Adriano/TieMeasureFlow
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases 3 Wiki Activity

deploy(traefik): label Traefik v3, dominio da APP_DOMAIN, middleware anche su tmflow-api (#38)

Browse Source 
Punto 11: rimossi SSLRedirect e browserXSSFilter (non esistono più in
Traefik v3), aggiunto frameDeny; rule di entrambi i router da
${APP_DOMAIN:?manca APP_DOMAIN}, non più il dominio cablato. Middleware
tmflow-headers ora applicato anche al router API, non solo al web.

Resto del punto 10: rimosso il PathPrefix(`/uploads/`) dalla rule
dell'API — stesso motivo della location nginx già tolta: nessun mount,
i file passano da /api/files.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
AdrianoDev
2026-09-21 22:35:25 +02:00
parent e91ef739af
commit 7a21ec4e44
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-compose.yml
+7 -5
View File
@@ -50,12 +50,13 @@ services:
start_period: 20s
labels:
- "traefik.enable=true"
- "traefik.http.routers.tmflow-api.rule=Host(`tieflow.tielogic.xyz`) && (PathPrefix(`/api/`) || PathPrefix(`/uploads/`))"
- "traefik.http.routers.tmflow-api.rule=Host(`${APP_DOMAIN:?manca APP_DOMAIN}`) && PathPrefix(`/api/`)"
- "traefik.http.routers.tmflow-api.entrypoints=web,websecure"
- "traefik.http.routers.tmflow-api.tls=true"
- "traefik.http.routers.tmflow-api.tls.certresolver=mytlschallenge"
- "traefik.http.routers.tmflow-api.priority=100"
- "traefik.http.services.tmflow-api.loadbalancer.server.port=8000"
- "traefik.http.routers.tmflow-api.middlewares=tmflow-headers"
networks:
- tmflow-net
- traefik-net
@@ -99,19 +100,20 @@ services:
start_period: 20s
labels:
- "traefik.enable=true"
- "traefik.http.routers.tmflow-web.rule=Host(`tieflow.tielogic.xyz`)"
- "traefik.http.routers.tmflow-web.rule=Host(`${APP_DOMAIN:?manca APP_DOMAIN}`)"
- "traefik.http.routers.tmflow-web.entrypoints=web,websecure"
- "traefik.http.routers.tmflow-web.tls=true"
- "traefik.http.routers.tmflow-web.tls.certresolver=mytlschallenge"
- "traefik.http.routers.tmflow-web.priority=10"
- "traefik.http.services.tmflow-web.loadbalancer.server.port=5000"
- "traefik.http.middlewares.tmflow-headers.headers.SSLRedirect=true"
- "traefik.http.middlewares.tmflow-headers.headers.STSSeconds=315360000"
- "traefik.http.middlewares.tmflow-headers.headers.browserXSSFilter=true"
# Traefik v3: SSLRedirect e browserXSSFilter non ci sono più (SSL redirect
# si fa a livello di entrypoint, l'XSS Auditor del browser non esiste più).
- "traefik.http.middlewares.tmflow-headers.headers.stsSeconds=315360000"
- "traefik.http.middlewares.tmflow-headers.headers.contentTypeNosniff=true"
- "traefik.http.middlewares.tmflow-headers.headers.forceSTSHeader=true"
- "traefik.http.middlewares.tmflow-headers.headers.STSIncludeSubdomains=true"
- "traefik.http.middlewares.tmflow-headers.headers.STSPreload=true"
- "traefik.http.middlewares.tmflow-headers.headers.frameDeny=true"
- "traefik.http.routers.tmflow-web.middlewares=tmflow-headers"
networks:
- tmflow-net