feat: introduce Gatekeeper application, Directus utilities, and monorepo configuration for linting, testing, and husky hooks.

2026-02-01 21:23:34 +01:00
parent c2a0ba88c0
commit 83b4ea8807
51 changed files with 3150 additions and 282 deletions
--- a/packages/infra/docker/Dockerfile.gatekeeper
+++ b/packages/infra/docker/Dockerfile.gatekeeper
@@ -0,0 +1,47 @@
+FROM node:20-alpine AS base
+
+# Install dependencies only when needed
+FROM base AS deps
+RUN apk add --no-cache libc6-compat
+WORKDIR /app
+
+# Install dependencies
+COPY package.json pnpm-lock.yaml* ./
+RUN corepack enable pnpm && pnpm i --frozen-lockfile
+
+# Rebuild the source code only when needed
+FROM base AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
+ENV NEXT_TELEMETRY_DISABLED=1
+
+# Build the application
+RUN corepack enable pnpm && pnpm run build
+
+# Production image, copy all the files and run next
+FROM base AS runner
+WORKDIR /app
+
+RUN apk add --no-cache curl
+
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+
+RUN addgroup --system --gid 1001 nodejs
+RUN adduser --system --uid 1001 nextjs
+
+# Automatically leverage output traces to reduce image size
+# https://nextjs.org/docs/advanced-features/output-file-tracing
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+
+USER nextjs
+
+EXPOSE 3000
+
+ENV PORT=3000
+ENV HOSTNAME="0.0.0.0"
+
+CMD ["node", "server.js"]
--- a/packages/infra/docker/docker-compose.template.yml
+++ b/packages/infra/docker/docker-compose.template.yml
@@ -1,33 +1,109 @@
 services:
  app:
-    image: registry.infra.mintel.me/${PROJECT_NAME:-mintel/app}:${IMAGE_TAG:-latest}
+    image: registry.infra.mintel.me/mintel/${APP_NAME:-app}:${IMAGE_TAG:-latest}
    restart: always
    networks:
      - infra
-    ports:
-      - "3000:3000"
    env_file:
      - ${ENV_FILE:-.env}
    labels:
      - "traefik.enable=true"
      # HTTP ⇒ HTTPS redirect
-      - "traefik.http.routers.${APP_NAME:-app}-web.rule=Host(${TRAEFIK_HOST}) && !PathPrefix(`/.well-known/acme-challenge/`)"
-      - "traefik.http.routers.${APP_NAME:-app}-web.entrypoints=web"
-      - "traefik.http.routers.${APP_NAME:-app}-web.middlewares=redirect-https"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-web.rule=Host(${TRAEFIK_HOST}) && !PathPrefix(`/.well-known/acme-challenge/`)"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-web.entrypoints=web"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-web.middlewares=redirect-https"
      # HTTPS router
-      - "traefik.http.routers.${APP_NAME:-app}.rule=Host(${TRAEFIK_HOST})"
-      - "traefik.http.routers.${APP_NAME:-app}.entrypoints=websecure"
-      - "traefik.http.routers.${APP_NAME:-app}.tls.certresolver=le"
-      - "traefik.http.routers.${APP_NAME:-app}.tls=true"
-      - "traefik.http.routers.${APP_NAME:-app}.service=${APP_NAME:-app}"
-      - "traefik.http.services.${APP_NAME:-app}.loadbalancer.server.port=3000"
-      - "traefik.http.services.${APP_NAME:-app}.loadbalancer.server.scheme=http"
+      - "traefik.http.routers.${PROJECT_NAME:-app}.rule=Host(${TRAEFIK_HOST})"
+      - "traefik.http.routers.${PROJECT_NAME:-app}.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME:-app}.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME:-app}.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-app}.service=${PROJECT_NAME:-app}"
+      - "traefik.http.services.${PROJECT_NAME:-app}.loadbalancer.server.port=3000"
+      - "traefik.http.services.${PROJECT_NAME:-app}.loadbalancer.server.scheme=http"
      # Forwarded Headers
-      - "traefik.http.middlewares.${APP_NAME:-app}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
