Merge origin/master into propose-fix-for-edge-broker-vulnerability, resolving all conflicts
This commit is contained in:
copilot-swe-agent[bot]
+112
-25
@@ -4,11 +4,11 @@ services:
|
||||
image: traefik:2.11
|
||||
container_name: traefik
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
- "4433:4433"
|
||||
- "${TRAEFIK_WEB_PORT:-80}:80"
|
||||
- "${TRAEFIK_WEBSECURE_PORT:-443}:443"
|
||||
- "${TRAEFIK_WEBSECURE_STAGING_PORT:-4433}:4433"
|
||||
# Prometheus metrics endpoint (local dev)
|
||||
- "9100:9100"
|
||||
- "${TRAEFIK_METRICS_PORT:-9100}:9100"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- ./services/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
|
||||
@@ -34,6 +34,41 @@ services:
|
||||
- "traefik.http.routers.traefik-local.entrypoints=web"
|
||||
- "traefik.http.routers.traefik-local.service=api@internal"
|
||||
- "traefik.http.routers.traefik-local.middlewares=dashboard-allow-local@file,dashboard-auth@file"
|
||||
# Broker API (handled in edge-broker service)
|
||||
- "traefik.http.routers.edge-broker.rule=Host(`api.truckwash.dk`) && PathPrefix(`/edge-broker`)"
|
||||
- "traefik.http.routers.edge-broker.entrypoints=websecure"
|
||||
- "traefik.http.routers.edge-broker.tls=true"
|
||||
- "traefik.http.routers.edge-broker.tls.certresolver=le"
|
||||
- "traefik.http.routers.edge-broker.middlewares=secure-headers@file,edge-broker-strip"
|
||||
- "traefik.http.routers.edge-broker.priority=200"
|
||||
- "traefik.http.routers.edge-broker.service=edge-broker"
|
||||
- "traefik.http.routers.edge-broker-io.rule=Host(`api.truckwash.io`) && PathPrefix(`/edge-broker`)"
|
||||
- "traefik.http.routers.edge-broker-io.entrypoints=websecure"
|
||||
- "traefik.http.routers.edge-broker-io.tls=true"
|
||||
- "traefik.http.routers.edge-broker-io.tls.certresolver=le_io"
|
||||
- "traefik.http.routers.edge-broker-io.middlewares=secure-headers@file,edge-broker-strip"
|
||||
- "traefik.http.routers.edge-broker-io.priority=200"
|
||||
- "traefik.http.routers.edge-broker-io.service=edge-broker"
|
||||
- "traefik.http.routers.edge-broker-v2.rule=Host(`api-v2.truckwash.io`) && PathPrefix(`/edge-broker`)"
|
||||
- "traefik.http.routers.edge-broker-v2.entrypoints=websecure"
|
||||
- "traefik.http.routers.edge-broker-v2.tls=true"
|
||||
- "traefik.http.routers.edge-broker-v2.tls.certresolver=le_io"
|
||||
- "traefik.http.routers.edge-broker-v2.middlewares=secure-headers@file,edge-broker-strip"
|
||||
- "traefik.http.routers.edge-broker-v2.priority=200"
|
||||
- "traefik.http.routers.edge-broker-v2.service=edge-broker"
|
||||
- "traefik.http.routers.edge-broker-staging.rule=Host(`api.truckwash.io`) && PathPrefix(`/edge-broker`)"
|
||||
- "traefik.http.routers.edge-broker-staging.entrypoints=websecure-staging"
|
||||
- "traefik.http.routers.edge-broker-staging.tls=true"
|
||||
- "traefik.http.routers.edge-broker-staging.tls.certresolver=le_io"
|
||||
- "traefik.http.routers.edge-broker-staging.middlewares=secure-headers@file,edge-broker-strip"
|
||||
- "traefik.http.routers.edge-broker-staging.priority=200"
|
||||
- "traefik.http.routers.edge-broker-staging.service=edge-broker"
|
||||
- "traefik.http.routers.edge-broker-local.rule=Host(`localhost`) && PathPrefix(`/api/edge-broker`)"
|
||||
- "traefik.http.routers.edge-broker-local.entrypoints=web"
|
||||
- "traefik.http.routers.edge-broker-local.middlewares=secure-headers@file,edge-broker-strip-local"
|
||||
- "traefik.http.routers.edge-broker-local.priority=200"
|
||||
- "traefik.http.routers.edge-broker-local.service=edge-broker"
|
||||
- "traefik.http.routers.edge-broker-local-secure.rule=Host(`localhost`) && PathPrefix(`/api/edge-broker`)"
|
||||
|
||||
redis:
|
||||
image: redis:7
|
||||
@@ -66,8 +101,9 @@ services:
|
||||
mysql-debug:
|
||||
image: mysql:8.4
|
||||
container_name: mysql-debug
|
||||
profiles: [dev]
|
||||
environment:
|
||||
MYSQL_ROOT_PASSWORD: ${CONFIG_DB_DEBUG_PASSWORD:-debug_root_password}
|
||||
MYSQL_ROOT_PASSWORD: ${CONFIG_DB_DEBUG_PASSWORD:?CONFIG_DB_DEBUG_PASSWORD is required for mysql-debug}
|
||||
MYSQL_DATABASE: ${CONFIG_DB_DEBUG_DATABASE:-nnks_db_debug}
|
||||
ports:
|
||||
- "3307:3306"
|
||||
@@ -86,10 +122,59 @@ services:
|
||||
dockerfile: services/edge-broker/Dockerfile
|
||||
container_name: edge-broker
|
||||
environment:
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET}
|
||||
EDGE_AUTH_MODE: ${EDGE_AUTH_MODE:-strict}
|
||||
ports:
|
||||
- "127.0.0.1:4300:4300"
|
||||
EDGE_MANAGER_URL: ${EDGE_MANAGER_URL:-http://caddy}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.edge-broker-api.rule=Host(`api.truckwash.dk`) && PathPrefix(`/edge-broker`)"
|
||||
- "traefik.http.routers.edge-broker-api.entrypoints=websecure"
|
||||
- "traefik.http.routers.edge-broker-api.tls=true"
|
||||
- "traefik.http.routers.edge-broker-api.tls.certresolver=le"
|
||||
- "traefik.http.routers.edge-broker-api.middlewares=secure-headers@file,edge-broker-strip"
|
||||
- "traefik.http.routers.edge-broker-api.priority=200"
|
||||
- "traefik.http.routers.edge-broker-api.service=edge-broker"
|
||||
- "traefik.http.routers.edge-broker-api-io.rule=Host(`api.truckwash.io`) && PathPrefix(`/edge-broker`)"
|
||||
- "traefik.http.routers.edge-broker-api-io.entrypoints=websecure"
|
||||
- "traefik.http.routers.edge-broker-api-io.tls=true"
|
||||
- "traefik.http.routers.edge-broker-api-io.tls.certresolver=le_io"
|
||||
- "traefik.http.routers.edge-broker-api-io.middlewares=secure-headers@file,edge-broker-strip"
|
||||
- "traefik.http.routers.edge-broker-api-io.priority=200"
|
||||
- "traefik.http.routers.edge-broker-api-io.service=edge-broker"
|
||||
- "traefik.http.routers.edge-broker-api-v2.rule=Host(`api-v2.truckwash.io`) && PathPrefix(`/edge-broker`)"
|
||||
- "traefik.http.routers.edge-broker-api-v2.entrypoints=websecure"
|
||||
- "traefik.http.routers.edge-broker-api-v2.tls=true"
|
||||
- "traefik.http.routers.edge-broker-api-v2.tls.certresolver=le_io"
|
||||
- "traefik.http.routers.edge-broker-api-v2.middlewares=secure-headers@file,edge-broker-strip"
|
||||
- "traefik.http.routers.edge-broker-api-v2.priority=200"
|
||||
- "traefik.http.routers.edge-broker-api-v2.service=edge-broker"
|
||||
- "traefik.http.routers.edge-broker-api-staging.rule=Host(`api.truckwash.io`) && PathPrefix(`/edge-broker`)"
|
||||
- "traefik.http.routers.edge-broker-api-staging.entrypoints=websecure-staging"
|
||||
- "traefik.http.routers.edge-broker-api-staging.tls=true"
|
||||
- "traefik.http.routers.edge-broker-api-staging.tls.certresolver=le_io"
|
||||
- "traefik.http.routers.edge-broker-api-staging.middlewares=secure-headers@file,edge-broker-strip"
|
||||
- "traefik.http.routers.edge-broker-api-staging.priority=200"
|
||||
- "traefik.http.routers.edge-broker-api-staging.service=edge-broker"
