Update traefik Docker tag to v3.6

.gitea/workflows/workflow.yaml

@@ -8,151 +8,202 @@ on:
     types: [opened, synchronize, reopened, closed]
 
 env:
-  # --- PATH CONFIGURATION ---
+  # Base path for PR preview environments
   REMOTE_DEPLOY_PATH: /var/app/traefik/test
+
+  # --- CUSTOMIZABLE PRODUCTION PATH ---
+  # Set the absolute path for your production deployment on the remote server.
   REMOTE_PROD_PATH: /var/app/traefik/prod
+
   REMOTE_STAGING_PATH: /var/app/traefik/staging
 
-  # --- SECRETS ---
   SSH_HOST: ${{ secrets.SSH_HOST }}
   SSH_USER: ${{ secrets.SSH_USER }}
   SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
   SSH_PORT: ${{ secrets.SSH_PORT || 22 }}
 
 jobs:
-  # ------------------------------------------------------------------
+  prepare_deployment_vars:
-  # STAGE 1: PREPARE CONTEXT
+    name: Prepare deployment vars
-  # ------------------------------------------------------------------
-  prepare_context:
-    name: Prepare Context
     runs-on: ubuntu-latest
     outputs:
-      pr_path: ${{ steps.calc.outputs.pr_path }}
+      deploy_path: ${{ steps.set-vars.outputs.deploy_path }}
     steps:
-      - id: calc
+      - name: Set deployment variables
-        name: Prepare Context
+        id: set-vars
         run: |
           REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            echo "pr_path=${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
+            # For PRs, create a unique directory under the base path
+            DEPLOY_PATH="${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}"
+          else
+            # For 'main' branch, use the specified production path.
+            # Fallback to a default if REMOTE_PROD_PATH is empty.
+            DEPLOY_PATH="${REMOTE_PROD_PATH:-${REMOTE_DEPLOY_PATH}/main}"
           fi
+          echo "DEPLOY_PATH=${DEPLOY_PATH}" >> $GITHUB_ENV
+          echo "deploy_path=${DEPLOY_PATH}" >> $GITHUB_OUTPUT
+          echo "DEPLOY_PATH will be: ${DEPLOY_PATH}"
 
-  # ------------------------------------------------------------------
+  create_remote_directory:
-  # STAGE 2: DEPLOY PREVIEW (DEV)
+    name: Create remote directory
-  # ------------------------------------------------------------------
-  deploy_preview:
-    name: Deploy (Dev/Preview)
     runs-on: ubuntu-latest
-    needs: [prepare_context]
+    needs: prepare_deployment_vars
-    if: github.event_name == 'pull_request' && github.event.action != 'closed'
+    if: |
+      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
+      || github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
-      - name: Deploy via Rsync & Docker
+      - name: Add host to known_hosts
-        uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
+        run: |
-        env:
+          mkdir -p ~/.ssh
-          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
+          chmod 700 ~/.ssh
-          REMOTE_HOST: ${{ env.SSH_HOST }}
+          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
-          REMOTE_USER: ${{ env.SSH_USER }}
+            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
-          REMOTE_PORT: ${{ env.SSH_PORT }}
+            exit 1
-          TARGET: ${{ needs.prepare_context.outputs.pr_path }}
+          }
-          # Exclude git internals to save bandwidth
+          chmod 644 ~/.ssh/known_hosts
-          EXCLUDE: ".git/, .github/"
-          # 1. Create directory first
-          SCRIPT_BEFORE: |
-            mkdir -p ${{ needs.prepare_context.outputs.pr_path }}
-          # 2. Run Docker Compose after sync
-          SCRIPT_AFTER: |
-            set -e
-            cd ${{ needs.prepare_context.outputs.pr_path }}
-            docker compose --env-file dev.env -f docker-compose.yaml up -d --build --remove-orphans --wait
 
-  # ------------------------------------------------------------------
+      - name: Create directory on remote
-  # STAGE 3: DEPLOY STAGING
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "mkdir -p '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'"
-  # ------------------------------------------------------------------
+
-  deploy_staging:
+  sync_repo_files:
-    name: Deploy (Staging)
+    name: Sync repository files
     runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main'
+    needs: [create_remote_directory, prepare_deployment_vars]
+    if: |
+      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
+      || github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
-      - name: Deploy via Rsync & Docker
+      - name: Sync files via scp
-        uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
+        uses: appleboy/scp-action@master
-        env:
-          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
-          REMOTE_HOST: ${{ env.SSH_HOST }}
-          REMOTE_USER: ${{ env.SSH_USER }}
-          REMOTE_PORT: ${{ env.SSH_PORT }}
-          TARGET: ${{ env.REMOTE_STAGING_PATH }}
-          EXCLUDE: ".git/, .github/"
-          SCRIPT_BEFORE: |
-            mkdir -p ${{ env.REMOTE_STAGING_PATH }}
-          SCRIPT_AFTER: |
-            set -e
-            cd ${{ env.REMOTE_STAGING_PATH }}
-            docker compose --env-file staging.env -f docker-compose.yaml up -d --build --remove-orphans --wait
-
-  # ------------------------------------------------------------------
-  # STAGE 4: DEPLOY PRODUCTION
-  # ------------------------------------------------------------------
-  deploy_prod:
-    name: Deploy (Production)
-    runs-on: ubuntu-latest
-    needs: [deploy_staging]
-    if: github.ref == 'refs/heads/main'
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-
-      - name: Deploy via Rsync & Docker
-        uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
-        env:
-          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
-          REMOTE_HOST: ${{ env.SSH_HOST }}
-          REMOTE_USER: ${{ env.SSH_USER }}
-          REMOTE_PORT: ${{ env.SSH_PORT }}
-          TARGET: ${{ env.REMOTE_PROD_PATH }}
-          EXCLUDE: ".git/, .github/"
-          SCRIPT_BEFORE: |
-            mkdir -p ${{ env.REMOTE_PROD_PATH }}
-          SCRIPT_AFTER: |
-            set -e
-            cd ${{ env.REMOTE_PROD_PATH }}
-            docker compose --env-file prod.env -f docker-compose.yaml -f docker-compose.prod.yaml up -d --build --remove-orphans --wait
-
-            # Run E2E Tests
-            echo "Running E2E tests..."
-            export CI=true
-            # Create venv to avoid polluting system python
-            python3 -m venv .venv
-            . .venv/bin/activate
-            pip install -r tests/e2e/requirements.txt
-            pytest tests/e2e/
-
-  # ------------------------------------------------------------------
-  # CLEANUP (Using appleboy/ssh-action for pure command execution)
-  # ------------------------------------------------------------------
-  cleanup:
-    name: Cleanup Preview
-    runs-on: ubuntu-latest
-    needs: [prepare_context]
-    if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
-    steps:
-      - name: Remove Remote Environment
-        uses: appleboy/ssh-action@823bd89e131d8d508129f9443cad5855e9ba96f0 # v1.2.4
         with:
           host: ${{ env.SSH_HOST }}
           username: ${{ env.SSH_USER }}
           key: ${{ env.SSH_PRIVATE_KEY }}
           port: ${{ env.SSH_PORT }}
-          script: |
+          source: "./"
-            TARGET="${{ needs.prepare_context.outputs.pr_path }}"
+          target: "${{ needs.prepare_deployment_vars.outputs.deploy_path }}"
-            if [ -d "$TARGET" ]; then
+
-              cd "$TARGET"
+      - name: Sync file via scp (staging)
-              docker compose down -v || true
+        if: github.ref == 'refs/heads/main'
-              cd ..
+        uses: appleboy/scp-action@master
-              rm -rf "$TARGET"
+        with:
-              echo "Cleanup successful"
+          host: ${{ env.SSH_HOST }}
-            else
+          username: ${{ env.SSH_USER }}
-              echo "Directory not found, skipping."
+          key: ${{ env.SSH_PRIVATE_KEY }}
-            fi
+          port: ${{ env.SSH_PORT }}
+          source: "./"
+          target: ${{ env.REMOTE_STAGING_PATH }}
+
+  run_docker_compose_dev:
+    name: Run docker-compose remotely (Dev)
+    runs-on: ubuntu-latest
+    needs: [sync_repo_files, prepare_deployment_vars]
+    if: |
+      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
+    steps:
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
+
+      - name: Add host to known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
+            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
+            exit 1
+          }
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Run docker-compose on remote host
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose --env-file dev.env -f docker-compose.yaml up -d --build"
+
+  run_docker_compose_staging:
+    name: Run docker-compose remotely (Staging)
+    runs-on: ubuntu-latest
+    needs: [sync_repo_files, prepare_deployment_vars]
+    if: |
+      (github.ref == 'refs/heads/main')
+    steps:
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
+
+      - name: Add host to known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
+            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
+            exit 1
+          }
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Run docker-compose on remote host
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${REMOTE_STAGING_PATH}' && docker-compose --env-file staging.env -f docker-compose.yaml up -d --build"
+
+  run_docker_compose_prod:
+    name: Run docker-compose remotely (Prod)
+    runs-on: ubuntu-latest
+    needs: [sync_repo_files, prepare_deployment_vars]
+    if: |
+      (github.ref == 'refs/heads/main')
+    steps:
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
+
+      - name: Add host to known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
+            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
+            exit 1
+          }
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Run docker-compose on remote host
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose --env-file prod.env -f docker-compose.yaml up -d --build"
+
+  cleanup_mr_environment:
+    name: Cleanup MR environment
+    runs-on: ubuntu-latest
+    needs: prepare_deployment_vars
+    if: |
+      github.event_name == 'pull_request' && 
+      (github.event.action == 'closed' || github.event.pull_request.merged == true)
+    steps:
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
+
+      - name: Add host to known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
+            echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
+            exit 1
+          }
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Run docker-compose down on remote host
+        run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose down"
+
+      - name: Delete deployment directory
+        run: |
+          ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "if [ -d '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' ]; then rm -rf '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'; echo 'Directory removed.'; else echo 'Directory not found, skipping.'; fi"

dev.env

@@ -1,9 +1,3 @@
 PORT=898
-HTTPS_PORT=446
 ENV=dev
 NETWORK_NAME=proxy
-CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
-DOMAIN=dev.kovagoadi.hu
-ACME_BYPASS=false
-TRAEFIK_LEGACY_OPT=
-# TRAEFIK_LEGACY_OPT="--providers.file.directory=/etc/traefik"

docker-compose.prod.yaml

@@ -1,9 +0,0 @@
-services:
-  traefik:
-    networks:
-      - proxy
-      - legacy-nginx
-networks:
-  legacy-nginx:
-    name: proxy
-    external: true

docker-compose.yaml

@@ -1,6 +1,7 @@
 services:
   traefik:
-    image: "traefik:v3.6@sha256:67622638cd88dbfcfba40159bc652ecf0aea0e032f8a3c7e3134ae7c037b9910"
+    image: "traefik:v3.6@sha256:18112aed2bfe3dfb8534f1045622390c3316596cff0cefab64f44e43d23e1640"
+    # container_name: "traefik"
     restart: unless-stopped
     security_opt:
       - no-new-privileges:true
@@ -12,44 +13,21 @@ services:
       - "--providers.docker.network=proxy"
       - "--providers.docker.constraints=Label(`env`, `${ENV}`)"
       - "--entryPoints.web.address=:80"
-      - "--entryPoints.https.address=:443"
-      - "--entryPoints.web.allowACMEByPass=${ACME_BYPASS}"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
-      - "--certificatesresolvers.letsencrypt.acme.email=kovagoadi@gmail.com"
-      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--certificatesResolvers.letsencrypt.acme.caServer=${CERTBOT_CA_RESOLVER}"
-      - "${TRAEFIK_LEGACY_OPT:-}"
-      - "--providers.file.watch=true"
-    # extra_hosts:
-    #   - "staging:${STAGING_IP:-192.168.1.85}"
-    #   - "webserver:${LEGACY_IP:-192.168.1.85}"
     ports:
       - "${PORT}:80"
-      - "${HTTPS_PORT}:443"
       - "8080"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "letsencrypt:/letsencrypt"
-      - "./${ENV}:/etc/traefik"
 
   whoami:
-    image: "traefik/whoami@sha256:200689790a0a0ea48ca45992e0450bc26ccab5307375b41c84dfc4f2475937ab"
+    image: "traefik/whoami"
     restart: unless-stopped
     networks:
       - proxy
     labels:
       - "env=${ENV}"
       - "traefik.enable=true"
-      - "traefik.http.routers.whoami.priority=100"
+      - "traefik.http.routers.whoami.rule=Host(`whoami.docker.localhost`)"
-      - "traefik.http.routers.whoami.rule=Host(`test-whoami.${DOMAIN}`)"
-      - "traefik.http.routers.https.priority=100"
-      - "traefik.http.routers.https.rule=Host(`test-whoami.${DOMAIN}`)"
       - "traefik.http.routers.whoami.entrypoints=web"
-      - traefik.http.routers.https.entrypoints=https
-      - traefik.http.routers.https.tls=true
-      - traefik.http.routers.https.tls.certresolver=letsencrypt
 networks:
   proxy:
-volumes:
-  letsencrypt:

prod.env

@@ -1,8 +1,3 @@
-PORT=80
+PORT=81
-HTTPS_PORT=443
 ENV=prod
 NETWORK_NAME=proxy
-CERTBOT_CA_RESOLVER=https://acme-v02.api.letsencrypt.org/directory
-DOMAIN=kovagoadi.hu
-ACME_BYPASS=true
-TRAEFIK_LEGACY_OPT="--providers.file.directory=/etc/traefik"

prod/forward-to-legacy-nginx.yaml

@@ -1,47 +0,0 @@
-# ./traefik/forward-to-legacy-nginx.yaml
-
-tcp:
-  routers:
-    # Router for HTTPS (Passthrough)
-    nginx-legacy-router-secure:
-      rule: "HostSNI(`*`)"
-      service: nginx-legacy-service-secure
-      # Passthrough must be true for SSL to reach Nginx encrypted
-      tls:
-        passthrough: true
-      priority: 10
-      entryPoints:
-        - "https"
-
-  services:
-    # Service defining the external IP
-    nginx-legacy-service-secure:
-      loadBalancer:
-        servers:
-          # This is the actual external IP and Port of your Nginx
-          - address: "webserver:443"
-
-http:
-  routers:
-    # 1. TRAEFIK-MANAGED ACME HANDLER (Removed manual router)
-    traefik-acme-handler:
-      rule: "Host(`test-whoami.kovagoadi.hu`) && PathPrefix(`/.well-known/acme-challenge/`)"
-      entryPoints:
-        - "web"
-      service: "acme-http@internal" # This is the internal service name
-      priority: 1000                # High priority to ensure it wins
-
-    # 2. THE HTTP CATCH-ALL (Sends other ACME and HTTP to Nginx)
-    nginx-legacy-router:
-      rule: "HostRegexp(`^.+$`)"
-      service: nginx-legacy-service
-      # Low priority ensures specific containers are handled first, but before the default acme-handler
-      priority: 90
-      entryPoints:
-        - "web"
-
-  services:
-    nginx-legacy-service:
-      loadBalancer:
-        servers:
-          - url: "http://webserver:80"

prod/route-to-staging-dev.yaml

@@ -1,33 +0,0 @@
-http:
-  routers:
-    # Router for HTTP (Port 80)
-    staging:
-      rule: "HostRegexp(`^.+\\.staging\\.kovagoadi\\.hu$`) || HostRegexp(`^.+\\.dev\\.kovagoadi\\.hu$`)"
-      entryPoints:
-        - "web"
-      service: "dev-staging"
-      priority: 1000
-  services:
-    dev-staging:
-      loadBalancer:
-        servers:
-          - url: "http://staging:8080"
-
-tcp:
-  routers:
-    # Router for HTTPS (Passthrough)
-    dev-staging-secure:
-      rule: "HostSNIRegexp(`^.+\\.staging\\.kovagoadi\\.hu$`) || HostSNIRegexp(`^.+\\.dev\\.kovagoadi\\.hu$`)"
-      service: "dev-staging-secure"
-      # Passthrough must be true for SSL to reach Nginx encrypted
-      tls:
-        passthrough: true
-      priority: 1000
-      entryPoints:
-        - "https"
-  services:  
-    dev-staging-secure:
-      loadBalancer:
-        servers:
-          # Note: Ensure Traefik trusts the cert at .85 or set insecureSkipVerify
-          - address: "staging:445"

staging.env

@@ -1,8 +1,3 @@
 PORT=8080
-HTTPS_PORT=445
 ENV=staging
 NETWORK_NAME=proxy
-CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
-DOMAIN=staging.kovagoadi.hu
-ACME_BYPASS=false
-TRAEFIK_LEGACY_OPT=

tests/e2e/.gitignore

@@ -1 +0,0 @@
-__pycache__

tests/e2e/requirements.txt

@@ -1,2 +0,0 @@
-pytest
-requests

tests/e2e/test_traefik.py

@@ -1,221 +0,0 @@
-import pytest
-import requests
-import os
-
-# Configuration
-DOMAIN = os.getenv("DOMAIN", "dev.kovagoadi.hu")
-PORT = os.getenv("PORT", "898")
-HTTPS_PORT = os.getenv("HTTPS_PORT", "446")
-
-BASE_URL = f"http://127.0.0.1:{PORT}"
-HTTPS_BASE_URL = f"https://127.0.0.1:{HTTPS_PORT}"
-HOST_HEADER = f"test-whoami.{DOMAIN}"
-
-@pytest.fixture(scope="session", autouse=True)
-def mock_webserver():
-    """Start ephemeral mock webserver containers and configure Traefik."""
-    import time
-    
-    # Skip ephemeral mocks in CI environment; test against real services
-    if os.getenv("CI"):
-        print("CI environment detected. Skipping ephemeral mock setup; testing against real services.")
-        yield
-        return
-
-    # In CI (Docker-in-Docker), we need to use the HOST path for volumes, not the container path.
-    # The workflow mounts the project root to /app, but the Docker daemon is on the host.
-    # We pass PROJECT_ROOT env var to the test container to tell it where the files are on the HOST.
-    cwd = os.getenv("PROJECT_ROOT", os.getcwd())
-    certs_dir = os.path.join(cwd, "tests/mock_nginx/certs")
-    image = "nginx:alpine"
-    
-    # Define mocks
-    mocks = [
-        {
-            "name": "mock-legacy-ephemeral",
-            "alias": "webserver",
-            "conf": os.path.join(cwd, "tests/mock_nginx/legacy.conf"),
-            "ports": ["80", "443"]
-        },
-        {
-            "name": "mock-staging-ephemeral",
-            "alias": "mock",
-            "conf": os.path.join(cwd, "tests/mock_nginx/staging.conf"),
-            "ports": ["8080", "445"]
-        }
-    ]
-    
-    # Cleanup and Start Mocks
-    mock_ips = {}
-    for mock in mocks:
-        subprocess.run(["docker", "rm", "-f", mock["name"]], capture_output=True)
-        cmd = [
-            "docker", "run", "-d", "--rm",
-            "--name", mock["name"],
-            "--network", "proxy",
-            "--network-alias", mock["alias"],
-            "-v", f"{mock['conf']}:/etc/nginx/nginx.conf:ro",
-            "-v", f"{certs_dir}:/etc/nginx/certs:ro",
-            image
-        ]
-        
-        print(f"Starting {mock['name']}...")
-        result = subprocess.run(cmd, capture_output=True, text=True)
-        if result.returncode != 0:
-            print(f"STDOUT: {result.stdout}")
-            print(f"STDERR: {result.stderr}")
-            pytest.fail(f"Failed to start {mock['name']}: {result.stderr}")
-            
-        # Inspect container to get IP
-        inspect_cmd = ["docker", "inspect", "-f", "{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}", mock["name"]]
-        inspect_res = subprocess.run(inspect_cmd, capture_output=True, text=True)
-        if inspect_res.returncode != 0:
-             pytest.fail(f"Failed to inspect {mock['name']}: {inspect_res.stderr}")
-        mock_ips[mock["alias"]] = inspect_res.stdout.strip()
-        print(f"{mock['name']} IP: {mock_ips[mock['alias']]}")
-
-    # Restart Traefik with IP env vars for extra_hosts
-    print(f"Restarting Traefik with STAGING_IP={mock_ips['mock']} and LEGACY_IP={mock_ips['webserver']}...")
-    env = os.environ.copy()
-    env["STAGING_IP"] = mock_ips["mock"]
-    env["LEGACY_IP"] = mock_ips["webserver"]
-    
-    # In CI (Docker-in-Docker), we need to tell docker-compose that the project root 
-    # is the HOST path (PROJECT_ROOT), not the container path (/app).
-    # This ensures volume mounts use the correct host paths.
-    if "PROJECT_ROOT" in os.environ:
-        env["COMPOSE_PROJECT_DIR"] = os.environ["PROJECT_ROOT"]
-
-    # We need to recreate the container to pick up extra_hosts changes
-    try:
-        subprocess.run(["docker-compose", "--env-file", "dev.env", "up", "-d", "--force-recreate", "--no-deps", "traefik"], env=env, check=True, capture_output=True, text=True)
-    except subprocess.CalledProcessError as e:
-        print(f"Docker Compose STDOUT: {e.stdout}")
-        print(f"Docker Compose STDERR: {e.stderr}")
-        raise e
-    
-    # Wait for everything to settle
-    time.sleep(5)
-    
-    yield
-    
-    print("Stopping mocks and restoring Traefik...")
-    for mock in mocks:
-        subprocess.run(["docker", "stop", mock["name"]], capture_output=True)
-    
-    # Restore Traefik to default (optional)
-    subprocess.run(["docker-compose", "--env-file", "dev.env", "up", "-d", "--force-recreate", "--no-deps", "traefik"], check=True)
-
-def test_whoami_http_reachable():
-    """Verify that the whoami service is reachable via HTTP."""
-    try:
-        response = requests.get(BASE_URL, headers={"Host": HOST_HEADER}, timeout=5)
-        assert response.status_code == 200
-        assert "Hostname:" in response.text
-    except requests.exceptions.RequestException as e:
-        pytest.fail(f"Failed to connect to {BASE_URL}: {e}")
-
-import subprocess
-
-def test_whoami_https_reachable():
-    """Verify that the whoami service is reachable via HTTPS using curl (to handle SNI/DNS)."""
-    # We use curl because requests doesn't support --resolve easily to force SNI with custom IP
-    cmd = [
-        "curl", "-s", "-k", "--fail",
-        "--resolve", f"{HOST_HEADER}:{HTTPS_PORT}:127.0.0.1",
-        f"https://{HOST_HEADER}:{HTTPS_PORT}"
-    ]
-    try:
-        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10, check=True)
-        assert result.returncode == 0
-    except subprocess.CalledProcessError as e:
-        pytest.fail(f"Curl failed with exit code {e.returncode}: {e.stderr}")
-    except subprocess.TimeoutExpired:
-        pytest.fail("Curl timed out")
-
-def test_https_redirect():
-    """Verify that HTTP requests are NOT redirected to HTTPS (based on config, or check if they SHOULD be)."""
-    # Based on docker-compose, there is no global redirect middleware configured on the entrypoint.
-    # So HTTP should remain HTTP.
-    try:
-        response = requests.get(BASE_URL, headers={"Host": HOST_HEADER}, allow_redirects=False, timeout=5)
-        assert response.status_code == 200
-    except requests.exceptions.RequestException as e:
-        pytest.fail(f"Failed to connect to {BASE_URL}: {e}")
-
-def test_unknown_host_404():
-    """Verify that requests to an unknown host (hitting legacy-nginx catch-all) are routed to the mock."""
-    try:
-        # We use a domain that doesn't match the specific *.dev.kovagoadi.hu rules
-        # so it falls through to the catch-all 'nginx-legacy-router'
-        response = requests.get(BASE_URL + "/login", headers={"Host": "tar.kovagoadi.hu"}, timeout=5)
-        assert response.status_code == 200
-    except requests.exceptions.RequestException as e:
-        pytest.fail(f"Failed to connect to {BASE_URL}: {e}")
-
-def test_unknown_host_https_passthrough():
-    """Verify that HTTPS requests to an unknown host are passed through to the mock Nginx."""
-    # We use curl to handle SNI and self-signed certs
-    # unknown.com should hit the catch-all SNI router
-    cmd = [
-        "curl", "-s", "-k", "-i", "--fail",
-        "--resolve", f"tar.kovagoadi.hu:{HTTPS_PORT}:127.0.0.1",
-        f"https://tar.kovagoadi.hu:{HTTPS_PORT}/login"
-    ]
-    try:
-        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10, check=True)
-        assert result.returncode == 0
-    except subprocess.CalledProcessError as e:
-        pytest.fail(f"Curl failed with exit code {e.returncode}: {e.stderr}")
-    except subprocess.TimeoutExpired:
-        pytest.fail("Curl timed out")
-
-def test_staging_http_routing():
-    """Verify HTTP requests to *.staging.kovagoadi.hu are routed to the mock."""
-    host = "test-whoami.staging.kovagoadi.hu"
-    try:
-        response = requests.get(BASE_URL, headers={"Host": host}, timeout=5)
-        assert response.status_code == 200
-    except requests.exceptions.RequestException as e:
-        pytest.fail(f"Failed to connect to {BASE_URL} with host {host}: {e}")
-
-def test_dev_http_routing():
-    """Verify HTTP requests to *.dev.kovagoadi.hu are routed to the mock."""
-    host = "test-whoami.dev.kovagoadi.hu"
-    try:
-        response = requests.get(BASE_URL, headers={"Host": host}, timeout=5)
-        assert response.status_code == 200
-    except requests.exceptions.RequestException as e:
-        pytest.fail(f"Failed to connect to {BASE_URL} with host {host}: {e}")
-
-def test_staging_https_routing():
-    """Verify HTTPS requests to *.staging.kovagoadi.hu are routed to the mock."""
-    host = "test-whoami.staging.kovagoadi.hu"
-    cmd = [
-        "curl", "-s", "-k", "-i", "--fail",
-        "--resolve", f"{host}:{HTTPS_PORT}:127.0.0.1",
-        f"https://{host}:{HTTPS_PORT}"
-    ]
-    try:
-        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10, check=True)
-        assert result.returncode == 0
-    except subprocess.CalledProcessError as e:
-        pytest.fail(f"Curl failed with exit code {e.returncode}: {e.stderr}")
-    except subprocess.TimeoutExpired:
-        pytest.fail("Curl timed out")
-
-def test_dev_https_routing():
-    """Verify HTTPS requests to *.dev.kovagoadi.hu are routed to the mock."""
-    host = "test-whoami.dev.kovagoadi.hu"
-    cmd = [
-        "curl", "-s", "-k", "-i", "--fail",
-        "--resolve", f"{host}:{HTTPS_PORT}:127.0.0.1",
-        f"https://{host}:{HTTPS_PORT}"
-    ]
-    try:
-        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10, check=True)
-        assert result.returncode == 0
-    except subprocess.CalledProcessError as e:
-        pytest.fail(f"Curl failed with exit code {e.returncode}: {e.stderr}")
-    except subprocess.TimeoutExpired:
-        pytest.fail("Curl timed out")

tests/mock_nginx/certs/server.crt

@@ -1,19 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDCzCCAfOgAwIBAgIUU5vuywVWaoDfFyee7NCy0BqXU3kwDQYJKoZIhvcNAQEL
-BQAwFTETMBEGA1UEAwwKbW9jay1uZ2lueDAeFw0yNTEyMjUxNjAwMTNaFw0yNjEy
-MjUxNjAwMTNaMBUxEzARBgNVBAMMCm1vY2stbmdpbngwggEiMA0GCSqGSIb3DQEB
-AQUAA4IBDwAwggEKAoIBAQCaoLrs78+HbDFB/HsXTy5nqtP7V33Js0GDWxk6QkOq
-qbCtd5e2fzjkFFWkFIuouLEL1+4xW5txToaCtIYhQUgwST/Wu4wLlzrueRmprTh2
-oTLbpSVXn6kO7dvDinsfelcjnLNgjRkkKPRYVvnCsrr2O9gFhClWf+WKMuNP99/O
-4Y7Na4l6fyQAMjDSgdFjVvB+D9YMbkfNmo5hs009lF0Y6u35hIaY1NyfI+csvwWZ
-j75I/1TGKQGwrmtG2U31xM8Y8mj7mye0IeXoIg8rl/efYVKRcEBahu0140t6A69g
-N7kCSsGhl78VJEUVz5OuOSdV9UDwzawiHh/M+1KE3/3VAgMBAAGjUzBRMB0GA1Ud
-DgQWBBQOgMuir6oD712l2GKpUoPo0RUcyDAfBgNVHSMEGDAWgBQOgMuir6oD712l
-2GKpUoPo0RUcyDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAv
-52u9mAOTKStdNZA4R68icJRXmOuxkTh9/rMdOYFF+GM2bMiX1DsvY9/VAFuy7EdZ
-yfvu72JyaBDMljryz6doupXm9Do9um2sTU0YKkarV2EECYqt5uC56KWs9XZ9mnYW
-wnTrLTbGZhRbGz4pq+Pq7Z1VUexV/Tnoxs5RlOaDxrlaS9htLfIR3dv2bhQiMGN9
-1LESNZ16c3s4026pxeojCKFVf2GS+IBdbzljdUzBMVzwGl10UZQHfMDJptuW6JKo
-rO5XVp5cLpLzSgUSGtGIoT2dR2Nk5kxGw4VbRCKKD7CDdS+JFypSwdg3v2oNfAmV
-op1lOPZtztQRw/6zo4Ex
------END CERTIFICATE-----

