。生产主机的 SSH 管理账号使用独立密钥，关闭密码登录。 -Redis 原始端口不映射到宿主机。公网 `6380` 只接受 TLS，注册服务为每台设备创建独立 ACL 账号；停用安装会删除该账号。证书续期后需重新生成 `/opt/cangku/shared/redis-tls.pem` 并重启 TLS 网关。 +Redis 原始端口不映射到宿主机。公网 `6380` 只接受 TLS，注册服务为每台设备创建独立 ACL 账号；停用安装会删除该账号。证书文件应归属 HAProxy 容器的 `99:99` 并保持 `0600`，续期后需重新生成 `/opt/cangku/shared/redis-tls.pem`、恢复该属主并重启 TLS 网关。 diff --git a/deploy/production/docker-compose.yml b/deploy/production/docker-compose.yml index f69f4e3..e55a3f0 100644 --- a/deploy/production/docker-compose.yml +++ b/deploy/production/docker-compose.yml @@ -51,7 +51,7 @@ services: - 6380:6380 volumes: - ./haproxy-redis.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro - - /opt/cangku/shared/redis-tls.pem:/usr/local/etc/haproxy/certs/redis.pem:ro + - /opt/cangku/shared/redis-tls.pem:/usr/local/etc/haproxy/certs/redis.pem:ro,z depends_on: redis: condition: service_healthy