「🏗️」 wip: should be ready to prod

docker/docker-compose.prod.yml

@@ -0,0 +1,47 @@
+name: ft_transcendence
+
+include:
+  - ./volumes.yml
+  - ./networks.yml
+  - ./front/compose.yml
+  - ./proxy/compose.yml
+  - ./monitoring/compose.yml
+  - ./api-base/compose.yml
+  # - ./front/compose.yml
+  - ./ELK/compose.yml
+
+services:
+  proxy:
+    container_name: transcendence-proxy
+    build:
+      dockerfile: docker/proxy/Dockerfile
+      context: ../
+    volumes:
+      - log-nginx:/var/log/front
+    environment:
+      - TZ=Europe/Paris
+    depends_on:
+      user-api:
+        condition: service_started
+      auth-api:
+        condition: service_started
+    networks:
+      - front
+      - traefik-back
+    restart: unless-stopped
+    healthcheck:
+      disable: true
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-back
+      
+      - traefik.http.routers.trans.rule=Host(`trans.kanel.ovh`)
+      - traefik.http.routers.trans.entrypoints=websecure
+      - traefik.http.routers.trans.tls=true
+      - traefik.http.routers.trans.tls.certresolver=letsencrypt
+      - traefik.http.routers.trans.service=trans
+      - traefik.http.services.trans.loadbalancer.server.port=80
+
+networks:
+  traefik-back:
+    external: true

docker/front/Dockerfile

@@ -1,4 +1,17 @@
-FROM		node:lts-alpine AS builder
+FROM		alpine:3.22 AS builder
+
+ENV			PKGS=true
+ENV			TTY=true
+
+RUN			apk add --no-cache bash clang make git
+
+RUN			git clone --recurse-submodules https://github.com/keyzox71/webserv /build \
+			&& cd /build && git checkout prod
+
+RUN			cd /build \
+			&& CXXFLAGS="-std=c++98" PKGS=true make -j re
+
+FROM		node:lts-alpine AS builder-vite
 
 RUN			npm install -g pnpm
 
@@ -13,23 +26,21 @@ COPY		src ./src
 
 RUN			pnpm vite build
 
-FROM		owasp/modsecurity-crs:nginx-alpine
 
-RUN			mkdir -p /etc/nginx/modsecurity.d \
+FROM		alpine:3.22
-			&& cp /etc/modsecurity.d/unicode.mapping /etc/nginx/modsecurity.d/unicode.mapping
 
-COPY		docker/front/config/default.conf.template \
+RUN			apk add --no-cache libstdc++ tzdata
-			/etc/nginx/templates/conf.d/default.conf.template
 
-COPY		--chmod=755 docker/front/entry/ssl-cert.sh /docker-entrypoint.d/ssl-cert.sh
+COPY		--from=builder /build/webserv /bin/webserv
 
-COPY		--from=builder /app/dist /usr/share/nginx/html
+RUN			chmod +x /bin/webserv
+RUN			mkdir -p /usr/share/webserv
+RUN			chmod 777 /usr/share/webserv
 
-USER		root
+COPY		--chmod=644 docker/front/config.toml /config.toml
-RUN			mkdir -p /var/log/front
-RUN			touch /var/log/front/err.log /var/log/front/log.log
-RUN			chmod -R 777 /var/log/front
-USER		nginx
 
-EXPOSE		80 443
+COPY		--from=builder-vite /app/dist /usr/share/webserv
-STOPSIGNAL	SIGINT
+
+WORKDIR		/
+
+CMD			[ "/bin/webserv", "/config.toml" ]

docker/front/compose.yml

@@ -1,20 +1,11 @@
 services:
-  front:
+  webserv:
-    container_name: transcendence-front
+    container_name: transcendence-webserv
     build:
       dockerfile: docker/front/Dockerfile
       context: ../../
-    ports:
-      - ${OUT_PORT}:443
-    volumes:
-      - log-nginx:/var/log/front
     environment:
       - TZ=Europe/Paris
-    depends_on:
-      user-api:
-        condition: service_started
-      auth-api:
-        condition: service_started
     networks:
       - front
     restart: unless-stopped

docker/front/config.toml

@@ -0,0 +1,7 @@
+[server]
+host = "0.0.0.0"
+port = 80
+
+[server.location./]
+methods = { "GET" }
+root = "/usr/share/webserv"

docker/monitoring/exporters/nginx/compose.yml

@@ -3,7 +3,7 @@ services:
     container_name: transcendence-nginx-exporter
     image: nginx/nginx-prometheus-exporter:latest
     command:
-      - '-nginx.scrape-uri=http://transcendence-front:8080/status/format/json'
+      - '-nginx.scrape-uri=http://transcendence-front:8080/nginx_status'
     depends_on:
       front:
         condition: service_started

docker/proxy/Dockerfile

@@ -0,0 +1,35 @@
+FROM		node:lts-alpine AS builder
+
+RUN			npm install -g pnpm
+
+WORKDIR		/app
+
+COPY		package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+
+RUN			pnpm install --frozen-lockfile
+
+COPY		vite.config.js tailwind.config.js ./
+COPY		src ./src
+
+RUN			pnpm vite build
+
+FROM		owasp/modsecurity-crs:nginx-alpine
+
+RUN			mkdir -p /etc/nginx/modsecurity.d \
+			&& cp /etc/modsecurity.d/unicode.mapping /etc/nginx/modsecurity.d/unicode.mapping
+
+COPY		docker/proxy/config/default.conf.template \
+			/etc/nginx/templates/conf.d/default.conf.template
+
+COPY		--chmod=755 docker/proxy/entry/ssl-cert.sh /docker-entrypoint.d/ssl-cert.sh
+
+COPY		--from=builder /app/dist /usr/share/nginx/html
+
+USER		root
+RUN			mkdir -p /var/log/front
+RUN			touch /var/log/front/err.log /var/log/front/log.log
+RUN			chmod -R 777 /var/log/front
+USER		nginx
+
+EXPOSE		80 443
+STOPSIGNAL	SIGINT

docker/proxy/compose.yml

@@ -0,0 +1,20 @@
+services:
+  front:
+    container_name: transcendence-front
+    build:
+      dockerfile: docker/front/Dockerfile
+      context: ../../
+    ports:
+      - ${OUT_PORT}:443
+    volumes:
+      - log-nginx:/var/log/front
+    environment:
+      - TZ=Europe/Paris
+    depends_on:
+      user-api:
+        condition: service_started
+      auth-api:
+        condition: service_started
+    networks:
+      - front
+    restart: unless-stopped

docker/proxy/config/default.conf.template

@@ -2,23 +2,20 @@ server {
 	error_log /var/log/front/err.log warn;
 	access_log /var/log/front/log.log;
 
-    listen 443 ssl;
+    listen 80;
-    server_name example.com;  # Replace with your domain or handle env vars externally
-
-    ssl_certificate     /etc/nginx/certs/fullchain.pem;
-    ssl_certificate_key /etc/nginx/certs/privkey.pem;
-
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers HIGH:!aNULL:!MD5;
-
-    root /usr/share/nginx/html;
-    index index.html;
 
     modsecurity on;
 
-    location / {
+	add_header X-Frame-Options "SAMEORIGIN" always;
-        try_files $uri $uri/ =404;
+    add_header X-Content-Type-Options "nosniff" always;
-    }
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+
+	location / {
+		proxy_pass http://transcendence-webserv:80/;
+		proxy_http_version 1.1;
+	}
 
     location /api/v1/user/ {
         proxy_pass http://transcendence-api-user:3000/;
@@ -43,12 +40,6 @@ server {
 	}
 }
 
-server {
-    listen 80;
-    server_name example.com;
-    return 301 https://$host$request_uri;
-}
-
 server {
     listen 8080;
     location /nginx_status {