|
||||
- "traefik.http.routers.edge-broker-local.rule=Host(`localhost`) && PathPrefix(`/api/edge-broker`)"
|
||||
- "traefik.http.routers.edge-broker-local.entrypoints=web"
|
||||
- "traefik.http.routers.edge-broker-local.middlewares=secure-headers@file,edge-broker-strip-local"
|
||||
- "traefik.http.routers.edge-broker-local.priority=200"
|
||||
- "traefik.http.routers.edge-broker-local.service=edge-broker"
|
||||
- "traefik.http.routers.edge-broker-local-secure.rule=Host(`localhost`) && PathPrefix(`/api/edge-broker`)"
|
||||
- "traefik.http.routers.edge-broker-local-secure.entrypoints=websecure"
|
||||
- "traefik.http.routers.edge-broker-local-secure.tls=true"
|
||||
- "traefik.http.routers.edge-broker-local-secure.middlewares=secure-headers@file,edge-broker-strip-local"
|
||||
- "traefik.http.routers.edge-broker-local-secure.priority=200"
|
||||
- "traefik.http.routers.edge-broker-local-secure.service=edge-broker"
|
||||
- "traefik.http.routers.edge-broker-local-staging.rule=Host(`localhost`) && PathPrefix(`/api/edge-broker`)"
|
||||
- "traefik.http.routers.edge-broker-local-staging.entrypoints=websecure-staging"
|
||||
- "traefik.http.routers.edge-broker-local-staging.tls=true"
|
||||
- "traefik.http.routers.edge-broker-local-staging.middlewares=secure-headers@file,edge-broker-strip-local"
|
||||
- "traefik.http.routers.edge-broker-local-staging.priority=200"
|
||||
- "traefik.http.routers.edge-broker-local-staging.service=edge-broker"
|
||||
- "traefik.http.middlewares.edge-broker-strip.stripPrefix.prefixes=/edge-broker"
|
||||
- "traefik.http.middlewares.edge-broker-strip-local.stripPrefix.prefixes=/api/edge-broker"
|
||||
- "traefik.http.services.edge-broker.loadbalancer.server.port=4300"
|
||||
|
||||
caddy:
|
||||
image: caddy:2.7.6-alpine
|
||||
@@ -102,7 +187,7 @@ services:
|
||||
- php5
|
||||
volumes:
|
||||
- ./services/nginx/app:/var/www/html
|
||||
- ./services/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
|
||||
- ./services/caddy:/etc/caddy:ro
|
||||
- ./services/caddy/logs:/var/log/caddy
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
@@ -122,8 +207,16 @@ services:
|
||||
- "traefik.http.routers.api-io.tls.certresolver=le_io"
|
||||
- "traefik.http.routers.api-io.service=caddy"
|
||||
- "traefik.http.routers.api-io.middlewares=secure-headers@file,api-ratelimit@file"
|
||||
# Public API (.io load-balanced gateway)
|
||||
- "traefik.http.routers.api-v2.rule=Host(`api-v2.truckwash.io`)"
|
||||
- "traefik.http.routers.api-v2.entrypoints=websecure"
|
||||
- "traefik.http.routers.api-v2.tls=true"
|
||||
- "traefik.http.routers.api-v2.tls.domains[0].main=api-v2.truckwash.io"
|
||||
- "traefik.http.routers.api-v2.tls.certresolver=le_io"
|
||||
- "traefik.http.routers.api-v2.service=caddy"
|
||||
- "traefik.http.routers.api-v2.middlewares=secure-headers@file,api-ratelimit@file"
|
||||
# HTTP to HTTPS redirect for both API domains
|
||||
- "traefik.http.routers.api-http.rule=Host(`api.truckwash.dk`) || Host(`api.truckwash.io`)"
|
||||
- "traefik.http.routers.api-http.rule=Host(`api.truckwash.dk`) || Host(`api.truckwash.io`) || Host(`api-v2.truckwash.io`)"
|
||||
- "traefik.http.routers.api-http.entrypoints=web"
|
||||
- "traefik.http.routers.api-http.middlewares=redirect-to-https@file"
|
||||
- "traefik.http.routers.api-http.service=caddy"
|
||||
@@ -159,9 +252,10 @@ services:
