build: align dev environment with klz-2026 standards

2026-02-12 18:29:35 +01:00
parent 64ff262d75
commit 7225efb0ea
2 changed files with 122 additions and 29 deletions
--- a/.env.example
+++ b/.env.example
@@ -0,0 +1,79 @@
+# ============================================================================
+# Mintel.me - Environment Configuration
+# ============================================================================
+# Copy this file to .env for local development
+# For production, use .env.production as a template
+# ============================================================================
+
+# ────────────────────────────────────────────────────────────────────────────
+# Application Configuration
+# ────────────────────────────────────────────────────────────────────────────
+PROJECT_NAME=mintel-me
+NODE_ENV=development
+NEXT_PUBLIC_BASE_URL=http://mintel.me.localhost
+# TARGET is used to differentiate between environments (testing, staging, production)
+TARGET=development
+NEXT_PUBLIC_TARGET=development
+
+# ────────────────────────────────────────────────────────────────────────────
+# Docker Orchestration (Traefik)
+# ────────────────────────────────────────────────────────────────────────────
+TRAEFIK_HOST=mintel.me.localhost
+TRAEFIK_RULE=Host(`mintel.me.localhost`)
+# Use AUTH_MIDDLEWARE to enable/disable Gatekeeper locally
+# Default is empty (disabled) for local development
+# Production: mintel-me-auth
+AUTH_MIDDLEWARE=
+
+# ────────────────────────────────────────────────────────────────────────────
+# Directus CMS Configuration
+# ────────────────────────────────────────────────────────────────────────────
+DIRECTUS_URL=https://cms.mintel.me
+DIRECTUS_HOST=cms.mintel.me.localhost
+DIRECTUS_KEY=some-random-key
+DIRECTUS_SECRET=some-random-secret
+DIRECTUS_DB_NAME=directus
+DIRECTUS_DB_USER=directus
+DIRECTUS_DB_PASSWORD=directus
+
+# ────────────────────────────────────────────────────────────────────────────
+# Analytics (Umami)
+# ────────────────────────────────────────────────────────────────────────────
+UMAMI_WEBSITE_ID=
+UMAMI_API_ENDPOINT=https://analytics.infra.mintel.me
+
+# ────────────────────────────────────────────────────────────────────────────
+# Error Tracking (Sentry)
+# ────────────────────────────────────────────────────────────────────────────
+SENTRY_DSN=
+
+# ────────────────────────────────────────────────────────────────────────────
+# Gatekeeper (Standard Auth)
+# ────────────────────────────────────────────────────────────────────────────
+GATEKEEPER_PASSWORD=mintel
+GATEKEEPER_ORIGIN=https://mintel.me/gatekeeper
+COOKIE_DOMAIN=.mintel.me
+AUTH_COOKIE_NAME=mintel_gatekeeper_session
+
+# ────────────────────────────────────────────────────────────────────────────
+# Deployment Configuration (CI/CD only)
+# ────────────────────────────────────────────────────────────────────────────
+IMAGE_TAG=latest
+ENV_FILE=.env
+LOG_LEVEL=info
+
+# ============================================================================
+# IMPORTANT NOTES
+# ============================================================================
+#
+# Networking:
+# ──────────
+# • The project uses a project-prefixed internal network: ${PROJECT_NAME}-internal
+# • All inter-service communication should use Docker aliases
+#
+# Authentication:
+# ───────────────
+# • Gatekeeper is managed via Traefik ForwardAuth
+# • Set AUTH_MIDDLEWARE=${PROJECT_NAME}-auth in .env.production to enable it
+#
+# ============================================================================
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,31 +3,41 @@ services:
    image: registry.infra.mintel.me/mintel/mintel.me:${IMAGE_TAG:-latest}
    restart: always
    networks:
+      - default
      - infra
    env_file:
      - ${ENV_FILE:-.env}
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.${PROJECT_NAME}.rule=${TRAEFIK_RULE:-Host(`${TRAEFIK_HOST:-mintel.me.localhost}`)}"
-      - "traefik.http.routers.${PROJECT_NAME}.entrypoints=websecure"
-      - "traefik.http.routers.${PROJECT_NAME}.tls.certresolver=le"
-      - "traefik.http.routers.${PROJECT_NAME}.tls=true"
-      - "traefik.http.services.${PROJECT_NAME}.loadbalancer.server.port=3000"
-      - "traefik.http.routers.${PROJECT_NAME}.middlewares=${TRAEFIK_MIDDLEWARES:-${PROJECT_NAME}-auth}"
+      # HTTP ⇒ HTTPS redirect
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.rule=${TRAEFIK_RULE:-Host(`${TRAEFIK_HOST:-mintel.me.localhost}`)}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.entrypoints=web"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-web.middlewares=redirect-https"
+      # HTTPS router (Standard)
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.rule=${TRAEFIK_RULE:-Host(`${TRAEFIK_HOST:-mintel.me.localhost}`)}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.service=${PROJECT_NAME:-mintel-me}"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}.middlewares=${AUTH_MIDDLEWARE:-compress,${PROJECT_NAME:-mintel-me}-forward}"
+      - "traefik.http.services.${PROJECT_NAME:-mintel-me}.loadbalancer.server.port=3000"
      - "traefik.docker.network=infra"

