Update traefik:v3.7 Docker digest to 24841fe

Reviewed-on: #83

.gitea/workflows/workflow.yaml

@@ -47,10 +47,10 @@ jobs:
     needs: [prepare_context]
     if: github.event_name == 'pull_request' && github.event.action != 'closed'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Deploy via Rsync & Docker
-        uses: easingthemes/ssh-deploy@922253577e23ce0edbfdbf819f0e1ceaecabc61a # v5.1.2
+        uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
         env:
           SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
           REMOTE_HOST: ${{ env.SSH_HOST }}
@@ -76,10 +76,10 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Deploy via Rsync & Docker
-        uses: easingthemes/ssh-deploy@922253577e23ce0edbfdbf819f0e1ceaecabc61a # v5.1.2
+        uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
         env:
           SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
           REMOTE_HOST: ${{ env.SSH_HOST }}
@@ -92,7 +92,7 @@ jobs:
           SCRIPT_AFTER: |
             set -e
             cd ${{ env.REMOTE_STAGING_PATH }}
-            docker compose --env-file staging.env -f docker-compose.yaml up -d --build --remove-orphans --wait
+            docker compose --env-file staging.env -f docker-compose.yaml -f docker-compose.client.yaml up -d --build --remove-orphans --wait
 
   # ------------------------------------------------------------------
   # STAGE 3.5: DEPLOY PRE-PROD
@@ -103,10 +103,10 @@ jobs:
     needs: [deploy_staging]
     if: github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Deploy via Rsync & Docker
-        uses: easingthemes/ssh-deploy@922253577e23ce0edbfdbf819f0e1ceaecabc61a # v5.1.2
+        uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
         env:
           SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
           REMOTE_HOST: ${{ env.SSH_HOST }}
@@ -122,7 +122,7 @@ jobs:
             docker compose --env-file preprod.env -f docker-compose.yaml -f docker-compose.prod.yaml -f docker-compose.preprod.yaml up -d --build --remove-orphans --wait
 
       - name: Run E2E Tests
-        uses: appleboy/ssh-action@823bd89e131d8d508129f9443cad5855e9ba96f0 # v1.2.4
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
         with:
           host: ${{ env.SSH_HOST }}
           username: ${{ env.SSH_USER }}
@@ -165,10 +165,10 @@ jobs:
     needs: [deploy_preprod]
     if: github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Deploy via Rsync & Docker
-        uses: easingthemes/ssh-deploy@922253577e23ce0edbfdbf819f0e1ceaecabc61a # v5.1.2
+        uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
         env:
           SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
           REMOTE_HOST: ${{ env.SSH_HOST }}

docker-compose.client.yaml

@@ -0,0 +1,9 @@
+services:
+  traefik:
+    networks:
+      - proxy
+      - shared_network
+networks:
+  shared_network:
+    name: prod_shared-network
+    external: true

docker-compose.dev.yaml

@@ -3,10 +3,14 @@ services:
     networks:
       - proxy
       - staging-network
+      - shared_network
 networks:
   legacy-nginx:
     name: proxy
     external: true
   staging-network:
     name: staging_proxy
+    external: true
+  shared_network:
+    name: prod_shared-network
     external: true

docker-compose.yaml

@@ -1,12 +1,11 @@
 services:
   traefik:
-    image: "traefik:v3.6@sha256:5ae9c349154d5298a5d61a7b25e5f3a9f53314f1515e87632120b95051c7917c"
+    image: "traefik:v3.7@sha256:24841fe2de7304c149343d877d2923b4c8800a38ba015dea9174c23b20e344a0"
     restart: unless-stopped
     security_opt:
       - no-new-privileges:true
     networks:
       - proxy
-      - shared_network
     command:
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
@@ -22,6 +21,8 @@ services:
       - "--certificatesResolvers.letsencrypt.acme.caServer=${CERTBOT_CA_RESOLVER}"
       - "${TRAEFIK_LEGACY_OPT:-}"
       - "--providers.file.watch=true"
+      - "--accesslog"
+      - "--log.level=INFO"
     # extra_hosts:
     #   - "staging:${STAGING_IP:-192.168.1.85}"
     #   - "webserver:${LEGACY_IP:-192.168.1.85}"
@@ -35,7 +36,7 @@ services:
       - "./${ENV}:/etc/traefik"
 
   whoami:
-    image: "traefik/whoami@sha256:200689790a0a0ea48ca45992e0450bc26ccab5307375b41c84dfc4f2475937ab"
+    image: "traefik/whoami@sha256:c4717a8d1f0134a7444e24f881160e033991f23027c6c5a9a3f8fd22e70d1d44"
     restart: unless-stopped
     networks:
       - proxy
@@ -52,8 +53,5 @@ services:
       - traefik.http.routers.https.tls.certresolver=letsencrypt
 networks:
   proxy:
-  shared_network:
-    name: prod_shared-network
-    external: true
 volumes:
   letsencrypt:

preprod/forward-to-legacy-nginx.yaml

@@ -13,10 +13,16 @@ tcp:
       entryPoints:
         - "https"
 
+  serversTransports:
+    nginx-legacy-transport-secure:
+      proxyProtocol:
+        version: 2
+
   services:
     # Service defining the external IP
     nginx-legacy-service-secure:
       loadBalancer:
+        serversTransport: nginx-legacy-transport-secure
         servers:
           # This is the actual external IP and Port of your Nginx
           - address: "webserver:443"

prod/forward-to-legacy-nginx.yaml

@@ -13,10 +13,16 @@ tcp:
       entryPoints:
         - "https"
 
+  serversTransports:
+    nginx-legacy-transport-secure:
+      proxyProtocol:
+        version: 2
+
   services:
     # Service defining the external IP
     nginx-legacy-service-secure:
       loadBalancer:
+        serversTransport: nginx-legacy-transport-secure
         servers:
           # This is the actual external IP and Port of your Nginx
           - address: "webserver:443"

prod/route-to-kovagoadigepe.yaml

@@ -0,0 +1,29 @@
+http:
+  routers:
+    kovagoadi-gepe-http-router:
+      rule: "HostRegexp(`^.+\\.kovagoadi-gepe\\.kovagoadi\\.hu$`)"
+      entryPoints:
+        - "web"
+      service: "kovagoadi-gepe-http"
+      priority: 100
+  services:
+    kovagoadi-gepe-http:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.81:80"
+
+tcp:
+  routers:
+    kovagoadi-gepe-secure-router:
+      rule: "HostSNI(`*.kovagoadi-gepe.kovagoadi.hu`)"
+      service: "kovagoadi-gepe-secure"
+      tls:
+        passthrough: true
+      priority: 100
+      entryPoints:
+        - "https"
+  services:  
+    kovagoadi-gepe-secure:
+      loadBalancer:
+        servers:
+          - address: "192.168.1.81:443"

tests/mock_nginx/legacy.conf

@@ -5,6 +5,9 @@ http {
         listen 80;
         server_name _;
 
+        real_ip_header X-Forwarded-For;
+        set_real_ip_from 0.0.0.0/0;
+
         location / {
             add_header X-Mock-Service "legacy";
             return 200 "Mock Nginx Legacy HTTP\n";
@@ -12,9 +15,12 @@ http {
     }
 
     server {
-        listen 443 ssl;
+        listen 443 ssl proxy_protocol;
         server_name _;
 
+        real_ip_header proxy_protocol;
+        set_real_ip_from 0.0.0.0/0;
+
         ssl_certificate /etc/nginx/certs/server.crt;
         ssl_certificate_key /etc/nginx/certs/server.key;