|
||||
container_name: caddy-staging
|
||||
depends_on:
|
||||
- php-staging
|
||||
command: ["caddy", "run", "--config", "/etc/caddy/Caddyfile-staging", "--adapter", "caddyfile"]
|
||||
volumes:
|
||||
- ./services/nginx/staging:/var/www/html
|
||||
- ./services/caddy/Caddyfile-staging:/etc/caddy/Caddyfile:ro
|
||||
- ./services/caddy:/etc/caddy:ro
|
||||
- ./services/caddy/logs-staging:/var/log/caddy
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
@@ -214,10 +308,9 @@ services:
|
||||
environment:
|
||||
AUTO_COMPOSER_INSTALL: "true"
|
||||
EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
|
||||
volumes:
|
||||
- ./services/nginx/app:/var/www/html
|
||||
- ./services/edge-agent/dist:/services/edge-agent/dist:ro
|
||||
- ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
|
||||
- ./services/php/logs:/var/log/php
|
||||
|
||||
@@ -235,10 +328,9 @@ services:
|
||||
environment:
|
||||
AUTO_COMPOSER_INSTALL: "false"
|
||||
EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
|
||||
volumes:
|
||||
- ./services/nginx/app:/var/www/html
|
||||
- ./services/edge-agent/dist:/services/edge-agent/dist:ro
|
||||
- ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
|
||||
- ./services/php/logs:/var/log/php
|
||||
|
||||
@@ -256,10 +348,9 @@ services:
|
||||
environment:
|
||||
AUTO_COMPOSER_INSTALL: "false"
|
||||
EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
|
||||
volumes:
|
||||
- ./services/nginx/app:/var/www/html
|
||||
- ./services/edge-agent/dist:/services/edge-agent/dist:ro
|
||||
- ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
|
||||
- ./services/php/logs:/var/log/php
|
||||
|
||||
@@ -277,10 +368,9 @@ services:
|
||||
environment:
|
||||
AUTO_COMPOSER_INSTALL: "false"
|
||||
EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
|
||||
volumes:
|
||||
- ./services/nginx/app:/var/www/html
|
||||
- ./services/edge-agent/dist:/services/edge-agent/dist:ro
|
||||
- ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
|
||||
- ./services/php/logs:/var/log/php
|
||||
|
||||
@@ -298,10 +388,9 @@ services:
|
||||
environment:
|
||||
AUTO_COMPOSER_INSTALL: "false"
|
||||
EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
|
||||
volumes:
|
||||
- ./services/nginx/app:/var/www/html
|
||||
- ./services/edge-agent/dist:/services/edge-agent/dist:ro
|
||||
- ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
|
||||
- ./services/php/logs:/var/log/php
|
||||
|
||||
@@ -319,10 +408,9 @@ services:
|
||||
environment:
|
||||
AUTO_COMPOSER_INSTALL: "false"
|
||||
EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
|
||||
volumes:
|
||||
- ./services/nginx/staging:/var/www/html
|
||||
- ./services/edge-agent/dist:/services/edge-agent/dist:ro
|
||||
- ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
|
||||
- ./services/php/logs-staging:/var/log/php
|
||||
|
||||
@@ -340,10 +428,9 @@ services:
|
||||
environment:
|
||||
AUTO_COMPOSER_INSTALL: "false"
|
||||
EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET}
|
||||
EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
|
||||
volumes:
|
||||
- ./services/nginx/app:/var/www/html
|
||||
- ./services/edge-agent/dist:/services/edge-agent/dist:ro
|
||||
- ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
|
||||
- ./services/php/logs:/var/log/php
|
||||
portainer:
|
||||
|
||||
Reference in New Issue
Block a user