Update traefik:v3.7 Docker digest to 24841fe

Merge pull request 'Update traefik:v3.7 Docker digest to 1c32e7c' (#83 ) from renovate/traefik-v3.7 into main
Reviewed-on: #83
2026-09-22 02:34:50 +00:00 · 2026-09-18 23:27:02 +02:00 · 2026-09-18 02:31:18 +00:00 · 2026-09-09 22:28:29 +02:00 · 2026-09-05 02:30:39 +00:00 · 2026-08-31 18:18:58 +02:00
23 changed files with 842 additions and 171 deletions
@@ -8,202 +8,218 @@ on:
    types: [opened, synchronize, reopened, closed]
 env:
-  # Base path for PR preview environments
+  # --- PATH CONFIGURATION ---
  REMOTE_DEPLOY_PATH: /var/app/traefik/test
  # --- CUSTOMIZABLE PRODUCTION PATH ---
  # Set the absolute path for your production deployment on the remote server.
  REMOTE_PROD_PATH: /var/app/traefik/prod
  REMOTE_STAGING_PATH: /var/app/traefik/staging
  REMOTE_PREPROD_PATH: /var/app/traefik/preprod
  # --- SECRETS ---
  SSH_HOST: ${{ secrets.SSH_HOST }}
  SSH_USER: ${{ secrets.SSH_USER }}
  SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
  SSH_PORT: ${{ secrets.SSH_PORT || 22 }}
 jobs:
-  prepare_deployment_vars:
+  # ------------------------------------------------------------------
-    name: Prepare deployment vars
+  # STAGE 1: PREPARE CONTEXT
  # ------------------------------------------------------------------
  prepare_context:
    name: Prepare Context
    runs-on: ubuntu-latest
    outputs:
-      deploy_path: ${{ steps.set-vars.outputs.deploy_path }}
+      pr_path: ${{ steps.calc.outputs.pr_path }}
    steps:
-      - name: Set deployment variables
+      - id: calc
-        id: set-vars
+        name: Prepare Context
        run: |
          REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            # For PRs, create a unique directory under the base path
+            echo "pr_path=${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
            DEPLOY_PATH="${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}"
          else
            # For 'main' branch, use the specified production path.
            # Fallback to a default if REMOTE_PROD_PATH is empty.
            DEPLOY_PATH="${REMOTE_PROD_PATH:-${REMOTE_DEPLOY_PATH}/main}"
          fi
          echo "DEPLOY_PATH=${DEPLOY_PATH}" >> $GITHUB_ENV
          echo "deploy_path=${DEPLOY_PATH}" >> $GITHUB_OUTPUT
          echo "DEPLOY_PATH will be: ${DEPLOY_PATH}"
-  create_remote_directory:
+  # ------------------------------------------------------------------
-    name: Create remote directory
+  # STAGE 2: DEPLOY PREVIEW (DEV)
  # ------------------------------------------------------------------
  deploy_preview:
    name: Deploy (Dev/Preview)
    runs-on: ubuntu-latest
-    needs: prepare_deployment_vars
+    needs: [prepare_context]
-    if: |
+    if: github.event_name == 'pull_request' && github.event.action != 'closed'
      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
      || github.ref == 'refs/heads/main'
    steps:
-      - name: Setup SSH
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
        with:
          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
-      - name: Add host to known_hosts
+      - name: Deploy via Rsync & Docker
-        run: |
+        uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
-          mkdir -p ~/.ssh
+        env:
-          chmod 700 ~/.ssh
+          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
-          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
+          REMOTE_HOST: ${{ env.SSH_HOST }}
-            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
+          REMOTE_USER: ${{ env.SSH_USER }}
-            exit 1
+          REMOTE_PORT: ${{ env.SSH_PORT }}
-          }
+          TARGET: ${{ needs.prepare_context.outputs.pr_path }}
-          chmod 644 ~/.ssh/known_hosts
+          # Exclude git internals to save bandwidth
          EXCLUDE: ".git/, .github/"
          # 1. Create directory first
          SCRIPT_BEFORE: |
            mkdir -p ${{ needs.prepare_context.outputs.pr_path }}
          # 2. Run Docker Compose after sync
          SCRIPT_AFTER: |
            set -e
            cd ${{ needs.prepare_context.outputs.pr_path }}
            docker compose --env-file dev.env -f docker-compose.yaml -f docker-compose.dev.yaml up -d --build --remove-orphans --wait
-      - name: Create directory on remote
+  # ------------------------------------------------------------------
-        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "mkdir -p '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'"
+  # STAGE 3: DEPLOY STAGING
-
+  # ------------------------------------------------------------------
-  sync_repo_files:
+  deploy_staging:
-    name: Sync repository files
+    name: Deploy (Staging)
    runs-on: ubuntu-latest
-    needs: [create_remote_directory, prepare_deployment_vars]
+    if: github.ref == 'refs/heads/main'
    if: |
      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
      || github.ref == 'refs/heads/main'
    steps:
-      - name: Checkout repository
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
-      - name: Sync files via scp
+      - name: Deploy via Rsync & Docker
-        uses: appleboy/scp-action@master
+        uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
        env:
          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
          REMOTE_HOST: ${{ env.SSH_HOST }}
          REMOTE_USER: ${{ env.SSH_USER }}
          REMOTE_PORT: ${{ env.SSH_PORT }}
          TARGET: ${{ env.REMOTE_STAGING_PATH }}
          EXCLUDE: ".git/, .github/"
          SCRIPT_BEFORE: |
            mkdir -p ${{ env.REMOTE_STAGING_PATH }}
          SCRIPT_AFTER: |
            set -e
            cd ${{ env.REMOTE_STAGING_PATH }}
            docker compose --env-file staging.env -f docker-compose.yaml -f docker-compose.client.yaml up -d --build --remove-orphans --wait
  # ------------------------------------------------------------------
  # STAGE 3.5: DEPLOY PRE-PROD
  # ------------------------------------------------------------------
  deploy_preprod:
    name: Deploy (Pre-Prod)
    runs-on: ubuntu-latest
    needs: [deploy_staging]
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Deploy via Rsync & Docker
        uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
        env:
          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
          REMOTE_HOST: ${{ env.SSH_HOST }}
          REMOTE_USER: ${{ env.SSH_USER }}
          REMOTE_PORT: ${{ env.SSH_PORT }}
          TARGET: ${{ env.REMOTE_PREPROD_PATH }}
          EXCLUDE: ".git/, .github/"
          SCRIPT_BEFORE: |
            mkdir -p ${{ env.REMOTE_PREPROD_PATH }}
          SCRIPT_AFTER: |
            set -e
            cd ${{ env.REMOTE_PREPROD_PATH }}
            docker compose --env-file preprod.env -f docker-compose.yaml -f docker-compose.prod.yaml -f docker-compose.preprod.yaml up -d --build --remove-orphans --wait
      - name: Run E2E Tests
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ env.SSH_HOST }}
          username: ${{ env.SSH_USER }}
          key: ${{ env.SSH_PRIVATE_KEY }}
          port: ${{ env.SSH_PORT }}
-          source: "./"
+          script: |
-          target: "${{ needs.prepare_deployment_vars.outputs.deploy_path }}"
+            set -e
            cd ${{ env.REMOTE_PREPROD_PATH }}
            echo "Running E2E tests..."
            python3 -m venv .venv
            . .venv/bin/activate
            # Export env vars
            set -a
            . preprod.env
            set +a
            pip install -r tests/e2e/requirements.txt
            # Run tests
            if pytest tests/e2e/; then
              echo "Tests passed!"
              # Cleanup on success
              docker compose --env-file preprod.env -f docker-compose.yaml -f docker-compose.prod.yaml down --remove-orphans
            else
              echo "Tests failed!"
              # Optional: Cleanup on failure? Or keep for debugging?
              # User's previous script had it after, implying it runs if pytest succeeds (due to set -e).
              # I will fail the step.
              exit 1
            fi
-      - name: Sync file via scp (staging)
+  # ------------------------------------------------------------------
-        if: github.ref == 'refs/heads/main'
+  # STAGE 4: DEPLOY PRODUCTION
-        uses: appleboy/scp-action@master
+  # ------------------------------------------------------------------
  deploy_prod:
    name: Deploy (Production)
    runs-on: ubuntu-latest
    needs: [deploy_preprod]
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Deploy via Rsync & Docker
        uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
        env:
          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
          REMOTE_HOST: ${{ env.SSH_HOST }}
          REMOTE_USER: ${{ env.SSH_USER }}
          REMOTE_PORT: ${{ env.SSH_PORT }}
          TARGET: ${{ env.REMOTE_PROD_PATH }}
          EXCLUDE: ".git/, .github/"
          SCRIPT_BEFORE: |
            mkdir -p ${{ env.REMOTE_PROD_PATH }}
          SCRIPT_AFTER: |
            set -e
            cd ${{ env.REMOTE_PROD_PATH }}
            docker compose --env-file prod.env -f docker-compose.yaml -f docker-compose.prod.yaml up -d --build --remove-orphans --wait
            # Run E2E Tests
            echo "Running E2E tests..."
            export CI=true
            # Create venv to avoid polluting system python
            python3 -m venv .venv
            . .venv/bin/activate
            # Export env vars so pytest can see them
            set -a
            . prod.env
            set +a
            pip install -r tests/e2e/requirements.txt
            pytest tests/e2e/
  # ------------------------------------------------------------------
  # CLEANUP (Using appleboy/ssh-action for pure command execution)
  # ------------------------------------------------------------------
  cleanup:
    name: Cleanup Preview
    runs-on: ubuntu-latest
    needs: [prepare_context]
    if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
    steps:
      - name: Remove Remote Environment
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ env.SSH_HOST }}
          username: ${{ env.SSH_USER }}
          key: ${{ env.SSH_PRIVATE_KEY }}
          port: ${{ env.SSH_PORT }}
-          source: "./"
+          script: |
-          target: ${{ env.REMOTE_STAGING_PATH }}
+            TARGET="${{ needs.prepare_context.outputs.pr_path }}"
-
+            if [ -d "$TARGET" ]; then
-  run_docker_compose_dev:
+              cd "$TARGET"
-    name: Run docker-compose remotely (Dev)
+              docker compose down -v || true
-    runs-on: ubuntu-latest
+              cd ..
-    needs: [sync_repo_files, prepare_deployment_vars]
+              rm -rf "$TARGET"
-    if: |
+              echo "Cleanup successful"
-      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
+            else
-    steps:
+              echo "Directory not found, skipping."
-      - name: Setup SSH
+            fi
        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
        with:
          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
      - name: Add host to known_hosts
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
            exit 1
          }
          chmod 644 ~/.ssh/known_hosts
      - name: Run docker-compose on remote host
        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose --env-file dev.env -f docker-compose.yaml up -d --build"
  run_docker_compose_staging:
    name: Run docker-compose remotely (Staging)
    runs-on: ubuntu-latest
    needs: [sync_repo_files, prepare_deployment_vars]
    if: |
      (github.ref == 'refs/heads/main')
    steps:
      - name: Setup SSH
        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
        with:
          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
      - name: Add host to known_hosts
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
            exit 1
          }
          chmod 644 ~/.ssh/known_hosts
      - name: Run docker-compose on remote host
        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${REMOTE_STAGING_PATH}' && docker-compose --env-file staging.env -f docker-compose.yaml up -d --build"
  run_docker_compose_prod:
    name: Run docker-compose remotely (Prod)
    runs-on: ubuntu-latest
    needs: [sync_repo_files, prepare_deployment_vars]
    if: |
      (github.ref == 'refs/heads/main')
    steps:
      - name: Setup SSH
        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
        with:
          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
      - name: Add host to known_hosts
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
            exit 1
          }
          chmod 644 ~/.ssh/known_hosts
      - name: Run docker-compose on remote host
        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose --env-file prod.env -f docker-compose.yaml up -d --build"
  cleanup_mr_environment:
    name: Cleanup MR environment
    runs-on: ubuntu-latest
    needs: prepare_deployment_vars
    if: |
      github.event_name == 'pull_request' && 
      (github.event.action == 'closed' || github.event.pull_request.merged == true)
    steps:
      - name: Setup SSH
        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
        with:
          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
      - name: Add host to known_hosts
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
            exit 1
          }
          chmod 644 ~/.ssh/known_hosts
      - name: Run docker-compose down on remote host
        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose down"
      - name: Delete deployment directory
        run: |
          ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "if [ -d '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' ]; then rm -rf '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'; echo 'Directory removed.'; else echo 'Directory not found, skipping.'; fi"
@@ -1,3 +1,9 @@
 PORT=898
 HTTPS_PORT=446
 ENV=dev
-NETWORK_NAME=proxy
+NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=dev.kovagoadi.hu
 ACME_BYPASS=false
 TRAEFIK_LEGACY_OPT=
 # TRAEFIK_LEGACY_OPT="--providers.file.directory=/etc/traefik"
@@ -0,0 +1,9 @@
 services:
  traefik:
    networks:
      - proxy
      - shared_network
 networks:
  shared_network:
    name: prod_shared-network
    external: true
@@ -0,0 +1,16 @@
 services:
  traefik:
    networks:
      - proxy
      - staging-network
      - shared_network
 networks:
  legacy-nginx:
    name: proxy
    external: true
  staging-network:
    name: staging_proxy
    external: true
  shared_network:
    name: prod_shared-network
    external: true
@@ -0,0 +1,13 @@
 services:
  traefik:
    networks:
      - proxy
      - legacy-nginx
      - shared-network
 networks:
  legacy-nginx:
    name: proxy
    external: true
  shared-network:
    name: prod_shared-network
    external: true
@@ -0,0 +1,12 @@
 services:
  traefik:
    networks:
      - proxy
      - legacy-nginx
      - shared-network
 networks:
  legacy-nginx:
    name: proxy
    external: true
  shared-network:
    external: false
@@ -1,7 +1,6 @@
 services:
  traefik:
-    image: "traefik:v3.4"
+    image: "traefik:v3.7@sha256:24841fe2de7304c149343d877d2923b4c8800a38ba015dea9174c23b20e344a0"
