87 Commits

Author SHA1 Message Date
166f023e3b fix(staging): completely resolve phantom 403 imgproxy caching loops via base64, traefik routing precedence, and variable mapping 2026-02-19 20:06:55 +01:00
3b60d450e1 fix(infra): whitelist video files and source maps
- Added webm, mp4, map to Traefik whitelist to bypass Gatekeeper
- Added webm, mp4, map to middleware exclusion to prevent locale redirects
- This fixes 404 errors for background videos and source maps on protected environments
2026-02-19 16:04:58 +01:00
8a7247d80c fix(imgproxy): switch from base64 to plain URL format
Use plain/ source URL format instead of base64 encoding.
Base64 was causing 404 errors from imgproxy.
Plain format verified working via direct curl tests.
2026-02-19 15:07:20 +01:00
cdbede3551 fix(infra): whitelist static image assets in traefik
- Added PathRegexp for .svg, .png, .jpg, etc. to public router
- Allows central imgproxy to fetch source images from protected staging environment
- Resolves broken images caused by imgproxy receiving login page HTML
2026-02-19 01:52:41 +01:00
067b4aa05b fix(infra): correct traefik host rule syntax for public router
- Fixed invalid Traefik rule syntax in docker-compose.yml (was using raw hostname)
- Updated middleware.ts to explicitly allow localized paths
- Ensures whitelist for OG images/health checks is recognized
2026-02-18 23:43:54 +01:00
f344c8b0d1 fix(infra): simplify traefik whitelist rules for og images
- Replaced complex PathRegexp with explicit PathPrefix rules for /api/og and /opengraph-image
- Added localized prefixes (/de/, /en/) to ensure Gatekeeper bypass works reliable
2026-02-18 22:04:46 +01:00
b4fa4f3ec5 fix(infra): whitelist /_img proxy path and restore image config
- Whitelisted /_img path in Traefik labels to allow public access (fixing login page images)
- Restored dangerouslyAllowSVG and CSP settings in next.config.mjs (lost in shallow merge)
- Ensuring Next.js proxy works correctly behind Gatekeeper
2026-02-18 21:42:33 +01:00
654e1b90d7 feat(infra): configure next.js image proxy to hide backend url
- Implemented /_img/ rewrite in next.config.mjs to proxy requests to IMGPROXY_URL
- Updated lib/imgproxy.ts to use local /_img path instead of public endpoint
- Replaced NEXT_PUBLIC_IMGPROXY_URL (build-time) with IMGPROXY_URL (runtime) env var
- Updated docker-compose.yml to strip build args and inject runtime IMGPROXY_URL
- Cleaned up Dockerfile and audit scripts
2026-02-18 15:58:27 +01:00
a60664f964 feat(infra): configure imgproxy to use next.js rewrite proxy
- Added /_img/ rewrite rule in next.config.mjs to proxy image requests to IMGPROXY_URL
- Updated lib/imgproxy.ts to use local /_img path instead of exposed public URL
- Replaced NEXT_PUBLIC_IMGPROXY_URL (build-time) with IMGPROXY_URL (runtime)
- Updated Dockerfile and docker-compose.yml to strip unused build args
2026-02-18 15:57:44 +01:00
e0fae20835 fix(infra): make IMGPROXY_URL_MAPPING configurable via environment variables
This ensures that the image proxy correctly maps public domains to internal
Docker hostnames across different environments (testing, staging, production)
without manual configuration of the docker-compose.yml file.
2026-02-18 11:57:03 +01:00
9e9bc9d3aa feat: optimize performance and SEO, integrate Lighthouse CI
- Integrated imgproxy for centralized image optimization
- Implemented Lighthouse CI in Gitea pipeline with native Chromium
- Reached 100/100 SEO score by fixing canonicals, hreflang, and link text
- Optimized LCP by forcing Hero component visibility until hydration
- Decoupled analytics into an async shell to reduce TTI
2026-02-18 10:01:00 +01:00
ea0dae310c fix(infra): restore official production volume and repair directus snapshot
- Hardened docker-compose.yml to use klz-cablescom_directus-db-data volume
- Added mandatory 'relations: []' key to Directus snapshot.yaml
- Aligned internal network mappings for db connectivity
2026-02-17 22:49:21 +01:00
d7fd139232 fix(infra): resolve gatekeeper label overwrite and alias collision 2026-02-17 17:50:45 +01:00
50d278953e fix(orchestration): namespace Traefik labels with PROJECT_NAME to avoid collisions 2026-02-17 17:06:16 +01:00
baf05c089c fix(orchestration): remove hardcoded external volume to fix pipeline failure 2026-02-17 16:53:57 +01:00
c292dec4d6 fix: resolve contact page 500 and Leaflet initialization errors
- Fixed Docker service names and volume configuration
- Bootstrapped Directus and applied schema
- Updated DIRECTUS_URL to local instance in .env
- Implemented manual Leaflet lifecycle management in LeafletMap.tsx
  to prevent re-initialization error
2026-02-17 16:13:31 +01:00
1906cb6736 fix(infra): split PathPrefix into single-arg calls for Traefik v3
Traefik v3 only accepts one argument per PathPrefix. The multi-arg syntax
silently invalidated the entire public router, causing OG images, health,
sitemap and robots.txt to fall through to the auth-protected main router.
2026-02-17 02:09:54 +01:00
163b356920 fix(og-image): resolve 404s, migrate middleware to proxy.ts, and fix local port conflict 2026-02-17 01:31:13 +01:00
d360fbff6b fix: pipeline 2026-02-16 23:18:41 +01:00
c76c91928f fix: pipeline 2026-02-16 23:08:12 +01:00
3d498ba46f fix: build 2026-02-16 21:32:24 +01:00
16597806bf fix(infra): resolve local directus service matching, improve branding script flexibility, and cleanup build artifacts 2026-02-16 18:07:56 +01:00
4e762ebfdf feat: optimize event capturing and playback accuracy 2026-02-15 18:06:50 +01:00
a1a5df8a51 fix(og): enable automatic OG image discovery and refine Traefik whitelist
- Removed manual 'images' metadata overrides.
- This allows Next.js to use built-in automatic discovery.
- Ensures metadata uses the dynamic metadataBase from the environment.
- Refined Traefik public router regex for sub-routes.
- Restored and verified imports in modified page.tsx files.
2026-02-13 01:38:26 +01:00
3119199a8b fix(infra): definitive fix for Traefik Host rule and Gatekeeper bypass
- Switched Traefik Host rules from backticks to double quotes for safety.
- Used printf in deploy.yml to guarantee literal writing of environment variables.
- Verified that Host rules now correctly match without shell-side side-effects.
- Maintained WOFF fonts for Satori compatibility.
2026-02-12 23:34:33 +01:00
9097e2cead fix(infra): guaranteed Traefik bypass for OG images and sitemaps
- Added explicit Host match and PathPrefixes to public router in docker-compose.yml.
- Increased priority of public router to 2000.
- Updated middleware.ts to bypass next-intl for OG images and API routes.
- Verified local rendering of OG images.
2026-02-12 22:18:21 +01:00
a19bd92df7 fix(og): robust infrastructure fix for OG image check
- Added exhaustive PathRegexp whitelists in docker-compose.yml to bypass Gatekeeper.
- Fixed TRAEFIK_HOST_RULE interpolation in deploy.yml.
- Enhanced scripts/check-og-images.ts with header and body diagnostics.
- Added server-side font loading logs in lib/og-helper.tsx.
2026-02-12 21:59:13 +01:00
350b1919f3 fix(og): diagnostic fix for CI OG image check
- Updated scripts/check-og-images.ts to log response body on failure.
- Refined Traefik public router rule in docker-compose.yml for better path matching.
- Fixed TRAEFIK_HOST_RULE assignment in deploy.yml (removed literal single quotes).
2026-02-12 21:35:45 +01:00
081e1466f2 fix(infra): whitelist OG images in Traefik to bypass Gatekeeper
Added public router labels to ensure OG images, sitemaps, and health checks
are accessible on testing/staging environments for crawlers and CI tests.
2026-02-12 21:25:04 +01:00
e9cd8d1768 fix(analytics): restore Smart Proxy mechanism and remove conflicting rewrites 2026-02-12 17:33:42 +01:00
e800c1fbe0 feat: align analytics and error naming standards and fix Umami proxy 2026-02-12 16:55:20 +01:00
f21e3262fc fix(infra): pass Cookie header to Gatekeeper ForwardAuth 2026-02-12 14:25:14 +01:00
6139ceae0b fix(gatekeeper): upgrade to v1.7.12 2026-02-11 22:49:38 +01:00
d253134699 fix(gatekeeper): upgrade to v1.7.11 2026-02-11 22:35:54 +01:00
3b77ba5412 fix: ensure correct middleware order and path-based gatekeeper origins 2026-02-11 20:51:34 +01:00
268d1c5cbd fix: use correctly prefixed /gatekeeper/api/verify endpoint for forwardauth 2026-02-11 19:14:52 +01:00
6b2da9abb6 fix: use correct gatekeeper image tag v1.7.10 2026-02-11 18:38:52 +01:00
da514a17e3 feat: integrate mintel gatekeeper into testing environment 2026-02-11 18:32:55 +01:00
0a928936e7 fix: use robust healthcheck and fix indent 2026-02-11 01:16:29 +01:00
5a918484f9 fix: remove production authentication and add healthcheck 2026-02-11 01:08:06 +01:00
a2d11dcadf refactor: streamline env and directus logic using @mintel/next-utils and fix network isolation 2026-02-10 23:41:32 +01:00
2809d639f5 fix: align gatekeeper labels and forwardauth path with mb-grid standards 2026-02-10 21:28:19 +01:00
7b2863a0ca fix: align gatekeeper labels and network aliases with mb-grid standards 2026-02-10 21:23:12 +01:00
2677ca34a2 fix: remove varnish 2026-02-10 19:23:10 +01:00
a0bcd043d7 fix: deploy 2026-02-10 16:25:54 +01:00
765bfa7001 fix: deploy 2026-02-10 16:14:10 +01:00
4ca4744a8c feat: integrate feedback module 2026-02-08 21:48:55 +01:00
25cf055f9f fix: traefik routing rules and define missing compress middleware 2026-02-06 23:57:37 +01:00
0ae02ba73b fix(analytics): bypass gatekeeper and middleware for tracking endpoints 2026-02-06 23:16:52 +01:00
e3f7344daf chore: traefik labels
Some checks failed
Build & Deploy KLZ Cables / 🔍 Prepare Environment (push) Successful in 10s
Build & Deploy KLZ Cables / 🏗️ Build App (push) Successful in 26s
Build & Deploy KLZ Cables / 🧪 Quality Assurance (push) Failing after 1m34s
Build & Deploy KLZ Cables / 🚀 Deploy (push) Has been skipped
Build & Deploy KLZ Cables / ⚡ PageSpeed (push) Has been skipped
Build & Deploy KLZ Cables / 🔔 Notifications (push) Successful in 2s
2026-02-06 18:36:34 +01:00