      # Gatekeeper Router (Path-based)
-      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.rule=(Host(`${TRAEFIK_HOST}`) && PathPrefix(`/gatekeeper`))"
-      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.entrypoints=websecure"
-      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.tls.certresolver=le"
-      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.tls=true"
-      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.service=${PROJECT_NAME}-gatekeeper"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.rule=(Host(`${TRAEFIK_HOST:-mintel.me}`) && PathPrefix(`/gatekeeper`))"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-gatekeeper.service=${PROJECT_NAME:-mintel-me}-gatekeeper"

-      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.address=http://${PROJECT_NAME}-gatekeeper:3000/gatekeeper/api/verify"
-      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.trustForwardHeader=true"
-      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.authRequestHeaders=X-Forwarded-Host,X-Forwarded-Proto,X-Forwarded-For,Cookie"
-      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.authResponseHeaders=X-Auth-User"
-      - "traefik.docker.network=infra"
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-auth.forwardauth.address=http://${PROJECT_NAME:-mintel-me}-gatekeeper:3000/gatekeeper/api/verify"
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-auth.forwardauth.trustForwardHeader=true"
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-auth.forwardauth.authRequestHeaders=X-Forwarded-Host,X-Forwarded-Proto,X-Forwarded-For,Cookie"
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-auth.forwardauth.authResponseHeaders=X-Auth-User"
+
+      # Forwarded Headers
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.middlewares.${PROJECT_NAME:-mintel-me}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"

  gatekeeper:
    profiles: ["gatekeeper"]
@@ -41,7 +51,7 @@ services:
    env_file:
      - ${ENV_FILE:-.env}
    environment:
-      PORT: ${PORT:-3000}
+      PORT: 3000
      PROJECT_NAME: ${PROJECT_NAME:-Mintel.me}
      PROJECT_COLOR: ${PROJECT_COLOR:-#ff00ff}
      COOKIE_DOMAIN: ${COOKIE_DOMAIN:-.mintel.me}
@@ -50,15 +60,15 @@ services:
      NEXT_PUBLIC_BASE_URL: ${GATEKEEPER_ORIGIN}
    labels:
      - "traefik.enable=true"
-      - "traefik.http.services.${PROJECT_NAME}-gatekeeper.loadbalancer.server.port=3000"
+      - "traefik.http.services.${PROJECT_NAME:-mintel-me}-gatekeeper.loadbalancer.server.port=3000"
      - "traefik.docker.network=infra"

  directus:
    image: registry.infra.mintel.me/mintel/directus:latest
    restart: always
    networks:
+      - default
      - infra
-      - backend
    env_file:
      - ${ENV_FILE:-.env}
    environment:
@@ -71,9 +81,14 @@ services:
      DB_USER: ${DIRECTUS_DB_USER:-directus}
      DB_PASSWORD: ${DIRECTUS_DB_PASSWORD:-directus}
      PUBLIC_URL: ${DIRECTUS_URL:-https://cms.mintel.me}
+      SENTRY_DSN: ${SENTRY_DSN}
+      SENTRY_ENVIRONMENT: ${TARGET:-development}
+      LOGGER_LEVEL: ${LOG_LEVEL:-info}
    volumes:
      - ./directus/uploads:/directus/uploads
      - ./directus/extensions:/directus/extensions
+      - ./directus/schema:/directus/schema
+      - ./directus/migrations:/directus/migrations
    healthcheck:
      test:
        [
@@ -90,20 +105,19 @@ services:
      start_period: 30s
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.${PROJECT_NAME}-directus.rule=Host(`${DIRECTUS_HOST:-cms.mintel.me.localhost}`)"
-      - "traefik.http.routers.${PROJECT_NAME}-directus.entrypoints=websecure"
-      - "traefik.http.routers.${PROJECT_NAME}-directus.tls.certresolver=le"
-      - "traefik.http.routers.${PROJECT_NAME}-directus.tls=true"
-      - "traefik.http.routers.${PROJECT_NAME}-directus.middlewares=${PROJECT_NAME}-forward,compress"
-      - "traefik.http.services.${PROJECT_NAME}-directus.loadbalancer.server.port=8055"
-      - "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.rule=Host(`${DIRECTUS_HOST:-cms.mintel.me.localhost}`)"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.entrypoints=websecure"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.tls.certresolver=le"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.tls=true"
+      - "traefik.http.routers.${PROJECT_NAME:-mintel-me}-directus.middlewares=${PROJECT_NAME:-mintel-me}-forward,compress"
+      - "traefik.http.services.${PROJECT_NAME:-mintel-me}-directus.loadbalancer.server.port=8055"
      - "traefik.docker.network=infra"

  directus-db:
    image: postgres:15-alpine
    restart: always
    networks:
-      - backend
+      - default
    env_file:
      - ${ENV_FILE:-.env}
    environment:
@@ -114,10 +128,10 @@ services:
      - directus-db-data:/var/lib/postgresql/data

 networks:
+  default:
+    name: ${PROJECT_NAME:-mintel-me}-internal
  infra:
    external: true
-  backend:
-    internal: true

 volumes:
  directus-db-data: