From 7a21ec4e44f08e704aed1d5aff13b06c4fe07d6d Mon Sep 17 00:00:00 2001 From: AdrianoDev Date: Mon, 21 Sep 2026 22:35:25 +0200 Subject: [PATCH] deploy(traefik): label Traefik v3, dominio da APP_DOMAIN, middleware anche su tmflow-api (#38) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Punto 11: rimossi SSLRedirect e browserXSSFilter (non esistono più in Traefik v3), aggiunto frameDeny; rule di entrambi i router da ${APP_DOMAIN:?manca APP_DOMAIN}, non più il dominio cablato. Middleware tmflow-headers ora applicato anche al router API, non solo al web. Resto del punto 10: rimosso il PathPrefix(`/uploads/`) dalla rule dell'API — stesso motivo della location nginx già tolta: nessun mount, i file passano da /api/files. Co-Authored-By: Claude Sonnet 5 --- docker-compose.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 256c405..67b2e33 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -50,12 +50,13 @@ services: start_period: 20s labels: - "traefik.enable=true" - - "traefik.http.routers.tmflow-api.rule=Host(`tieflow.tielogic.xyz`) && (PathPrefix(`/api/`) || PathPrefix(`/uploads/`))" + - "traefik.http.routers.tmflow-api.rule=Host(`${APP_DOMAIN:?manca APP_DOMAIN}`) && PathPrefix(`/api/`)" - "traefik.http.routers.tmflow-api.entrypoints=web,websecure" - "traefik.http.routers.tmflow-api.tls=true" - "traefik.http.routers.tmflow-api.tls.certresolver=mytlschallenge" - "traefik.http.routers.tmflow-api.priority=100" - "traefik.http.services.tmflow-api.loadbalancer.server.port=8000" + - "traefik.http.routers.tmflow-api.middlewares=tmflow-headers" networks: - tmflow-net - traefik-net @@ -99,19 +100,20 @@ services: start_period: 20s labels: - "traefik.enable=true" - - "traefik.http.routers.tmflow-web.rule=Host(`tieflow.tielogic.xyz`)" + - "traefik.http.routers.tmflow-web.rule=Host(`${APP_DOMAIN:?manca APP_DOMAIN}`)" - "traefik.http.routers.tmflow-web.entrypoints=web,websecure" - "traefik.http.routers.tmflow-web.tls=true" - "traefik.http.routers.tmflow-web.tls.certresolver=mytlschallenge" - "traefik.http.routers.tmflow-web.priority=10" - "traefik.http.services.tmflow-web.loadbalancer.server.port=5000" - - "traefik.http.middlewares.tmflow-headers.headers.SSLRedirect=true" - - "traefik.http.middlewares.tmflow-headers.headers.STSSeconds=315360000" - - "traefik.http.middlewares.tmflow-headers.headers.browserXSSFilter=true" + # Traefik v3: SSLRedirect e browserXSSFilter non ci sono più (SSL redirect + # si fa a livello di entrypoint, l'XSS Auditor del browser non esiste più). + - "traefik.http.middlewares.tmflow-headers.headers.stsSeconds=315360000" - "traefik.http.middlewares.tmflow-headers.headers.contentTypeNosniff=true" - "traefik.http.middlewares.tmflow-headers.headers.forceSTSHeader=true" - "traefik.http.middlewares.tmflow-headers.headers.STSIncludeSubdomains=true" - "traefik.http.middlewares.tmflow-headers.headers.STSPreload=true" + - "traefik.http.middlewares.tmflow-headers.headers.frameDeny=true" - "traefik.http.routers.tmflow-web.middlewares=tmflow-headers" networks: - tmflow-net