Planify/compose.yml at main · quentingimenez/Planify · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
networks:
  edge:
    driver: bridge
  app:
    driver: bridge

volumes:
  pgdata:
  traefik-acme:

services:
  reverse-proxy:
    image: traefik:v3.5.4
    container_name: planify-proxy
    command:
      - --api.dashboard=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      # - --entrypoints.web.http.redirections.entryPoint.to=websecure  # Désactivé pour le test local
      # - --entrypoints.web.http.redirections.entryPoint.scheme=https   # Désactivé pour le test local
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      # - --certificatesresolvers.le.acme.tlschallenge=true           # Désactivé pour le test local
      # - --certificatesresolvers.le.acme.email=${ACME_EMAIL}         # Désactivé pour le test local
      # - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json # Désactivé pour le test local
      - --serversTransport.insecureSkipVerify=false
    ports:
      - "80:80"
      - "443:443"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-acme:/letsencrypt
    networks:
      - edge
      - app
    labels:
      - "traefik.enable=true"
      # Middlewares globaux sécurité + RPS limit
      - "traefik.http.middlewares.secure-headers.headers.stsSeconds=31536000"
      - "traefik.http.middlewares.secure-headers.headers.stsIncludeSubdomains=true"
      - "traefik.http.middlewares.secure-headers.headers.stsPreload=true"
      - "traefik.http.middlewares.secure-headers.headers.forceSTSHeader=true"
      - "traefik.http.middlewares.secure-headers.headers.frameDeny=true"
      - "traefik.http.middlewares.secure-headers.headers.referrerPolicy=no-referrer"
      - "traefik.http.middlewares.secure-headers.headers.contentTypeNosniff=true"
      - "traefik.http.middlewares.secure-headers.headers.browserXssFilter=true"
      - "traefik.http.middlewares.csp.headers.contentSecurityPolicy=\
        default-src 'self'; \
        script-src 'self' 'unsafe-inline'; \
        style-src 'self' 'unsafe-inline'; \
        img-src 'self' data:; \
        font-src 'self' data:; \
        connect-src 'self' http://localhost ws://localhost; \
        frame-ancestors 'none'"
      - "traefik.http.middlewares.ratelimit.ratelimit.average=50"
      - "traefik.http.middlewares.ratelimit.ratelimit.burst=100"
      # Middleware pour bloquer tout accès direct à /api au niveau proxy
      - "traefik.http.middlewares.block-api-path.stripprefixregex.regex=/api(/.*)?"
      - "traefik.http.middlewares.block-api-path.errors.status=403"
      - "traefik.http.middlewares.block-api-path.errors.service=error-svc"
      - "traefik.http.middlewares.block-api-path.errors.query=/403.html"
      # Service d'erreur minimal (renvoi 403)
      - "traefik.http.services.error-svc.loadbalancer.server.port=65535"

  front:
    image: ghcr.io/quentingimenez/planify_frontend:latest
    container_name: Planify-front
    expose:
      - "3000"
    depends_on:
      - back
    environment:
      - NODE_ENV=production
    networks:
      - app
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.front.rule=Host(`${APP_DOMAIN}`)"
      - "traefik.http.routers.front.entrypoints=web" # Changé de websecure à web
      # - "traefik.http.routers.front.tls.certresolver=le" # Désactivé pour le test local
      - "traefik.http.services.front.loadbalancer.server.port=3000"
      # Appliquer sécurité + rate limit
      - "traefik.http.routers.front.middlewares=secure-headers,csp,ratelimit"

  back:
    image: ghcr.io/quentingimenez/planify_backend:latest
    container_name: Planify-back
    expose:
      - "4000"
    environment:
      - NODE_ENV=production
      - JWT_SECRET=${JWT_SECRET}
      - DATABASE_URL="postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}"
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_PORT=${SMTP_PORT}
      - SMTP_SECURE=${SMTP_SECURE}
      - SMTP_USER=${SMTP_USER}
      - SMTP_PASS=${SMTP_PASS}
    depends_on:
      - db
    networks:
      - app

  db:
    image: postgres:16.10-alpine3.22
    container_name: Planify-postgres
    restart: always
    environment:
      - POSTGRES_DB=${POSTGRES_DB}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    expose:
      - "5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    networks:
      - app

  pgadmin:
    image: dpage/pgadmin4:latest
    container_name: Planify-pgadmin
    restart: always
    environment:
      - PGADMIN_DEFAULT_EMAIL=${PGADMIN_DEFAULT_EMAIL}
      - PGADMIN_DEFAULT_PASSWORD=${PGADMIN_DEFAULT_PASSWORD}
      - PGADMIN_CONFIG_SERVER_MODE=False
      - PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED=False
    ports:
      - "8080:80"
    depends_on:
      - db
    networks:
      - app