fix(infra): use dynamic project variables for Traefik router labels and aliases to prevent collisions
Some checks failed
Build & Deploy / 🔍 Prepare (push) Successful in 6s
Build & Deploy / 🧪 QA (push) Failing after 2m24s
Build & Deploy / 🏗️ Build (push) Has been skipped
Build & Deploy / 🚀 Deploy (push) Has been skipped
Build & Deploy / 🧪 Post-Deploy Verification (push) Has been skipped
Build & Deploy / 🔔 Notify (push) Successful in 1s
Some checks failed
Build & Deploy / 🔍 Prepare (push) Successful in 6s
Build & Deploy / 🧪 QA (push) Failing after 2m24s
Build & Deploy / 🏗️ Build (push) Has been skipped
Build & Deploy / 🚀 Deploy (push) Has been skipped
Build & Deploy / 🧪 Post-Deploy Verification (push) Has been skipped
Build & Deploy / 🔔 Notify (push) Successful in 1s
This commit is contained in:
@@ -10,51 +10,51 @@ services:
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# HTTP ⇒ HTTPS redirect
|
||||
- 'traefik.http.routers.mintel-me-web.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
|
||||
- "traefik.http.routers.mintel-me-web.entrypoints=web"
|
||||
# - "traefik.http.routers.mintel-me-web.middlewares=redirect-https"
|
||||
- 'traefik.http.routers.${PROJECT_NAME}-web.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
|
||||
- "traefik.http.routers.${PROJECT_NAME}-web.entrypoints=web"
|
||||
# - "traefik.http.routers.${PROJECT_NAME}-web.middlewares=redirect-https"
|
||||
# HTTPS router (Standard)
|
||||
- 'traefik.http.routers.mintel-me.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
|
||||
- "traefik.http.routers.mintel-me.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
||||
- "traefik.http.routers.mintel-me.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
||||
- "traefik.http.routers.mintel-me.tls=${TRAEFIK_TLS:-false}"
|
||||
- "traefik.http.routers.mintel-me.service=mintel-me-app-svc"
|
||||
- "traefik.http.routers.mintel-me.middlewares=${AUTH_MIDDLEWARE:-mintel-me-ratelimit,mintel-me-forward}"
|
||||
- "traefik.http.services.mintel-me-app-svc.loadbalancer.server.port=3000"
|
||||
- 'traefik.http.routers.${PROJECT_NAME}.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
|
||||
- "traefik.http.routers.${PROJECT_NAME}.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
||||
- "traefik.http.routers.${PROJECT_NAME}.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
||||
- "traefik.http.routers.${PROJECT_NAME}.tls=${TRAEFIK_TLS:-false}"
|
||||
- "traefik.http.routers.${PROJECT_NAME}.service=${PROJECT_NAME}-app-svc"
|
||||
- "traefik.http.routers.${PROJECT_NAME}.middlewares=${AUTH_MIDDLEWARE:-${PROJECT_NAME}-ratelimit,${PROJECT_NAME}-forward}"
|
||||
- "traefik.http.services.${PROJECT_NAME}-app-svc.loadbalancer.server.port=3000"
|
||||
- "traefik.docker.network=infra"
|
||||
- "caddy=${TRAEFIK_HOST:-mintel.localhost}"
|
||||
- "caddy.reverse_proxy={{upstreams 3000}}"
|
||||
|
||||
# Public Router (Whitelist for OG Images, Sitemaps, Health)
|
||||
- 'traefik.http.routers.mintel-me-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*"))'
|
||||
- "traefik.http.routers.mintel-me-public.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
||||
- "traefik.http.routers.mintel-me-public.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
||||
- "traefik.http.routers.mintel-me-public.tls=${TRAEFIK_TLS:-false}"
|
||||
- "traefik.http.routers.mintel-me-public.service=mintel-me-app-svc"
|
||||
- "traefik.http.routers.mintel-me-public.middlewares=${AUTH_MIDDLEWARE_UNPROTECTED:-mintel-me-ratelimit,mintel-me-forward}"
|
||||
- "traefik.http.routers.mintel-me-public.priority=2000"
|
||||
- 'traefik.http.routers.${PROJECT_NAME}-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*"))'
|
||||
- "traefik.http.routers.${PROJECT_NAME}-public.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
||||
- "traefik.http.routers.${PROJECT_NAME}-public.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
||||
- "traefik.http.routers.${PROJECT_NAME}-public.tls=${TRAEFIK_TLS:-false}"
|
||||
- "traefik.http.routers.${PROJECT_NAME}-public.service=${PROJECT_NAME}-app-svc"
|
||||
- "traefik.http.routers.${PROJECT_NAME}-public.middlewares=${AUTH_MIDDLEWARE_UNPROTECTED:-${PROJECT_NAME}-ratelimit,${PROJECT_NAME}-forward}"
|
||||
- "traefik.http.routers.${PROJECT_NAME}-public.priority=2000"
|
||||
|
||||
# Middlewares
|
||||
- "traefik.http.middlewares.mintel-me-ratelimit.ratelimit.average=100"
|
||||
- "traefik.http.middlewares.mintel-me-ratelimit.ratelimit.burst=50"
|
||||
- "traefik.http.middlewares.${PROJECT_NAME}-ratelimit.ratelimit.average=100"
|
||||
- "traefik.http.middlewares.${PROJECT_NAME}-ratelimit.ratelimit.burst=50"
|
||||
|
||||
# Gatekeeper Router (Path-based)
|
||||
- 'traefik.http.routers.mintel-me-gatekeeper.rule=(Host("${TRAEFIK_HOST:-mintel.localhost}") && PathPrefix("/gatekeeper"))'
|
||||
- "traefik.http.routers.mintel-me-gatekeeper.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
||||
- "traefik.http.routers.mintel-me-gatekeeper.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
||||
- "traefik.http.routers.mintel-me-gatekeeper.tls=${TRAEFIK_TLS:-false}"
|
||||
- "traefik.http.routers.mintel-me-gatekeeper.service=mintel-me-gatekeeper-svc"
|
||||
- 'traefik.http.routers.${PROJECT_NAME}-gatekeeper.rule=(Host("${TRAEFIK_HOST:-mintel.localhost}") && PathPrefix("/gatekeeper"))'
|
||||
- "traefik.http.routers.${PROJECT_NAME}-gatekeeper.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
||||
- "traefik.http.routers.${PROJECT_NAME}-gatekeeper.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
||||
- "traefik.http.routers.${PROJECT_NAME}-gatekeeper.tls=${TRAEFIK_TLS:-false}"
|
||||
- "traefik.http.routers.${PROJECT_NAME}-gatekeeper.service=${PROJECT_NAME}-gatekeeper-svc"
|
||||
|
||||
- "traefik.http.middlewares.mintel-me-auth.forwardauth.address=http://mintel-me-gatekeeper:3000/gatekeeper/api/verify"
|
||||
- "traefik.http.middlewares.mintel-me-auth.forwardauth.trustForwardHeader=true"
|
||||
- "traefik.http.middlewares.mintel-me-auth.forwardauth.authRequestHeaders=X-Forwarded-Host,X-Forwarded-Proto,X-Forwarded-For,Cookie"
|
||||
- "traefik.http.middlewares.mintel-me-auth.forwardauth.authResponseHeaders=X-Auth-User"
|
||||
- "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.address=http://${PROJECT_NAME}-gatekeeper:3000/gatekeeper/api/verify"
|
||||
- "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.trustForwardHeader=true"
|
||||
- "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.authRequestHeaders=X-Forwarded-Host,X-Forwarded-Proto,X-Forwarded-For,Cookie"
|
||||
- "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.authResponseHeaders=X-Auth-User"
|
||||
|
||||
# Forwarded Headers
|
||||
- "traefik.http.middlewares.mintel-me-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
|
||||
- "traefik.http.middlewares.mintel-me-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
|
||||
- "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
|
||||
- "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
|
||||
|
||||
mintel-me-gatekeeper:
|
||||
gatekeeper:
|
||||
profiles: ["gatekeeper"]
|
||||
image: registry.infra.mintel.me/mintel/gatekeeper:v1.7.12
|
||||
container_name: ${PROJECT_NAME:-mintel-me}-gatekeeper
|
||||
@@ -62,7 +62,7 @@ services:
|
||||
networks:
|
||||
infra:
|
||||
aliases:
|
||||
- mintel-me-gatekeeper
|
||||
- ${PROJECT_NAME}-gatekeeper
|
||||
env_file:
|
||||
- ${ENV_FILE:-.env}
|
||||
environment:
|
||||
@@ -74,7 +74,7 @@ services:
|
||||
GATEKEEPER_PASSWORD: ${GATEKEEPER_PASSWORD:-mintel}
|
||||
NEXT_PUBLIC_BASE_URL: ${GATEKEEPER_ORIGIN}
|
||||
labels:
|
||||
- "traefik.http.services.mintel-me-gatekeeper-svc.loadbalancer.server.port=3000"
|
||||
- "traefik.http.services.${PROJECT_NAME}-gatekeeper-svc.loadbalancer.server.port=3000"
|
||||
- "traefik.docker.network=infra"
|
||||
- "caddy=gatekeeper.${TRAEFIK_HOST:-mintel.localhost}"
|
||||
- "caddy.reverse_proxy={{upstreams 3000}}"
|
||||
|
||||
Reference in New Issue
Block a user