Merge branch 'main' into add-access-log-config

.gitea/workflows/workflow.yaml

@@ -47,7 +47,7 @@ jobs:
     needs: [prepare_context]
     if: github.event_name == 'pull_request' && github.event.action != 'closed'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Deploy via Rsync & Docker
         uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
@@ -76,7 +76,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Deploy via Rsync & Docker
         uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
@@ -103,7 +103,7 @@ jobs:
     needs: [deploy_staging]
     if: github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Deploy via Rsync & Docker
         uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
@@ -165,7 +165,7 @@ jobs:
     needs: [deploy_preprod]
     if: github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Deploy via Rsync & Docker
         uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3

docker-compose.yaml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: "traefik:v3.7@sha256:6d3e069ee484ab1da5adfdda555a75eb9b1545ef09096a0cc7c3043101986a20"
+    image: "traefik:v3.7@sha256:d6858791f9e74df44ca4014166647c41cdc2abd3bf2a71b832ca4e1c6a91b257"
     restart: unless-stopped
     security_opt:
       - no-new-privileges:true
@@ -9,7 +9,7 @@ services:
     command:
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=prod_shared-network"
+      - "--providers.docker.network=proxy"
       - "--providers.docker.constraints=Label(`env`, `${ENV}`)"
       - "--entryPoints.web.address=:80"
       - "--entryPoints.https.address=:443"
@@ -19,9 +19,9 @@ services:
       - "--certificatesresolvers.letsencrypt.acme.email=kovagoadi@gmail.com"
       - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
       - "--certificatesResolvers.letsencrypt.acme.caServer=${CERTBOT_CA_RESOLVER}"
-      # - "--providers.file.watch=true"
-      - "--accesslog"
-      - "--log.level=INFO"
+      - "${TRAEFIK_LEGACY_OPT:-}"
+      - "--providers.file.watch=true"
+      - "--accesslog=true"
     # extra_hosts:
     #   - "staging:${STAGING_IP:-192.168.1.85}"
     #   - "webserver:${LEGACY_IP:-192.168.1.85}"
@@ -32,10 +32,10 @@ services:
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "letsencrypt:/letsencrypt"
-      # - "./${ENV}:/etc/traefik"
+      - "./${ENV}:/etc/traefik"
 
   whoami:
-    image: "traefik/whoami@sha256:c4717a8d1f0134a7444e24f881160e033991f23027c6c5a9a3f8fd22e70d1d44"
+    image: "traefik/whoami@sha256:200689790a0a0ea48ca45992e0450bc26ccab5307375b41c84dfc4f2475937ab"
     restart: unless-stopped
     networks:
       - proxy

preprod/forward-to-legacy-nginx.yaml

@@ -13,16 +13,10 @@ tcp:
       entryPoints:
         - "https"
 
-  serversTransports:
-    nginx-legacy-transport-secure:
-      proxyProtocol:
-        version: 2
-
   services:
     # Service defining the external IP
     nginx-legacy-service-secure:
       loadBalancer:
-        serversTransport: nginx-legacy-transport-secure
         servers:
           # This is the actual external IP and Port of your Nginx
           - address: "webserver:443"

prod/forward-to-legacy-nginx.yaml

@@ -13,16 +13,10 @@ tcp:
       entryPoints:
         - "https"
 
-  serversTransports:
-    nginx-legacy-transport-secure:
-      proxyProtocol:
-        version: 2
-
   services:
     # Service defining the external IP
     nginx-legacy-service-secure:
       loadBalancer:
-        serversTransport: nginx-legacy-transport-secure
         servers:
           # This is the actual external IP and Port of your Nginx
           - address: "webserver:443"
@@ -31,7 +25,7 @@ http:
   routers:
     # 1. TRAEFIK-MANAGED ACME HANDLER (Removed manual router)
     traefik-acme-handler:
-      rule: "PathPrefix(`/.well-known/acme-challenge/`)"
+      rule: "Host(`test-whoami.kovagoadi.hu`) && PathPrefix(`/.well-known/acme-challenge/`)"
       entryPoints:
         - "web"
       service: "acme-http@internal" # This is the internal service name

tests/mock_nginx/legacy.conf

@@ -5,9 +5,6 @@ http {
         listen 80;
         server_name _;
 
-        real_ip_header X-Forwarded-For;
-        set_real_ip_from 0.0.0.0/0;
-
         location / {
             add_header X-Mock-Service "legacy";
             return 200 "Mock Nginx Legacy HTTP\n";
@@ -15,12 +12,9 @@ http {
     }
 
     server {
-        listen 443 ssl proxy_protocol;
+        listen 443 ssl;
         server_name _;
 
-        real_ip_header proxy_protocol;
-        set_real_ip_from 0.0.0.0/0;
-
         ssl_certificate /etc/nginx/certs/server.crt;
         ssl_certificate_key /etc/nginx/certs/server.key;