    # container_name: "traefik"
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
@@ -13,21 +12,46 @@ services:
      - "--providers.docker.network=proxy"
      - "--providers.docker.constraints=Label(`env`, `${ENV}`)"
      - "--entryPoints.web.address=:80"
      - "--entryPoints.https.address=:443"
      - "--entryPoints.web.allowACMEByPass=${ACME_BYPASS}"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=kovagoadi@gmail.com"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--certificatesResolvers.letsencrypt.acme.caServer=${CERTBOT_CA_RESOLVER}"
      - "${TRAEFIK_LEGACY_OPT:-}"
      - "--providers.file.watch=true"
      - "--accesslog"
      - "--log.level=INFO"
    # extra_hosts:
    #   - "staging:${STAGING_IP:-192.168.1.85}"
    #   - "webserver:${LEGACY_IP:-192.168.1.85}"
    ports:
      - "${PORT}:80"
      - "${HTTPS_PORT}:443"
      - "8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "letsencrypt:/letsencrypt"
      - "./${ENV}:/etc/traefik"
  whoami:
-    image: "traefik/whoami"
+    image: "traefik/whoami@sha256:c4717a8d1f0134a7444e24f881160e033991f23027c6c5a9a3f8fd22e70d1d44"
    restart: unless-stopped
    networks:
      - proxy
    labels:
      - "env=${ENV}"
      - "traefik.enable=true"
-      - "traefik.http.routers.whoami.rule=Host(`whoami.docker.localhost`)"
+      - "traefik.http.routers.whoami.priority=100"
      - "traefik.http.routers.whoami.rule=Host(`test-whoami.${DOMAIN}`)"
      - "traefik.http.routers.https.priority=100"
      - "traefik.http.routers.https.rule=Host(`test-whoami.${DOMAIN}`)"
      - "traefik.http.routers.whoami.entrypoints=web"
      - traefik.http.routers.https.entrypoints=https
      - traefik.http.routers.https.tls=true
      - traefik.http.routers.https.tls.certresolver=letsencrypt
 networks:
  proxy:
 volumes:
  letsencrypt:
@@ -0,0 +1,9 @@
 PORT=8081
 HTTPS_PORT=447
 ENV=preprod
 NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=preprod.kovagoadi.hu
 ACME_BYPASS=false
 TRAEFIK_LEGACY_OPT="--providers.file.directory=/etc/traefik"
 CI=true
@@ -0,0 +1,53 @@
 # ./traefik/forward-to-legacy-nginx.yaml
 tcp:
  routers:
    # Router for HTTPS (Passthrough)
    nginx-legacy-router-secure:
      rule: "HostSNI(`*`)"
      service: nginx-legacy-service-secure
      # Passthrough must be true for SSL to reach Nginx encrypted
      tls:
        passthrough: true
      priority: 10
      entryPoints:
        - "https"
  serversTransports:
    nginx-legacy-transport-secure:
      proxyProtocol:
        version: 2
  services:
    # Service defining the external IP
    nginx-legacy-service-secure:
      loadBalancer:
        serversTransport: nginx-legacy-transport-secure
        servers:
          # This is the actual external IP and Port of your Nginx
          - address: "webserver:443"
 http:
  routers:
    # 1. TRAEFIK-MANAGED ACME HANDLER (Removed manual router)
    traefik-acme-handler:
      rule: "Host(`test-whoami.kovagoadi.hu`) && PathPrefix(`/.well-known/acme-challenge/`)"
      entryPoints:
        - "web"
      service: "acme-http@internal" # This is the internal service name
      priority: 1000                # High priority to ensure it wins
    # 2. THE HTTP CATCH-ALL (Sends other ACME and HTTP to Nginx)
    nginx-legacy-router:
      rule: "HostRegexp(`^.+$`)"
      service: nginx-legacy-service
      # Low priority ensures specific containers are handled first, but before the default acme-handler
      priority: 90
      entryPoints:
        - "web"
  services:
    nginx-legacy-service:
      loadBalancer:
        servers:
          - url: "http://webserver:80"
@@ -0,0 +1,33 @@
 http:
  routers:
    # Router for HTTP (Port 80)
    staging:
      rule: "HostRegexp(`^.+\\.staging\\.kovagoadi\\.hu$`) || HostRegexp(`^.+\\.dev\\.kovagoadi\\.hu$`)"
      entryPoints:
        - "web"
      service: "dev-staging"
      priority: 1000
  services:
    dev-staging:
      loadBalancer:
        servers:
          - url: "http://staging-traefik-1:80"
 tcp:
  routers:
    # Router for HTTPS (Passthrough)
    dev-staging-secure:
      rule: "HostSNIRegexp(`^.+\\.staging\\.kovagoadi\\.hu$`) || HostSNIRegexp(`^.+\\.dev\\.kovagoadi\\.hu$`)"
      service: "dev-staging-secure"
      # Passthrough must be true for SSL to reach Nginx encrypted
      tls:
        passthrough: true
      priority: 1000
      entryPoints:
        - "https"
  services:  
    dev-staging-secure:
      loadBalancer:
        servers:
          # Note: Ensure Traefik trusts the cert at .85 or set insecureSkipVerify
          - address: "staging-traefik-1:443"
@@ -1,3 +1,8 @@
-PORT=81
+PORT=80
 HTTPS_PORT=443
 ENV=prod
-NETWORK_NAME=proxy
+NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-v02.api.letsencrypt.org/directory
 DOMAIN=kovagoadi.hu
 ACME_BYPASS=true
 TRAEFIK_LEGACY_OPT="--providers.file.directory=/etc/traefik"
@@ -0,0 +1,53 @@
 # ./traefik/forward-to-legacy-nginx.yaml
 tcp:
  routers:
    # Router for HTTPS (Passthrough)
    nginx-legacy-router-secure:
      rule: "HostSNI(`*`)"
      service: nginx-legacy-service-secure
      # Passthrough must be true for SSL to reach Nginx encrypted
      tls:
        passthrough: true
      priority: 10
      entryPoints:
        - "https"
  serversTransports:
    nginx-legacy-transport-secure:
      proxyProtocol:
        version: 2
  services:
    # Service defining the external IP
    nginx-legacy-service-secure:
      loadBalancer:
        serversTransport: nginx-legacy-transport-secure
        servers:
          # This is the actual external IP and Port of your Nginx
          - address: "webserver:443"
 http:
  routers:
    # 1. TRAEFIK-MANAGED ACME HANDLER (Removed manual router)
    traefik-acme-handler:
      rule: "Host(`test-whoami.kovagoadi.hu`) && PathPrefix(`/.well-known/acme-challenge/`)"
      entryPoints:
        - "web"
      service: "acme-http@internal" # This is the internal service name
      priority: 1000                # High priority to ensure it wins
    # 2. THE HTTP CATCH-ALL (Sends other ACME and HTTP to Nginx)
    nginx-legacy-router:
      rule: "HostRegexp(`^.+$`)"
      service: nginx-legacy-service
      # Low priority ensures specific containers are handled first, but before the default acme-handler
      priority: 90
      entryPoints:
        - "web"
  services:
    nginx-legacy-service:
      loadBalancer:
        servers:
          - url: "http://webserver:80"
@@ -0,0 +1,29 @@
 http:
  routers:
    kovagoadi-gepe-http-router:
      rule: "HostRegexp(`^.+\\.kovagoadi-gepe\\.kovagoadi\\.hu$`)"
      entryPoints:
        - "web"
      service: "kovagoadi-gepe-http"
      priority: 100
  services:
    kovagoadi-gepe-http:
      loadBalancer:
        servers:
          - url: "http://192.168.1.81:80"
 tcp:
  routers:
    kovagoadi-gepe-secure-router:
      rule: "HostSNI(`*.kovagoadi-gepe.kovagoadi.hu`)"
      service: "kovagoadi-gepe-secure"
      tls:
        passthrough: true
      priority: 100
      entryPoints:
        - "https"
  services:  
    kovagoadi-gepe-secure:
      loadBalancer:
        servers:
          - address: "192.168.1.81:443"
@@ -0,0 +1,33 @@
 http:
  routers:
    # Router for HTTP (Port 80)
    staging:
      rule: "HostRegexp(`^.+\\.staging\\.kovagoadi\\.hu$`) || HostRegexp(`^.+\\.dev\\.kovagoadi\\.hu$`)"
      entryPoints:
        - "web"
      service: "dev-staging"
      priority: 1000
  services:
    dev-staging:
      loadBalancer:
        servers:
          - url: "http://staging-traefik-1:80"
 tcp:
  routers:
    # Router for HTTPS (Passthrough)
    dev-staging-secure:
      rule: "HostSNIRegexp(`^.+\\.staging\\.kovagoadi\\.hu$`) || HostSNIRegexp(`^.+\\.dev\\.kovagoadi\\.hu$`)"
      service: "dev-staging-secure"
      # Passthrough must be true for SSL to reach Nginx encrypted
      tls:
        passthrough: true
      priority: 1000
      entryPoints:
        - "https"
  services:  
    dev-staging-secure:
      loadBalancer:
        servers:
          # Note: Ensure Traefik trusts the cert at .85 or set insecureSkipVerify
          - address: "staging-traefik-1:443"
@@ -1,3 +1,8 @@
 PORT=8080
 HTTPS_PORT=445
 ENV=staging
-NETWORK_NAME=proxy
+NETWORK_NAME=proxy
 CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
 DOMAIN=staging.kovagoadi.hu
 ACME_BYPASS=false
 TRAEFIK_LEGACY_OPT=
@@ -0,0 +1 @@
 __pycache__
@@ -0,0 +1,2 @@
 pytest
 requests
@@ -0,0 +1,221 @@
 import pytest
 import requests
 import os
 # Configuration
 DOMAIN = os.getenv("DOMAIN", "asdasd.kovagoadi.hu")
 PORT = os.getenv("PORT", "10000")
 HTTPS_PORT = os.getenv("HTTPS_PORT", "10001")
 BASE_URL = f"http://192.168.1.85:{PORT}"
 HTTPS_BASE_URL = f"https://192.168.1.85:{HTTPS_PORT}"
 HOST_HEADER = f"test-whoami.{DOMAIN}"
 # @pytest.fixture(scope="session", autouse=True)
 # def mock_webserver():
 #     """Start ephemeral mock webserver containers and configure Traefik."""
 #     import time
 #     
 #     # Skip ephemeral mocks in CI environment; test against real services
 #     if os.getenv("CI"):
 #         print("CI environment detected. Skipping ephemeral mock setup; testing against real services.")
 #         yield
 #         return
 # 
 #     # In CI (Docker-in-Docker), we need to use the HOST path for volumes, not the container path.
 #     # The workflow mounts the project root to /app, but the Docker daemon is on the host.
 #     # We pass PROJECT_ROOT env var to the test container to tell it where the files are on the HOST.
 #     cwd = os.getenv("PROJECT_ROOT", os.getcwd())
 #     certs_dir = os.path.join(cwd, "tests/mock_nginx/certs")
 #     image = "nginx:alpine"
 #     
 #     # Define mocks
 #     mocks = [
 #         {
 #             "name": "mock-legacy-ephemeral",
 #             "alias": "webserver",
 #             "conf": os.path.join(cwd, "tests/mock_nginx/legacy.conf"),
 #             "ports": ["80", "443"]
 #         },
 #         {
 #             "name": "mock-staging-ephemeral",
 #             "alias": "mock",
 #             "conf": os.path.join(cwd, "tests/mock_nginx/staging.conf"),
 #             "ports": ["8080", "445"]
 #         }
 #     ]
 #     
 #     # Cleanup and Start Mocks
 #     mock_ips = {}
 #     for mock in mocks:
 #         subprocess.run(["docker", "rm", "-f", mock["name"]], capture_output=True)
 #         cmd = [
 #             "docker", "run", "-d", "--rm",
 #             "--name", mock["name"],
 #             "--network", "proxy",
 #             "--network-alias", mock["alias"],
 #             "-v", f"{mock['conf']}:/etc/nginx/nginx.conf:ro",
 #             "-v", f"{certs_dir}:/etc/nginx/certs:ro",
 #             image
 #         ]
 #         
 #         print(f"Starting {mock['name']}...")
 #         result = subprocess.run(cmd, capture_output=True, text=True)
 #         if result.returncode != 0:
 #             print(f"STDOUT: {result.stdout}")
 #             print(f"STDERR: {result.stderr}")
 #             pytest.fail(f"Failed to start {mock['name']}: {result.stderr}")
 #             
 #         # Inspect container to get IP
 #         inspect_cmd = ["docker", "inspect", "-f", "{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}", mock["name"]]
 #         inspect_res = subprocess.run(inspect_cmd, capture_output=True, text=True)
 #         if inspect_res.returncode != 0:
 #              pytest.fail(f"Failed to inspect {mock['name']}: {inspect_res.stderr}")
 #         mock_ips[mock["alias"]] = inspect_res.stdout.strip()
 #         print(f"{mock['name']} IP: {mock_ips[mock['alias']]}")
 # 
 #     # Restart Traefik with IP env vars for extra_hosts
 #     print(f"Restarting Traefik with STAGING_IP={mock_ips['mock']} and LEGACY_IP={mock_ips['webserver']}...")
 #     env = os.environ.copy()
 #     env["STAGING_IP"] = mock_ips["mock"]
 #     env["LEGACY_IP"] = mock_ips["webserver"]
 #     
 #     # In CI (Docker-in-Docker), we need to tell docker-compose that the project root 
 #     # is the HOST path (PROJECT_ROOT), not the container path (/app).
 #     # This ensures volume mounts use the correct host paths.
 #     if "PROJECT_ROOT" in os.environ:
 #         env["COMPOSE_PROJECT_DIR"] = os.environ["PROJECT_ROOT"]
 # 
 #     # We need to recreate the container to pick up extra_hosts changes
 #     try:
 #         subprocess.run(["docker-compose", "--env-file", "preprod.env", "up", "-d", "--force-recreate", "--no-deps", "traefik"], env=env, check=True, capture_output=True, text=True)
 #     except subprocess.CalledProcessError as e:
 #         print(f"Docker Compose STDOUT: {e.stdout}")
 #         print(f"Docker Compose STDERR: {e.stderr}")
 #         raise e
 #     
 #     # Wait for everything to settle
 #     time.sleep(5)
 #     
 #     yield
 #     
 #     print("Stopping mocks and restoring Traefik...")
 #     for mock in mocks:
 #         subprocess.run(["docker", "stop", mock["name"]], capture_output=True)
 #     
 #     # Restore Traefik to default (optional)
 #     subprocess.run(["docker-compose", "--env-file", "preprod.env", "up", "-d", "--force-recreate", "--no-deps", "traefik"], check=True)
 def test_whoami_http_reachable():
    """Verify that the whoami service is reachable via HTTP."""
    try:
        response = requests.get(BASE_URL, headers={"Host": HOST_HEADER}, timeout=5)
        assert response.status_code == 200
        assert "Hostname:" in response.text
    except requests.exceptions.RequestException as e:
        pytest.fail(f"Failed to connect to {BASE_URL}: {e}")
 import subprocess
 def test_whoami_https_reachable():
    """Verify that the whoami service is reachable via HTTPS using curl (to handle SNI/DNS)."""
    # We use curl because requests doesn't support --resolve easily to force SNI with custom IP
    cmd = [
        "curl", "-s", "-k", "--fail",
        "--resolve", f"{HOST_HEADER}:{HTTPS_PORT}:192.168.1.85",
        f"https://{HOST_HEADER}:{HTTPS_PORT}"
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10, check=True)
        assert result.returncode == 0
    except subprocess.CalledProcessError as e:
        pytest.fail(f"Curl failed with exit code {e.returncode}: {e.stderr}")
    except subprocess.TimeoutExpired:
        pytest.fail("Curl timed out")
 def test_https_redirect():
    """Verify that HTTP requests are NOT redirected to HTTPS (based on config, or check if they SHOULD be)."""
    # Based on docker-compose, there is no global redirect middleware configured on the entrypoint.
    # So HTTP should remain HTTP.
    try:
        response = requests.get(BASE_URL, headers={"Host": HOST_HEADER}, allow_redirects=False, timeout=5)
        assert response.status_code == 200
    except requests.exceptions.RequestException as e:
        pytest.fail(f"Failed to connect to {BASE_URL}: {e}")
 def test_unknown_host_404():
    """Verify that requests to an unknown host (hitting legacy-nginx catch-all) are routed to the mock."""
    try:
        # We use a domain that doesn't match the specific *.dev.kovagoadi.hu rules
        # so it falls through to the catch-all 'nginx-legacy-router'
        response = requests.get(BASE_URL + "/login", headers={"Host": "tar.kovagoadi.hu"}, timeout=5)
        assert response.status_code == 200
    except requests.exceptions.RequestException as e:
        pytest.fail(f"Failed to connect to {BASE_URL}: {e}")
 def test_unknown_host_https_passthrough():
    """Verify that HTTPS requests to an unknown host are passed through to the mock Nginx."""
    # We use curl to handle SNI and self-signed certs
    # unknown.com should hit the catch-all SNI router
    cmd = [
        "curl", "-s", "-k", "-i", "--fail",
        "--resolve", f"tar.kovagoadi.hu:{HTTPS_PORT}:192.168.1.85",
        f"https://tar.kovagoadi.hu:{HTTPS_PORT}/login"
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10, check=True)
        assert result.returncode == 0
    except subprocess.CalledProcessError as e:
        pytest.fail(f"Curl failed with exit code {e.returncode}: {e.stderr}")
    except subprocess.TimeoutExpired:
        pytest.fail("Curl timed out")
 def test_staging_http_routing():
    """Verify HTTP requests to *.staging.kovagoadi.hu are routed to the mock."""
    host = "test-whoami.staging.kovagoadi.hu"
    try:
        response = requests.get(BASE_URL, headers={"Host": host}, timeout=5)
        assert response.status_code == 200
    except requests.exceptions.RequestException as e:
        pytest.fail(f"Failed to connect to {BASE_URL} with host {host}: {e}")
 # def test_dev_http_routing():
 #     """Verify HTTP requests to *.dev.kovagoadi.hu are routed to the mock."""
 #     host = "test-whoami.dev.kovagoadi.hu"
 #     try:
 #         response = requests.get(BASE_URL, headers={"Host": host}, timeout=5)
 #         assert response.status_code == 200
 #     except requests.exceptions.RequestException as e:
 #         pytest.fail(f"Failed to connect to {BASE_URL} with host {host}: {e}")
 def test_staging_https_routing():
    """Verify HTTPS requests to *.staging.kovagoadi.hu are routed to the mock."""
    host = "test-whoami.staging.kovagoadi.hu"
    cmd = [
        "curl", "-s", "-k", "-i", "--fail",
        "--resolve", f"{host}:{HTTPS_PORT}:192.168.1.85",
        f"https://{host}:{HTTPS_PORT}"
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10, check=True)
        assert result.returncode == 0
    except subprocess.CalledProcessError as e:
        pytest.fail(f"Curl failed with exit code {e.returncode}: {e.stderr}")
    except subprocess.TimeoutExpired:
        pytest.fail("Curl timed out")
 # def test_dev_https_routing():
 #     """Verify HTTPS requests to *.dev.kovagoadi.hu are routed to the mock."""
 #     host = "test-whoami.dev.kovagoadi.hu"
 #     cmd = [
 #         "curl", "-s", "-k", "-i", "--fail",
 #         "--resolve", f"{host}:{HTTPS_PORT}:192.168.1.85",
 #         f"https://{host}:{HTTPS_PORT}"
 #     ]
 #     try:
 #         result = subprocess.run(cmd, capture_output=True, text=True, timeout=10, check=True)
 #         assert result.returncode == 0
 #     except subprocess.CalledProcessError as e:
 #         pytest.fail(f"Curl failed with exit code {e.returncode}: {e.stderr}")
 #     except subprocess.TimeoutExpired:
 #         pytest.fail("Curl timed out")
@@ -0,0 +1,19 @@
 -----BEGIN CERTIFICATE-----
 MIIDCzCCAfOgAwIBAgIUU5vuywVWaoDfFyee7NCy0BqXU3kwDQYJKoZIhvcNAQEL
 BQAwFTETMBEGA1UEAwwKbW9jay1uZ2lueDAeFw0yNTEyMjUxNjAwMTNaFw0yNjEy
 MjUxNjAwMTNaMBUxEzARBgNVBAMMCm1vY2stbmdpbngwggEiMA0GCSqGSIb3DQEB
 AQUAA4IBDwAwggEKAoIBAQCaoLrs78+HbDFB/HsXTy5nqtP7V33Js0GDWxk6QkOq
 qbCtd5e2fzjkFFWkFIuouLEL1+4xW5txToaCtIYhQUgwST/Wu4wLlzrueRmprTh2
 oTLbpSVXn6kO7dvDinsfelcjnLNgjRkkKPRYVvnCsrr2O9gFhClWf+WKMuNP99/O
 4Y7Na4l6fyQAMjDSgdFjVvB+D9YMbkfNmo5hs009lF0Y6u35hIaY1NyfI+csvwWZ
 j75I/1TGKQGwrmtG2U31xM8Y8mj7mye0IeXoIg8rl/efYVKRcEBahu0140t6A69g
 N7kCSsGhl78VJEUVz5OuOSdV9UDwzawiHh/M+1KE3/3VAgMBAAGjUzBRMB0GA1Ud
 DgQWBBQOgMuir6oD712l2GKpUoPo0RUcyDAfBgNVHSMEGDAWgBQOgMuir6oD712l
 2GKpUoPo0RUcyDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAv
 52u9mAOTKStdNZA4R68icJRXmOuxkTh9/rMdOYFF+GM2bMiX1DsvY9/VAFuy7EdZ
 yfvu72JyaBDMljryz6doupXm9Do9um2sTU0YKkarV2EECYqt5uC56KWs9XZ9mnYW
 wnTrLTbGZhRbGz4pq+Pq7Z1VUexV/Tnoxs5RlOaDxrlaS9htLfIR3dv2bhQiMGN9
 1LESNZ16c3s4026pxeojCKFVf2GS+IBdbzljdUzBMVzwGl10UZQHfMDJptuW6JKo
 rO5XVp5cLpLzSgUSGtGIoT2dR2Nk5kxGw4VbRCKKD7CDdS+JFypSwdg3v2oNfAmV
 op1lOPZtztQRw/6zo4Ex
 -----END CERTIFICATE-----
@@ -0,0 +1,28 @@
 -----BEGIN PRIVATE KEY-----
 MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCaoLrs78+HbDFB
 /HsXTy5nqtP7V33Js0GDWxk6QkOqqbCtd5e2fzjkFFWkFIuouLEL1+4xW5txToaC
 tIYhQUgwST/Wu4wLlzrueRmprTh2oTLbpSVXn6kO7dvDinsfelcjnLNgjRkkKPRY
 VvnCsrr2O9gFhClWf+WKMuNP99/O4Y7Na4l6fyQAMjDSgdFjVvB+D9YMbkfNmo5h
 s009lF0Y6u35hIaY1NyfI+csvwWZj75I/1TGKQGwrmtG2U31xM8Y8mj7mye0IeXo
 Ig8rl/efYVKRcEBahu0140t6A69gN7kCSsGhl78VJEUVz5OuOSdV9UDwzawiHh/M
 +1KE3/3VAgMBAAECggEANx57c5Fqj1IMXwLC2ATEPHUDGpHOB5PMEyhqnj9XwqK5
 laRPYuEH5Rmwi4w9Wnf3uIqQ4GxQxTuiLD5wn7MXKgs6Y++31LvkaHSnprnWKkd9
 Cxnb7Ve/GlDEqXgYOpjQLiQiNxUk9KRasZDTeElg5vxfHVxGpgxyROit6egokiR8
 JNglP+zrHicuvzl4f2DGQmjF5C4HQgyFIVrBv+vNKlqKmg2HatKIqBE60u7uw6CI
 /Q8ecqU9oVZscOF9T6hUJX0xijGSsE5UTR87U2zo0+fQRJ5qZ5pLjIuF5YiCi0eT
 qZex+h1TuTHNFoc1gcAyj5eDZQwwzZiR/Lae/pDyYwKBgQDVPy/elkUkoDm/OlbE
 g+wZpBAGGw2ACCK5SpgwRVmHEZUvBbNZgLfE0BydaK88eDTDbLpvfVNvMoNrZQTh
 bAqt9XsFBzmfMusiDYbK3ebhooObEcc6I1GmU5fqHuDv3h0CaEli2JjPmB44mXr8
 EGtl98nijNgAmbaA3p7IlWGeGwKBgQC5oPJOjSw6ZRywZwB220tIm0vMcp60sTmq
 H+ESaNMkpB38T9OBTdprBjAUzDCZC4jKFwU03ZQtGIN9S6BhogqyP8BRI/+lGJRQ
 ZLT1eVSHuC8bX1kVfb5tlahRQ2VUSj5cZxyOiZ8JXa1r1bf8/FZ/0tzLB4a7Ge5Z
 2lyQXa3SzwKBgCGCDkmRn0fEDY7o4d17RUw6JXJwKczmel5XRFbBbvH0Z1a+NJJp
 0XaRpQ1u96ou0Uur+Bewv72HWHM1qnCpg3wWSMBfhERpwdzV90pFWBQ4bymcv4t5
 JUlXdVWKiJnocvJ/5JgtpMVqB8WpCFQ3WEjriMOakg52GOFjGdw27OHlAoGBAKmk
 eezpvXK8dySLbXQx4zI+ol38nie6E13zdmixnczNo42zkjKIaMUISaaoGP20+dTe
 huaSXVl9HqXCGJdBVI8kDejZgkdqGBkEgBAaSvMhkwNr9ujaGs7hR4rEkfUfSLB/
 lyx4fvw7PULgdR3hqld06E0v2qRhBV/eXFufET0nAoGAaXKncm7o2LnMIcJV3qrk
 c0darLx+VWg0ILnE3/6kGSgGGnMm93tEwSX8h7Nq7QRNkVLUalVAcjm7jR9XGNsY
 W8oXqsyqmntNSA2f9w4MqYO2/i/xtN830qW2nw/RLLV5avD6EkY2KrlFbrrZQr2y
 q8oFyEAxJc8Kmo5ocnrPq1s=
 -----END PRIVATE KEY-----
@@ -0,0 +1,32 @@
 events {}
 http {
    server {
        listen 80;
        server_name _;
        real_ip_header X-Forwarded-For;
        set_real_ip_from 0.0.0.0/0;
        location / {
            add_header X-Mock-Service "legacy";
            return 200 "Mock Nginx Legacy HTTP\n";
        }
    }
    server {
        listen 443 ssl proxy_protocol;
        server_name _;
        real_ip_header proxy_protocol;
        set_real_ip_from 0.0.0.0/0;
        ssl_certificate /etc/nginx/certs/server.crt;
        ssl_certificate_key /etc/nginx/certs/server.key;
        location / {
            add_header X-Mock-Service "legacy";
            return 200 "Mock Nginx Legacy HTTPS\n";
        }
    }
 }
@@ -0,0 +1,26 @@
 events {}
 http {
    server {
        listen 80;
        server_name _;
        location / {
            add_header X-Mock-Service "true";
            return 200 "Mock Nginx HTTP\n";
        }
    }
    server {
        listen 443 ssl;
        server_name _;
        ssl_certificate /etc/nginx/certs/server.crt;
        ssl_certificate_key /etc/nginx/certs/server.key;
        location / {
            add_header X-Mock-Service "true";
            return 200 "Mock Nginx HTTPS\n";
        }
    }
 }
@@ -0,0 +1,26 @@
 events {}
 http {
    server {
        listen 8080;
        server_name _;
        location / {
            add_header X-Mock-Service "staging";
            return 200 "Mock Nginx Staging HTTP\n";
        }
    }
    server {
        listen 445 ssl;
        server_name _;
        ssl_certificate /etc/nginx/certs/server.crt;
        ssl_certificate_key /etc/nginx/certs/server.key;
        location / {
            add_header X-Mock-Service "staging";
            return 200 "Mock Nginx Staging HTTPS\n";
        }
    }
 }