95 lines
5.2 KiB
YAML
95 lines
5.2 KiB
YAML
services:
|
|
mintel-me-app:
|
|
image: registry.infra.mintel.me/mintel/mintel.me:${IMAGE_TAG:-latest}
|
|
restart: always
|
|
command: node apps/web/server.js
|
|
networks:
|
|
- default
|
|
- infra
|
|
env_file:
|
|
- ${ENV_FILE:-.env}
|
|
labels:
|
|
- "traefik.enable=true"
|
|
# HTTP ⇒ HTTPS redirect
|
|
- 'traefik.http.routers.${PROJECT_NAME}-web.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
|
|
- "traefik.http.routers.${PROJECT_NAME}-web.entrypoints=web"
|
|
# HTTPS router (Standard)
|
|
- 'traefik.http.routers.${PROJECT_NAME}.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
|
|
- "traefik.http.routers.${PROJECT_NAME}.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
|
- "traefik.http.routers.${PROJECT_NAME}.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
|
- "traefik.http.routers.${PROJECT_NAME}.tls=${TRAEFIK_TLS:-false}"
|
|
- "traefik.http.routers.${PROJECT_NAME}.service=${PROJECT_NAME}-app-svc"
|
|
- "traefik.http.routers.${PROJECT_NAME}.middlewares=${AUTH_MIDDLEWARE:-${PROJECT_NAME}-ratelimit,${PROJECT_NAME}-forward}"
|
|
- "traefik.http.services.${PROJECT_NAME}-app-svc.loadbalancer.server.port=3000"
|
|
- "traefik.docker.network=infra"
|
|
- "caddy=${TRAEFIK_HOST:-mintel.localhost}"
|
|
- "caddy.reverse_proxy={{upstreams 3000}}"
|
|
|
|
# Public Router (Whitelist for OG Images, Sitemaps, Health)
|
|
- 'traefik.http.routers.${PROJECT_NAME}-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/api/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathPrefix("/assets") || PathPrefix("/wp-content") || PathPrefix("/wp-includes") || PathPrefix("/showcase") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*") || PathRegexp(".*\\.(png|jpg|jpeg|webp|svg|ico|pdf|mp4|webm|woff2)$"))'
|
|
- "traefik.http.routers.${PROJECT_NAME}-public.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
|
- "traefik.http.routers.${PROJECT_NAME}-public.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
|
- "traefik.http.routers.${PROJECT_NAME}-public.tls=${TRAEFIK_TLS:-false}"
|
|
- "traefik.http.routers.${PROJECT_NAME}-public.service=${PROJECT_NAME}-app-svc"
|
|
- "traefik.http.routers.${PROJECT_NAME}-public.middlewares=${AUTH_MIDDLEWARE_UNPROTECTED:-${PROJECT_NAME}-ratelimit,${PROJECT_NAME}-forward}"
|
|
- "traefik.http.routers.${PROJECT_NAME}-public.priority=2000"
|
|
|
|
# Middlewares
|
|
- "traefik.http.middlewares.${PROJECT_NAME}-ratelimit.ratelimit.average=100"
|
|
- "traefik.http.middlewares.${PROJECT_NAME}-ratelimit.ratelimit.burst=200"
|
|
- "traefik.http.middlewares.${PROJECT_NAME}-ratelimit.ratelimit.burst=50"
|
|
|
|
# Gatekeeper Router (Path-based)
|
|
- 'traefik.http.routers.${PROJECT_NAME}-gatekeeper.rule=(Host("${TRAEFIK_HOST:-mintel.localhost}") && PathPrefix("/gatekeeper"))'
|
|
- "traefik.http.routers.${PROJECT_NAME}-gatekeeper.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
|
|
- "traefik.http.routers.${PROJECT_NAME}-gatekeeper.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
|
|
- "traefik.http.routers.${PROJECT_NAME}-gatekeeper.tls=${TRAEFIK_TLS:-false}"
|
|
- "traefik.http.routers.${PROJECT_NAME}-gatekeeper.service=${PROJECT_NAME}-gatekeeper-svc"
|
|
|
|
- "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.address=http://${PROJECT_NAME}-gatekeeper:3000/gatekeeper/api/verify"
|
|
- "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.trustForwardHeader=true"
|
|
- "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.authRequestHeaders=X-Forwarded-Host,X-Forwarded-Proto,X-Forwarded-For,Cookie"
|
|
- "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.authResponseHeaders=X-Auth-User"
|
|
|
|
# Forwarded Headers
|
|
- "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
|
|
- "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://127.0.0.1:3000/ || exit 1"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 20s
|
|
|
|
gatekeeper:
|
|
profiles: ["gatekeeper"]
|
|
image: registry.infra.mintel.me/mintel/gatekeeper:v1.7.12
|
|
container_name: ${PROJECT_NAME:-mintel-me}-gatekeeper
|
|
restart: always
|
|
networks:
|
|
infra:
|
|
aliases:
|
|
- ${PROJECT_NAME}-gatekeeper
|
|
env_file:
|
|
- ${ENV_FILE:-.env}
|
|
environment:
|
|
PORT: 3000
|
|
PROJECT_NAME: ${PROJECT_NAME:-Mintel.me}
|
|
PROJECT_COLOR: ${PROJECT_COLOR:-#ff00ff}
|
|
COOKIE_DOMAIN: ${COOKIE_DOMAIN:-localhost}
|
|
AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME:-mintel_gatekeeper_session}
|
|
GATEKEEPER_PASSWORD: ${GATEKEEPER_PASSWORD:-mintel}
|
|
NEXT_PUBLIC_BASE_URL: ${GATEKEEPER_ORIGIN}
|
|
labels:
|
|
- "traefik.http.services.${PROJECT_NAME}-gatekeeper-svc.loadbalancer.server.port=3000"
|
|
- "traefik.docker.network=infra"
|
|
- "caddy=gatekeeper.${TRAEFIK_HOST:-mintel.localhost}"
|
|
- "caddy.reverse_proxy={{upstreams 3000}}"
|
|
|
|
networks:
|
|
default:
|
|
name: ${PROJECT_NAME:-mintel-me}-internal
|
|
external: true
|
|
infra:
|
|
external: true
|