|
|
|
|
@@ -18,48 +18,48 @@ services:
|
|
|
|
|
labels:
|
|
|
|
|
- "traefik.enable=true"
|
|
|
|
|
# HTTP ⇒ HTTPS redirect
|
|
|
|
|
- "traefik.http.routers.klz-web.rule=${TRAEFIK_HOST_RULE:-Host(`${TRAEFIK_HOST:-klz-cables.com}`)}"
|
|
|
|
|
- "traefik.http.routers.klz-web.entrypoints=web"
|
|
|
|
|
- "traefik.http.routers.klz-web.middlewares=redirect-https"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-web.rule=${TRAEFIK_HOST_RULE:-Host(`${TRAEFIK_HOST:-klz-cables.com}`)}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-web.entrypoints=web"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-web.middlewares=redirect-https"
|
|
|
|
|
# HTTPS router (Standard)
|
|
|
|
|
- "traefik.http.routers.klz.rule=${TRAEFIK_HOST_RULE:-Host(`${TRAEFIK_HOST:-klz-cables.com}`)}"
|
|
|
|
|
- "traefik.http.routers.klz.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
|
|
|
|
- "traefik.http.routers.klz.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
|
|
|
|
- "traefik.http.routers.klz.tls=${TRAEFIK_TLS:-false}"
|
|
|
|
|
- "traefik.http.routers.klz.service=klz-app-svc"
|
|
|
|
|
- "traefik.http.routers.klz.middlewares=${AUTH_MIDDLEWARE:-klz-ratelimit,klz-forward,klz-compress}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}.rule=${TRAEFIK_HOST_RULE:-Host(`${TRAEFIK_HOST:-klz-cables.com}`)}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}.tls=${TRAEFIK_TLS:-false}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}.service=${PROJECT_NAME:-klz}-app-svc"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}.middlewares=${AUTH_MIDDLEWARE:-klz-ratelimit,klz-forward,klz-compress}"
|
|
|
|
|
|
|
|
|
|
# Public Router (Whitelist for OG Images, Sitemaps, Health)
|
|
|
|
|
- "traefik.http.routers.klz-public.rule=(${TRAEFIK_HOST_RULE:-Host(`${TRAEFIK_HOST:-klz-cables.com}`)}) && (PathPrefix(`/health`) || PathPrefix(`/sitemap.xml`) || PathPrefix(`/robots.txt`) || PathPrefix(`/manifest.webmanifest`) || PathRegexp(`^/([a-z]{2}/)?api/og`) || PathRegexp(`^/([a-z]{2}/)?opengraph-image$`) || PathRegexp(`^/([a-z]{2}/)?blog/opengraph-image$`) || PathRegexp(`^/sitemap(-[0-9]+)?\\.xml$`))"
|
|
|
|
|
- "traefik.http.routers.klz-public.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
|
|
|
|
- "traefik.http.routers.klz-public.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
|
|
|
|
- "traefik.http.routers.klz-public.tls=${TRAEFIK_TLS:-false}"
|
|
|
|
|
- "traefik.http.routers.klz-public.service=klz-app-svc"
|
|
|
|
|
- "traefik.http.routers.klz-public.middlewares=${AUTH_MIDDLEWARE_UNPROTECTED:-klz-ratelimit,klz-forward,klz-compress}"
|
|
|
|
|
- "traefik.http.routers.klz-public.priority=2000"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-public.rule=(${TRAEFIK_HOST_RULE:-Host(`${TRAEFIK_HOST:-klz-cables.com}`)}) && (PathPrefix(`/health`) || PathPrefix(`/sitemap.xml`) || PathPrefix(`/robots.txt`) || PathPrefix(`/manifest.webmanifest`) || PathRegexp(`^/([a-z]{2}/)?api/og`) || PathRegexp(`^/([a-z]{2}/)?opengraph-image$`) || PathRegexp(`^/([a-z]{2}/)?blog/opengraph-image$`) || PathRegexp(`^/sitemap(-[0-9]+)?\\.xml$`))"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-public.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-public.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-public.tls=${TRAEFIK_TLS:-false}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-public.service=${PROJECT_NAME:-klz}-app-svc"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-public.middlewares=${AUTH_MIDDLEWARE_UNPROTECTED:-klz-ratelimit,klz-forward,klz-compress}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-public.priority=2000"
|
|
|
|
|
|
|
|
|
|
- "traefik.http.services.klz-app-svc.loadbalancer.server.scheme=http"
|
|
|
|
|
- "traefik.http.services.klz-app-svc.loadbalancer.server.port=3000"
|
|
|
|
|
- "traefik.http.services.${PROJECT_NAME:-klz}-app-svc.loadbalancer.server.scheme=http"
|
|
|
|
|
- "traefik.http.services.${PROJECT_NAME:-klz}-app-svc.loadbalancer.server.port=3000"
|
|
|
|
|
- "traefik.docker.network=infra"
|
|
|
|
|
- "caddy=http://${TRAEFIK_HOST:-klz.localhost}"
|
|
|
|
|
- "caddy.reverse_proxy={{upstreams 3000}}"
|
|
|
|
|
|
|
|
|
|
# Middleware Definitions
|
|
|
|
|
- "traefik.http.middlewares.klz-compress.compress=true"
|
|
|
|
|
- "traefik.http.middlewares.${PROJECT_NAME:-klz}-compress.compress=true"
|
|
|
|
|
|
|
|
|
|
# Forwarded Headers
|
|
|
|
|
- "traefik.http.middlewares.klz-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
|
|
|
|
|
- "traefik.http.middlewares.klz-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
|
|
|
|
|
- "traefik.http.middlewares.${PROJECT_NAME:-klz}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
|
|
|
|
|
- "traefik.http.middlewares.${PROJECT_NAME:-klz}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
|
|
|
|
|
|
|
|
|
|
# Authentication Middleware (ForwardAuth)
|
|
|
|
|
- "traefik.http.middlewares.klz-auth.forwardauth.address=http://klz-gatekeeper:3000/gatekeeper/api/verify"
|
|
|
|
|
- "traefik.http.middlewares.klz-auth.forwardauth.trustForwardHeader=true"
|
|
|
|
|
- "traefik.http.middlewares.klz-auth.forwardauth.authRequestHeaders=X-Forwarded-Host,X-Forwarded-Proto,X-Forwarded-For,Cookie"
|
|
|
|
|
- "traefik.http.middlewares.klz-auth.forwardauth.authResponseHeaders=X-Auth-User"
|
|
|
|
|
- "traefik.http.middlewares.${PROJECT_NAME:-klz}-auth.forwardauth.address=http://${PROJECT_NAME:-klz}-gatekeeper:3000/gatekeeper/api/verify"
|
|
|
|
|
- "traefik.http.middlewares.${PROJECT_NAME:-klz}-auth.forwardauth.trustForwardHeader=true"
|
|
|
|
|
- "traefik.http.middlewares.${PROJECT_NAME:-klz}-auth.forwardauth.authRequestHeaders=X-Forwarded-Host,X-Forwarded-Proto,X-Forwarded-For,Cookie"
|
|
|
|
|
- "traefik.http.middlewares.${PROJECT_NAME:-klz}-auth.forwardauth.authResponseHeaders=X-Auth-User"
|
|
|
|
|
|
|
|
|
|
# Rate Limit Middleware
|
|
|
|
|
- "traefik.http.middlewares.klz-ratelimit.ratelimit.average=100"
|
|
|
|
|
- "traefik.http.middlewares.klz-ratelimit.ratelimit.burst=50"
|
|
|
|
|
- "traefik.http.middlewares.${PROJECT_NAME:-klz}-ratelimit.ratelimit.average=100"
|
|
|
|
|
- "traefik.http.middlewares.${PROJECT_NAME:-klz}-ratelimit.ratelimit.burst=50"
|
|
|
|
|
healthcheck:
|
|
|
|
|
test: [ "CMD", "curl", "-f", "http://127.0.0.1:3000/health" ]
|
|
|
|
|
