Jan WagnerandCursor
7e8313c96e
Product news is written at /admin behind Traefik forward-auth, while the public JSON and RSS feeds stay unauthenticated. Co-authored-by: Cursor <cursoragent@cursor.com>
87 lines
3.6 KiB
YAML
87 lines
3.6 KiB
YAML
services:
|
|
# Das Portfolio (Next.js)
|
|
w-make-portfolio:
|
|
build: .
|
|
image: w-make-portfolio:latest
|
|
container_name: w-make-portfolio
|
|
restart: always
|
|
environment:
|
|
- UPDATES_API_URL=http://updates-api:8080
|
|
- NEXT_PUBLIC_SITE_URL=https://w-make.com
|
|
- CONTACT_TO=${CONTACT_TO:-eldov@w-make.de}
|
|
- "CONTACT_FROM=${CONTACT_FROM:-W-MAKE <eldov@w-make.de>}"
|
|
- SMTP_HOST=${SMTP_HOST:-smtp.strato.de}
|
|
- SMTP_PORT=${SMTP_PORT:-465}
|
|
- SMTP_USER=${SMTP_USER:-eldov@w-make.de}
|
|
- SMTP_PASS=${SMTP_PASS}
|
|
- INQUIRIES_DB_PATH=/data/inquiries.sqlite
|
|
volumes:
|
|
- inquiries_data:/data
|
|
expose:
|
|
- "3000"
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=proxy"
|
|
- "traefik.http.routers.w-make.rule=Host(`w-make.com`) || Host(`www.w-make.com`)"
|
|
- "traefik.http.routers.w-make.priority=100"
|
|
- "traefik.http.routers.w-make.entrypoints=websecure"
|
|
- "traefik.http.routers.w-make.tls=true"
|
|
- "traefik.http.routers.w-make.tls.certresolver=http_resolver"
|
|
- "traefik.http.routers.w-make.middlewares=default@file,crowdsec-bouncer-plugin@file"
|
|
- "traefik.http.services.w-make.loadbalancer.server.port=3000"
|
|
networks:
|
|
- proxy
|
|
|
|
updates-api:
|
|
build:
|
|
context: ./services/updates-api
|
|
image: w-make-updates-api:latest
|
|
container_name: w-make-updates-api
|
|
restart: unless-stopped
|
|
environment:
|
|
- PORT=8080
|
|
- HOSTNAME=0.0.0.0
|
|
- UPDATES_DB_PATH=/data/updates.sqlite
|
|
- UPDATES_ADMIN_TOKEN=${UPDATES_ADMIN_TOKEN:?UPDATES_ADMIN_TOKEN must be set}
|
|
volumes:
|
|
- updates_data:/data
|
|
expose:
|
|
- "8080"
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:8080/healthz', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=proxy"
|
|
- "traefik.http.routers.w-make-updates.rule=Host(`updates.w-make.com`)"
|
|
- "traefik.http.routers.w-make-updates.priority=10"
|
|
- "traefik.http.routers.w-make-updates.entrypoints=websecure"
|
|
- "traefik.http.routers.w-make-updates.tls=true"
|
|
- "traefik.http.routers.w-make-updates.tls.certresolver=http_resolver"
|
|
- "traefik.http.routers.w-make-updates.middlewares=default@file,crowdsec-bouncer-plugin@file"
|
|
- "traefik.http.services.w-make-updates.loadbalancer.server.port=8080"
|
|
- "traefik.http.middlewares.wmake-updates-authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.w-make.com"
|
|
- "traefik.http.middlewares.wmake-updates-authelia.forwardauth.trustForwardHeader=true"
|
|
- "traefik.http.middlewares.wmake-updates-authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups"
|
|
- "traefik.http.routers.w-make-updates-admin.rule=Host(`updates.w-make.com`) && (PathPrefix(`/admin`) || PathPrefix(`/v1/admin`))"
|
|
- "traefik.http.routers.w-make-updates-admin.priority=200"
|
|
- "traefik.http.routers.w-make-updates-admin.entrypoints=websecure"
|
|
- "traefik.http.routers.w-make-updates-admin.tls=true"
|
|
- "traefik.http.routers.w-make-updates-admin.tls.certresolver=http_resolver"
|
|
- "traefik.http.routers.w-make-updates-admin.middlewares=default@file,crowdsec-bouncer-plugin@file,wmake-updates-authelia@docker"
|
|
- "traefik.http.routers.w-make-updates-admin.service=w-make-updates"
|
|
networks:
|
|
- proxy
|
|
|
|
volumes:
|
|
updates_data:
|
|
inquiries_data:
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|