「🏗️」 wip: should be ready to prod (closes #38)

docker/docker-compose.prod.yml

@@ -0,0 +1,10 @@
+name: ft_transcendence
+
+include:
+  - ./volumes.yml
+  - ./networks.yml
+  - ./front/compose.yml
+  - ./proxy/compose.prod.yml
+  - ./monitoring/compose.yml
+  - ./api-base/compose.yml
+  - ./ELK/compose.yml

docker/docker-compose.yml

@@ -6,4 +6,5 @@ include:
   - ./monitoring/compose.yml
   - ./api-base/compose.yml
   - ./front/compose.yml
+  - ./proxy/compose.yml
   - ./ELK/compose.yml

docker/front/Dockerfile

@@ -1,4 +1,17 @@
-FROM		node:lts-alpine AS builder
+FROM		alpine:3.22 AS builder
+
+ENV			PKGS=true
+ENV			TTY=true
+
+RUN			apk add --no-cache bash clang make git
+
+RUN			git clone --recurse-submodules https://github.com/keyzox71/webserv /build \
+			&& cd /build && git checkout prod
+
+RUN			cd /build \
+			&& CXXFLAGS="-std=c++98" PKGS=true make -j re
+
+FROM		node:lts-alpine AS builder-vite
 
 RUN			npm install -g pnpm
 
@@ -13,23 +26,21 @@ COPY		src ./src
 
 RUN			pnpm vite build
 
-FROM		owasp/modsecurity-crs:nginx-alpine
 
-RUN			mkdir -p /etc/nginx/modsecurity.d \
-			&& cp /etc/modsecurity.d/unicode.mapping /etc/nginx/modsecurity.d/unicode.mapping
+FROM		alpine:3.22
 
-COPY		docker/front/config/default.conf.template \
-			/etc/nginx/templates/conf.d/default.conf.template
+RUN			apk add --no-cache libstdc++ tzdata
 
-COPY		--chmod=755 docker/front/entry/ssl-cert.sh /docker-entrypoint.d/ssl-cert.sh
+COPY		--from=builder /build/webserv /bin/webserv
 
-COPY		--from=builder /app/dist /usr/share/nginx/html
+RUN			chmod +x /bin/webserv
+RUN			mkdir -p /usr/share/webserv
+RUN			chmod 777 /usr/share/webserv
 
-USER		root
-RUN			mkdir -p /var/log/front
-RUN			touch /var/log/front/err.log /var/log/front/log.log
-RUN			chmod -R 777 /var/log/front
-USER		nginx
+COPY		--chmod=644 docker/front/config.toml /config.toml
 
-EXPOSE		80 443
-STOPSIGNAL	SIGINT
+COPY		--from=builder-vite /app/dist /usr/share/webserv
+
+WORKDIR		/
+
+CMD			[ "/bin/webserv", "/config.toml" ]

docker/front/compose.yml

@@ -1,20 +1,11 @@
 services:
-  front:
-    container_name: transcendence-front
+  webserv:
+    container_name: transcendence-webserv
     build:
       dockerfile: docker/front/Dockerfile
       context: ../../
-    ports:
-      - ${OUT_PORT}:443
-    volumes:
-      - log-nginx:/var/log/front
     environment:
       - TZ=Europe/Paris
-    depends_on:
-      user-api:
-        condition: service_started
-      auth-api:
-        condition: service_started
     networks:
       - front
     restart: unless-stopped

docker/front/config.toml

@@ -0,0 +1,7 @@
+[server]
+host = "0.0.0.0"
+port = 80
+
+[server.location./]
+methods = { "GET" }
+root = "/usr/share/webserv"

docker/monitoring/exporters/nginx/compose.yml

@@ -3,7 +3,7 @@ services:
     container_name: transcendence-nginx-exporter
     image: nginx/nginx-prometheus-exporter:latest
     command:
-      - '-nginx.scrape-uri=http://transcendence-front:8080/status/format/json'
+      - '-nginx.scrape-uri=http://transcendence-front:8080/nginx_status'
     depends_on:
       front:
         condition: service_started

docker/proxy/Dockerfile

@@ -0,0 +1,35 @@
+FROM		node:lts-alpine AS builder
+
+RUN			npm install -g pnpm
+
+WORKDIR		/app
+
+COPY		package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+
+RUN			pnpm install --frozen-lockfile
+
+COPY		vite.config.js tailwind.config.js ./
+COPY		src ./src
+
+RUN			pnpm vite build
+
+FROM		owasp/modsecurity-crs:nginx-alpine
+
+RUN			mkdir -p /etc/nginx/modsecurity.d \
+			&& cp /etc/modsecurity.d/unicode.mapping /etc/nginx/modsecurity.d/unicode.mapping
+
+COPY		docker/proxy/config/default.conf.template \
+			/etc/nginx/templates/conf.d/default.conf.template
+
+COPY		--chmod=755 docker/proxy/entry/ssl-cert.sh /docker-entrypoint.d/ssl-cert.sh
+
+COPY		--from=builder /app/dist /usr/share/nginx/html
+
+USER		root
+RUN			mkdir -p /var/log/front
+RUN			touch /var/log/front/err.log /var/log/front/log.log
+RUN			chmod -R 777 /var/log/front
+USER		nginx
+
+EXPOSE		80 443
+STOPSIGNAL	SIGINT

docker/proxy/Dockerfile.prod

@@ -0,0 +1,35 @@
+FROM		node:lts-alpine AS builder
+
+RUN			npm install -g pnpm
+
+WORKDIR		/app
+
+COPY		package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+
+RUN			pnpm install --frozen-lockfile
+
+COPY		vite.config.js tailwind.config.js ./
+COPY		src ./src
+
+RUN			pnpm vite build
+
+FROM		owasp/modsecurity-crs:nginx-alpine
+
+RUN			mkdir -p /etc/nginx/modsecurity.d \
+			&& cp /etc/modsecurity.d/unicode.mapping /etc/nginx/modsecurity.d/unicode.mapping
+
+COPY		docker/proxy/config/default.prod.conf.template \
+			/etc/nginx/templates/conf.d/default.conf.template
+
+COPY		--chmod=755 docker/proxy/entry/ssl-cert.sh /docker-entrypoint.d/ssl-cert.sh
+
+COPY		--from=builder /app/dist /usr/share/nginx/html
+
+USER		root
+RUN			mkdir -p /var/log/front
+RUN			touch /var/log/front/err.log /var/log/front/log.log
+RUN			chmod -R 777 /var/log/front
+USER		nginx
+
+EXPOSE		80 443
+STOPSIGNAL	SIGINT

docker/proxy/compose.prod.yml

@@ -0,0 +1,35 @@
+services:
+  front:
+    container_name: transcendence-front
+    build:
+      dockerfile: docker/proxy/Dockerfile.prod
+      context: ../../
+    volumes:
+      - log-nginx:/var/log/front
+    environment:
+      - TZ=Europe/Paris
+    depends_on:
+      user-api:
+        condition: service_started
+      auth-api:
+        condition: service_started
+    networks:
+      - front
+      - traefik-back
+    restart: unless-stopped
+    healthcheck:
+      disable: true
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-back
+      
+      - traefik.http.routers.trans.rule=Host(`trans.kanel.ovh`)
+      - traefik.http.routers.trans.entrypoints=websecure
+      - traefik.http.routers.trans.tls=true
+      - traefik.http.routers.trans.tls.certresolver=letsencrypt
+      - traefik.http.routers.trans.service=trans
+      - traefik.http.services.trans.loadbalancer.server.port=80
+
+networks:
+  traefik-back:
+    external: true

docker/proxy/compose.yml

@@ -0,0 +1,20 @@
+services:
+  front:
+    container_name: transcendence-front
+    build:
+      dockerfile: docker/proxy/Dockerfile
+      context: ../../
+    ports:
+      - ${OUT_PORT}:443
+    volumes:
+      - log-nginx:/var/log/front
+    environment:
+      - TZ=Europe/Paris
+    depends_on:
+      user-api:
+        condition: service_started
+      auth-api:
+        condition: service_started
+    networks:
+      - front
+    restart: unless-stopped

docker/proxy/config/default.conf.template

@@ -3,7 +3,6 @@ server {
 	access_log /var/log/front/log.log;
 
     listen 443 ssl;
-    server_name example.com;  # Replace with your domain or handle env vars externally
 
     ssl_certificate     /etc/nginx/certs/fullchain.pem;
     ssl_certificate_key /etc/nginx/certs/privkey.pem;
@@ -11,14 +10,18 @@ server {
     ssl_protocols TLSv1.2 TLSv1.3;
     ssl_ciphers HIGH:!aNULL:!MD5;
 
-    root /usr/share/nginx/html;
-    index index.html;
-
     modsecurity on;
 
-    location / {
-        try_files $uri $uri/ =404;
-    }
+	add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+
+	location / {
+		proxy_pass http://transcendence-webserv:80/;
+		proxy_http_version 1.1;
+	}
 
     location /api/v1/user/ {
         proxy_pass http://transcendence-api-user:3000/;
@@ -38,15 +41,14 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
-	location /api/v1/auth/metrics {
-		return 403;
+	location /api/v1/auth/login/google/callback {
+		modsecurity off;
+        proxy_pass http://transcendence-api-auth:3000/login/google/callback;
+	}
+	location /api/v1/auth/register/google/callback {
+		modsecurity off;
+        proxy_pass http://transcendence-api-auth:3000/register/google/callback;
 	}
-}
-
-server {
-    listen 80;
-    server_name example.com;
-    return 301 https://$host$request_uri;
 }
 
 server {

docker/proxy/config/default.prod.conf.template

@@ -0,0 +1,56 @@
+server {
+	error_log /var/log/front/err.log warn;
+	access_log /var/log/front/log.log;
+
+    listen 80;
+
+    modsecurity on;
+
+	add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+
+	location / {
+		proxy_pass http://transcendence-webserv:80/;
+		proxy_http_version 1.1;
+	}
+
+    location /api/v1/user/ {
+        proxy_pass http://transcendence-api-user:3000/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+	location /api/v1/user/metrics {
+		return 403;
+	}
+
+    location /api/v1/auth/ {
+        proxy_pass http://transcendence-api-auth:3000/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+	location /api/v1/auth/metrics {
+		return 403;
+	}
+	location /api/v1/auth/login/google/callback {
+		modsecurity off;
+        proxy_pass http://transcendence-api-auth:3000/login/google/callback;
+	}
+	location /api/v1/auth/register/google/callback {
+		modsecurity off;
+        proxy_pass http://transcendence-api-auth:3000/register/google/callback;
+	}
+}
+
+server {
+    listen 8080;
+    location /nginx_status {
+        stub_status;
+    }
+}

src/utils/scoreStore_contract.js

@@ -3,14 +3,14 @@ import { readFile } from "fs/promises";
 
 export const rpc_url = process.env.AVAX_RPC_URL;
 export const contract_addr = process.env.AVAX_CONTRACT_ADDR;
-export const owner_priv_key = process.env.AVAX_PRIVATE_KEY;
+export const owner_priv_key = process.env.AVAX_PRIVATE_KEY || "0x00000000000000000000000000000000000000000000";
 
 const provider = new ethers.JsonRpcProvider(rpc_url);
 
-const wallet = new ethers.Wallet(owner_priv_key, provider);
 
 async function loadContract() {
 	try {
+		const wallet = new ethers.Wallet(owner_priv_key, provider);
 		const contractABI = JSON.parse(await readFile(new URL('../contract/scoreStore.json', import.meta.url)));
 
 		const contract = new ethers.Contract(contract_addr, contractABI, wallet);