interval: 15s
|
|
|
|
|
@@ -74,7 +74,7 @@ services:
|
|
|
|
|
networks:
|
|
|
|
|
infra:
|
|
|
|
|
aliases:
|
|
|
|
|
- klz-gatekeeper
|
|
|
|
|
- ${PROJECT_NAME:-klz}-gatekeeper
|
|
|
|
|
env_file:
|
|
|
|
|
- ${ENV_FILE:-.env}
|
|
|
|
|
environment:
|
|
|
|
|
@@ -88,12 +88,12 @@ services:
|
|
|
|
|
labels:
|
|
|
|
|
- "traefik.enable=true"
|
|
|
|
|
- "traefik.docker.network=infra"
|
|
|
|
|
- "traefik.http.routers.klz-gatekeeper.rule=(Host(`${TRAEFIK_HOST:-testing.klz-cables.com}`) && PathPrefix(`/gatekeeper`))"
|
|
|
|
|
- "traefik.http.routers.klz-gatekeeper.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
|
|
|
|
- "traefik.http.routers.klz-gatekeeper.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
|
|
|
|
- "traefik.http.routers.klz-gatekeeper.tls=${TRAEFIK_TLS:-false}"
|
|
|
|
|
- "traefik.http.routers.klz-gatekeeper.service=klz-gatekeeper-svc"
|
|
|
|
|
- "traefik.http.services.klz-gatekeeper-svc.loadbalancer.server.port=3000"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-gatekeeper.rule=(Host(`${TRAEFIK_HOST:-testing.klz-cables.com}`) && PathPrefix(`/gatekeeper`))"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-gatekeeper.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-gatekeeper.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-gatekeeper.tls=${TRAEFIK_TLS:-false}"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-gatekeeper.service=${PROJECT_NAME:-klz}-gatekeeper-svc"
|
|
|
|
|
- "traefik.http.services.${PROJECT_NAME:-klz}-gatekeeper-svc.loadbalancer.server.port=3000"
|
|
|
|
|
- "traefik.docker.network=infra"
|
|
|
|
|
|
|
|
|
|
klz-cms:
|
|
|
|
|
@@ -127,13 +127,13 @@ services:
|
|
|
|
|
disable: true
|
|
|
|
|
labels:
|
|
|
|
|
- "traefik.enable=true"
|
|
|
|
|
- "traefik.http.routers.klz-cms.rule=Host(`${DIRECTUS_HOST:-cms.klz-cables.com}`)"
|
|
|
|
|
- "traefik.http.routers.klz-cms.entrypoints=websecure"
|
|
|
|
|
- "traefik.http.routers.klz-cms.priority=5000"
|
|
|
|
|
- "traefik.http.routers.klz-cms.tls=true"
|
|
|
|
|
- "traefik.http.routers.klz-cms.tls.certresolver=le"
|
|
|
|
|
- "traefik.http.routers.klz-cms.service=klz-cms-svc"
|
|
|
|
|
- "traefik.http.services.klz-cms-svc.loadbalancer.server.port=8055"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-cms.rule=Host(`${DIRECTUS_HOST:-cms.klz-cables.com}`)"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-cms.entrypoints=websecure"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-cms.priority=5000"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-cms.tls=true"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-cms.tls.certresolver=le"
|
|
|
|
|
- "traefik.http.routers.${PROJECT_NAME:-klz}-cms.service=${PROJECT_NAME:-klz}-cms-svc"
|
|
|
|
|
- "traefik.http.services.${PROJECT_NAME:-klz}-cms-svc.loadbalancer.server.port=8055"
|
|
|
|
|
- "traefik.docker.network=infra"
|
|
|
|
|
- "caddy=http://${DIRECTUS_HOST:-cms.klz-cables.com}"
|
|
|
|
|
- "caddy.reverse_proxy={{upstreams 8055}}"
|
|
|
|
|
@@ -159,5 +159,3 @@ networks:
|
|
|
|
|
|
|
|
|
|
volumes:
|
|
|
|
|
directus-db-data:
|
|
|
|
|
external: true
|
|
|
|
|
name: klz-2026_directus-db-data
|
|
|
|
|
|