tests/mock_nginx/certs/server.key

@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCaoLrs78+HbDFB
-/HsXTy5nqtP7V33Js0GDWxk6QkOqqbCtd5e2fzjkFFWkFIuouLEL1+4xW5txToaC
-tIYhQUgwST/Wu4wLlzrueRmprTh2oTLbpSVXn6kO7dvDinsfelcjnLNgjRkkKPRY
-VvnCsrr2O9gFhClWf+WKMuNP99/O4Y7Na4l6fyQAMjDSgdFjVvB+D9YMbkfNmo5h
-s009lF0Y6u35hIaY1NyfI+csvwWZj75I/1TGKQGwrmtG2U31xM8Y8mj7mye0IeXo
-Ig8rl/efYVKRcEBahu0140t6A69gN7kCSsGhl78VJEUVz5OuOSdV9UDwzawiHh/M
-+1KE3/3VAgMBAAECggEANx57c5Fqj1IMXwLC2ATEPHUDGpHOB5PMEyhqnj9XwqK5
-laRPYuEH5Rmwi4w9Wnf3uIqQ4GxQxTuiLD5wn7MXKgs6Y++31LvkaHSnprnWKkd9
-Cxnb7Ve/GlDEqXgYOpjQLiQiNxUk9KRasZDTeElg5vxfHVxGpgxyROit6egokiR8
-JNglP+zrHicuvzl4f2DGQmjF5C4HQgyFIVrBv+vNKlqKmg2HatKIqBE60u7uw6CI
-/Q8ecqU9oVZscOF9T6hUJX0xijGSsE5UTR87U2zo0+fQRJ5qZ5pLjIuF5YiCi0eT
-qZex+h1TuTHNFoc1gcAyj5eDZQwwzZiR/Lae/pDyYwKBgQDVPy/elkUkoDm/OlbE
-g+wZpBAGGw2ACCK5SpgwRVmHEZUvBbNZgLfE0BydaK88eDTDbLpvfVNvMoNrZQTh
-bAqt9XsFBzmfMusiDYbK3ebhooObEcc6I1GmU5fqHuDv3h0CaEli2JjPmB44mXr8
-EGtl98nijNgAmbaA3p7IlWGeGwKBgQC5oPJOjSw6ZRywZwB220tIm0vMcp60sTmq
-H+ESaNMkpB38T9OBTdprBjAUzDCZC4jKFwU03ZQtGIN9S6BhogqyP8BRI/+lGJRQ
-ZLT1eVSHuC8bX1kVfb5tlahRQ2VUSj5cZxyOiZ8JXa1r1bf8/FZ/0tzLB4a7Ge5Z
-2lyQXa3SzwKBgCGCDkmRn0fEDY7o4d17RUw6JXJwKczmel5XRFbBbvH0Z1a+NJJp
-0XaRpQ1u96ou0Uur+Bewv72HWHM1qnCpg3wWSMBfhERpwdzV90pFWBQ4bymcv4t5
-JUlXdVWKiJnocvJ/5JgtpMVqB8WpCFQ3WEjriMOakg52GOFjGdw27OHlAoGBAKmk
-eezpvXK8dySLbXQx4zI+ol38nie6E13zdmixnczNo42zkjKIaMUISaaoGP20+dTe
-huaSXVl9HqXCGJdBVI8kDejZgkdqGBkEgBAaSvMhkwNr9ujaGs7hR4rEkfUfSLB/
-lyx4fvw7PULgdR3hqld06E0v2qRhBV/eXFufET0nAoGAaXKncm7o2LnMIcJV3qrk
-c0darLx+VWg0ILnE3/6kGSgGGnMm93tEwSX8h7Nq7QRNkVLUalVAcjm7jR9XGNsY
-W8oXqsyqmntNSA2f9w4MqYO2/i/xtN830qW2nw/RLLV5avD6EkY2KrlFbrrZQr2y
-q8oFyEAxJc8Kmo5ocnrPq1s=
------END PRIVATE KEY-----

tests/mock_nginx/legacy.conf

@@ -1,26 +0,0 @@
-events {}
-
-http {
-    server {
-        listen 80;
-        server_name _;
-
-        location / {
-            add_header X-Mock-Service "legacy";
-            return 200 "Mock Nginx Legacy HTTP\n";
-        }
-    }
-
-    server {
-        listen 443 ssl;
-        server_name _;
-
-        ssl_certificate /etc/nginx/certs/server.crt;
-        ssl_certificate_key /etc/nginx/certs/server.key;
-
-        location / {
-            add_header X-Mock-Service "legacy";
-            return 200 "Mock Nginx Legacy HTTPS\n";
-        }
-    }
-}

tests/mock_nginx/nginx.conf

@@ -1,26 +0,0 @@
-events {}
-
-http {
-    server {
-        listen 80;
-        server_name _;
-
-        location / {
-            add_header X-Mock-Service "true";
-            return 200 "Mock Nginx HTTP\n";
-        }
-    }
-
-    server {
-        listen 443 ssl;
-        server_name _;
-
-        ssl_certificate /etc/nginx/certs/server.crt;
-        ssl_certificate_key /etc/nginx/certs/server.key;
-
-        location / {
-            add_header X-Mock-Service "true";
-            return 200 "Mock Nginx HTTPS\n";
-        }
-    }
-}

tests/mock_nginx/staging.conf

@@ -1,26 +0,0 @@
-events {}
-
-http {
-    server {
-        listen 8080;
-        server_name _;
-
-        location / {
-            add_header X-Mock-Service "staging";
-            return 200 "Mock Nginx Staging HTTP\n";
-        }
-    }
-
-    server {
-        listen 445 ssl;
-        server_name _;
-
-        ssl_certificate /etc/nginx/certs/server.crt;
-        ssl_certificate_key /etc/nginx/certs/server.key;
-
-        location / {
-            add_header X-Mock-Service "staging";
-            return 200 "Mock Nginx Staging HTTPS\n";
-        }
-    }
-}