-      - "traefik.http.middlewares.${APP_NAME:-app}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
-      # Middlewares
-      - "traefik.http.routers.${APP_NAME:-app}.middlewares=${APP_NAME:-app}-forward,compress"
+      - "traefik.http.middlewares.${PROJECT_NAME:-app}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.middlewares.${PROJECT_NAME:-app}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
+      # Middlewares (Auth + Compress)
+      - "traefik.http.routers.${PROJECT_NAME:-app}.middlewares=${PROJECT_NAME:-app}-forward,${AUTH_MIDDLEWARE:-compress}"
+
+      # Gatekeeper Router (to show the login page)
+      - "traefik.http.routers.${PROJECT_NAME:-app}-gatekeeper.rule=Host(${TRAEFIK_HOST}) && PathPrefix(`/gatekeeper`)"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-gatekeeper.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-gatekeeper.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-gatekeeper.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-gatekeeper.service=${PROJECT_NAME:-app}-gatekeeper"
+
+      # Auth Middleware Definition
+      - "traefik.http.middlewares.${PROJECT_NAME:-app}-auth.forwardauth.address=http://${PROJECT_NAME}-gatekeeper:3000/api/verify"
+      - "traefik.http.middlewares.${PROJECT_NAME:-app}-auth.forwardauth.trustForwardHeader=true"
+      - "traefik.http.middlewares.${PROJECT_NAME:-app}-auth.forwardauth.authResponseHeaders=X-Auth-User"
+
+  gatekeeper:
+    image: registry.infra.mintel.me/mintel/gatekeeper:${IMAGE_TAG:-latest}
+    container_name: ${PROJECT_NAME}-gatekeeper
+    restart: always
+    networks:
+      - infra
+    env_file:
+      - ${ENV_FILE:-.env}
+    environment:
+      PORT: 3000
+      PROJECT_NAME: ${PROJECT_NAME:-Mintel App}
+      PROJECT_COLOR: ${PROJECT_COLOR:-#82ed20}
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.${PROJECT_NAME}-gatekeeper.loadbalancer.server.port=3000"
+
+  directus:
+    image: directus/directus:11
+    restart: always
+    networks:
+      - infra
+    env_file:
+      - ${ENV_FILE:-.env}
+    environment:
+      KEY: ${DIRECTUS_KEY}
+      SECRET: ${DIRECTUS_SECRET}
+      ADMIN_EMAIL: ${DIRECTUS_ADMIN_EMAIL}
+      ADMIN_PASSWORD: ${DIRECTUS_ADMIN_PASSWORD}
+      DB_CLIENT: 'pg'
+      DB_HOST: 'directus-db'
+      DB_PORT: '5432'
+      DB_DATABASE: ${DIRECTUS_DB_NAME:-directus}
+      DB_USER: ${DIRECTUS_DB_USER:-directus}
+      DB_PASSWORD: ${DIRECTUS_DB_PASSWORD:-mintel}
+      WEBSOCKETS_ENABLED: 'true'
+      PUBLIC_URL: ${DIRECTUS_URL}
+      SENTRY_DSN: ${SENTRY_DSN}
+    volumes:
+      - ./directus/uploads:/directus/uploads
+      - ./directus/extensions:/directus/extensions
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.${PROJECT_NAME}-directus.rule=Host(${DIRECTUS_HOST})"
+      - "traefik.http.routers.${PROJECT_NAME}-directus.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME}-directus.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME}-directus.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME}-directus.middlewares=${PROJECT_NAME}-forward,${AUTH_MIDDLEWARE:-compress}"
+      - "traefik.http.services.${PROJECT_NAME}-directus.loadbalancer.server.port=8055"
+
+  directus-db:
+    image: postgres:15-alpine
+    restart: always
+    networks:
+      - infra
+    env_file:
+      - ${ENV_FILE:-.env}
+    environment:
+      POSTGRES_DB: ${DIRECTUS_DB_NAME:-directus}
+      POSTGRES_USER: ${DIRECTUS_DB_USER:-directus}
+      POSTGRES_PASSWORD: ${DIRECTUS_DB_PASSWORD:-mintel}
+    volumes:
+      - directus-db-data:/var/lib/postgresql/data

 networks:
  infra:
    external: true
+
+volumes:
+  directus-db-data: