Setup env (#24)

Reviewed-on: #24
Co-authored-by: kovagoadi <kovagoadi@gmail.com>
Co-committed-by: kovagoadi <kovagoadi@gmail.com>

.gitea/workflows/workflow.yaml

@@ -46,10 +46,10 @@ jobs:
     needs: [prepare_context]
     if: github.event_name == 'pull_request' && github.event.action != 'closed'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
       - name: Deploy via Rsync & Docker
-        uses: easingthemes/ssh-deploy@v5.0.0
+        uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
         env:
           SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
           REMOTE_HOST: ${{ env.SSH_HOST }}
@@ -75,10 +75,10 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
       - name: Deploy via Rsync & Docker
-        uses: easingthemes/ssh-deploy@v5.0.0
+        uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
         env:
           SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
           REMOTE_HOST: ${{ env.SSH_HOST }}
@@ -102,10 +102,10 @@ jobs:
     needs: [deploy_staging]
     if: github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
       - name: Deploy via Rsync & Docker
-        uses: easingthemes/ssh-deploy@v5.0.0
+        uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
         env:
           SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
           REMOTE_HOST: ${{ env.SSH_HOST }}
@@ -130,7 +130,7 @@ jobs:
     if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
     steps:
       - name: Remove Remote Environment
-        uses: appleboy/ssh-action@v1.0.3
+        uses: appleboy/ssh-action@823bd89e131d8d508129f9443cad5855e9ba96f0 # v1.2.4
         with:
           host: ${{ env.SSH_HOST }}
           username: ${{ env.SSH_USER }}

dev.env

@@ -4,4 +4,6 @@ ENV=dev
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=dev.kovagoadi.hu
-TRAEFIK_LEGACY_OPT=
+ACME_BYPASS=false
+TRAEFIK_LEGACY_OPT=
+# TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"

docker-compose.yaml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: "traefik:v3.6@sha256:aaf0f6185419a50c74651448c1a5bf4606bd2d2ddb7b8749eed505d55bf8b8ea"
+    image: "traefik:v3.6@sha256:67622638cd88dbfcfba40159bc652ecf0aea0e032f8a3c7e3134ae7c037b9910"
     restart: unless-stopped
     security_opt:
       - no-new-privileges:true
@@ -13,6 +13,7 @@ services:
       - "--providers.docker.constraints=Label(`env`, `${ENV}`)"
       - "--entryPoints.web.address=:80"
       - "--entryPoints.https.address=:443"
+      - "--entryPoints.web.allowACMEByPass=${ACME_BYPASS}"
       - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
       - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
       - "--certificatesresolvers.letsencrypt.acme.email=kovagoadi@gmail.com"
@@ -37,7 +38,9 @@ services:
     labels:
       - "env=${ENV}"
       - "traefik.enable=true"
+      - "traefik.http.routers.whoami.priority=100"
       - "traefik.http.routers.whoami.rule=Host(`test-whoami.${DOMAIN}`)"
+      - "traefik.http.routers.https.priority=100"
       - "traefik.http.routers.https.rule=Host(`test-whoami.${DOMAIN}`)"
       - "traefik.http.routers.whoami.entrypoints=web"
       - traefik.http.routers.https.entrypoints=https

prod.env

@@ -4,4 +4,5 @@ ENV=prod
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-v02.api.letsencrypt.org/directory
 DOMAIN=kovagoadi.hu
+ACME_BYPASS=true
 TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"

prod/forward-to-legacy-nginx.yaml

@@ -9,7 +9,7 @@ tcp:
       # Passthrough must be true for SSL to reach Nginx encrypted
       tls:
         passthrough: true
-      priority: 1
+      priority: 10
       entryPoints:
         - "https"
 
@@ -23,12 +23,20 @@ tcp:
 
 http:
   routers:
-    # Router for HTTP
+    # 1. TRAEFIK-MANAGED ACME HANDLER (Removed manual router)
+    traefik-acme-handler:
+      rule: "Host(`test-whoami.kovagoadi.hu`) && PathPrefix(`/.well-known/acme-challenge/`)"
+      entryPoints:
+        - "web"
+      service: "acme-http@internal" # This is the internal service name
+      priority: 1000                # High priority to ensure it wins
+
+    # 2. THE HTTP CATCH-ALL (Sends other ACME and HTTP to Nginx)
     nginx-legacy-router:
       rule: "HostRegexp(`^.+$`)"
       service: nginx-legacy-service
-      # Low priority ensures specific containers are handled first
+      # Low priority ensures specific containers are handled first, but before the default acme-handler
-      priority: 1
+      priority: 90
       entryPoints:
         - "web"
 

staging.env

@@ -4,4 +4,5 @@ ENV=staging
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=staging.kovagoadi.hu
+ACME_BYPASS=false
 TRAEFIK_LEGACY_OPT=