feat: introduce Gatekeeper application, Directus utilities, and monorepo configuration for linting, testing, and husky hooks.

2026-02-01 21:23:34 +01:00
parent c2a0ba88c0
commit 83b4ea8807
51 changed files with 3150 additions and 282 deletions
--- a/packages/infra/docker/docker-compose.template.yml
+++ b/packages/infra/docker/docker-compose.template.yml
@@ -1,33 +1,109 @@
 services:
  app:
-    image: registry.infra.mintel.me/${PROJECT_NAME:-mintel/app}:${IMAGE_TAG:-latest}
+    image: registry.infra.mintel.me/mintel/${APP_NAME:-app}:${IMAGE_TAG:-latest}
    restart: always
    networks:
      - infra
-    ports:
-      - "3000:3000"
    env_file:
      - ${ENV_FILE:-.env}
    labels:
      - "traefik.enable=true"
      # HTTP ⇒ HTTPS redirect
-      - "traefik.http.routers.${APP_NAME:-app}-web.rule=Host(${TRAEFIK_HOST}) && !PathPrefix(`/.well-known/acme-challenge/`)"
-      - "traefik.http.routers.${APP_NAME:-app}-web.entrypoints=web"
-      - "traefik.http.routers.${APP_NAME:-app}-web.middlewares=redirect-https"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-web.rule=Host(${TRAEFIK_HOST}) && !PathPrefix(`/.well-known/acme-challenge/`)"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-web.entrypoints=web"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-web.middlewares=redirect-https"
      # HTTPS router
-      - "traefik.http.routers.${APP_NAME:-app}.rule=Host(${TRAEFIK_HOST})"
-      - "traefik.http.routers.${APP_NAME:-app}.entrypoints=websecure"
-      - "traefik.http.routers.${APP_NAME:-app}.tls.certresolver=le"
-      - "traefik.http.routers.${APP_NAME:-app}.tls=true"
-      - "traefik.http.routers.${APP_NAME:-app}.service=${APP_NAME:-app}"
-      - "traefik.http.services.${APP_NAME:-app}.loadbalancer.server.port=3000"
-      - "traefik.http.services.${APP_NAME:-app}.loadbalancer.server.scheme=http"
+      - "traefik.http.routers.${PROJECT_NAME:-app}.rule=Host(${TRAEFIK_HOST})"
+      - "traefik.http.routers.${PROJECT_NAME:-app}.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME:-app}.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME:-app}.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-app}.service=${PROJECT_NAME:-app}"
+      - "traefik.http.services.${PROJECT_NAME:-app}.loadbalancer.server.port=3000"
+      - "traefik.http.services.${PROJECT_NAME:-app}.loadbalancer.server.scheme=http"
      # Forwarded Headers
-      - "traefik.http.middlewares.${APP_NAME:-app}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
-      - "traefik.http.middlewares.${APP_NAME:-app}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
-      # Middlewares
-      - "traefik.http.routers.${APP_NAME:-app}.middlewares=${APP_NAME:-app}-forward,compress"
+      - "traefik.http.middlewares.${PROJECT_NAME:-app}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.middlewares.${PROJECT_NAME:-app}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
+      # Middlewares (Auth + Compress)
+      - "traefik.http.routers.${PROJECT_NAME:-app}.middlewares=${PROJECT_NAME:-app}-forward,${AUTH_MIDDLEWARE:-compress}"
+
+      # Gatekeeper Router (to show the login page)
+      - "traefik.http.routers.${PROJECT_NAME:-app}-gatekeeper.rule=Host(${TRAEFIK_HOST}) && PathPrefix(`/gatekeeper`)"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-gatekeeper.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-gatekeeper.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-gatekeeper.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-app}-gatekeeper.service=${PROJECT_NAME:-app}-gatekeeper"
+
+      # Auth Middleware Definition
+      - "traefik.http.middlewares.${PROJECT_NAME:-app}-auth.forwardauth.address=http://${PROJECT_NAME}-gatekeeper:3000/api/verify"
+      - "traefik.http.middlewares.${PROJECT_NAME:-app}-auth.forwardauth.trustForwardHeader=true"
+      - "traefik.http.middlewares.${PROJECT_NAME:-app}-auth.forwardauth.authResponseHeaders=X-Auth-User"
+
+  gatekeeper:
+    image: registry.infra.mintel.me/mintel/gatekeeper:${IMAGE_TAG:-latest}
+    container_name: ${PROJECT_NAME}-gatekeeper
+    restart: always
+    networks:
+      - infra
+    env_file:
+      - ${ENV_FILE:-.env}
+    environment:
+      PORT: 3000
+      PROJECT_NAME: ${PROJECT_NAME:-Mintel App}
+      PROJECT_COLOR: ${PROJECT_COLOR:-#82ed20}
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.${PROJECT_NAME}-gatekeeper.loadbalancer.server.port=3000"
+
+  directus:
+    image: directus/directus:11
+    restart: always
+    networks:
+      - infra
+    env_file:
+      - ${ENV_FILE:-.env}
+    environment:
+      KEY: ${DIRECTUS_KEY}
+      SECRET: ${DIRECTUS_SECRET}
+      ADMIN_EMAIL: ${DIRECTUS_ADMIN_EMAIL}
+      ADMIN_PASSWORD: ${DIRECTUS_ADMIN_PASSWORD}
+      DB_CLIENT: 'pg'
+      DB_HOST: 'directus-db'
+      DB_PORT: '5432'
+      DB_DATABASE: ${DIRECTUS_DB_NAME:-directus}
+      DB_USER: ${DIRECTUS_DB_USER:-directus}
+      DB_PASSWORD: ${DIRECTUS_DB_PASSWORD:-mintel}
+      WEBSOCKETS_ENABLED: 'true'
+      PUBLIC_URL: ${DIRECTUS_URL}
+      SENTRY_DSN: ${SENTRY_DSN}
+    volumes:
+      - ./directus/uploads:/directus/uploads
+      - ./directus/extensions:/directus/extensions
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.${PROJECT_NAME}-directus.rule=Host(${DIRECTUS_HOST})"
+      - "traefik.http.routers.${PROJECT_NAME}-directus.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME}-directus.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME}-directus.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME}-directus.middlewares=${PROJECT_NAME}-forward,${AUTH_MIDDLEWARE:-compress}"
+      - "traefik.http.services.${PROJECT_NAME}-directus.loadbalancer.server.port=8055"
+
+  directus-db:
+    image: postgres:15-alpine
+    restart: always
+    networks:
+      - infra
+    env_file:
+      - ${ENV_FILE:-.env}
+    environment:
+      POSTGRES_DB: ${DIRECTUS_DB_NAME:-directus}
+      POSTGRES_USER: ${DIRECTUS_DB_USER:-directus}
+      POSTGRES_PASSWORD: ${DIRECTUS_DB_PASSWORD:-mintel}
+    volumes:
+      - directus-db-data:/var/lib/postgresql/data

 networks:
  infra:
    external: true
+
+volumes:
+  directus-db-data: