.gitea/workflows/workflow.yaml

@@ -12,6 +12,7 @@ env:
   REMOTE_DEPLOY_PATH: /var/app/traefik/test
   REMOTE_PROD_PATH: /var/app/traefik/prod
   REMOTE_STAGING_PATH: /var/app/traefik/staging
+  REMOTE_PREPROD_PATH: /var/app/traefik/preprod
 
   # --- SECRETS ---
   SSH_HOST: ${{ secrets.SSH_HOST }}
@@ -65,7 +66,7 @@ jobs:
           SCRIPT_AFTER: |
             set -e
             cd ${{ needs.prepare_context.outputs.pr_path }}
-            docker compose --env-file dev.env -f docker-compose.yaml up -d --build --remove-orphans --wait
+            docker compose --env-file dev.env -f docker-compose.yaml -f docker-compose.dev.yaml up -d --build --remove-orphans --wait
 
   # ------------------------------------------------------------------
   # STAGE 3: DEPLOY STAGING
@@ -93,13 +94,75 @@ jobs:
             cd ${{ env.REMOTE_STAGING_PATH }}
             docker compose --env-file staging.env -f docker-compose.yaml up -d --build --remove-orphans --wait
 
+  # ------------------------------------------------------------------
+  # STAGE 3.5: DEPLOY PRE-PROD
+  # ------------------------------------------------------------------
+  deploy_preprod:
+    name: Deploy (Pre-Prod)
+    runs-on: ubuntu-latest
+    needs: [deploy_staging]
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+
+      - name: Deploy via Rsync & Docker
+        uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
+        env:
+          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
+          REMOTE_HOST: ${{ env.SSH_HOST }}
+          REMOTE_USER: ${{ env.SSH_USER }}
+          REMOTE_PORT: ${{ env.SSH_PORT }}
+          TARGET: ${{ env.REMOTE_PREPROD_PATH }}
+          EXCLUDE: ".git/, .github/"
+          SCRIPT_BEFORE: |
+            mkdir -p ${{ env.REMOTE_PREPROD_PATH }}
+          SCRIPT_AFTER: |
+            set -e
+            cd ${{ env.REMOTE_PREPROD_PATH }}
+            docker compose --env-file preprod.env -f docker-compose.yaml -f docker-compose.prod.yaml -f docker-compose.preprod.yaml up -d --build --remove-orphans --wait
+
+      - name: Run E2E Tests
+        uses: appleboy/ssh-action@823bd89e131d8d508129f9443cad5855e9ba96f0 # v1.2.4
+        with:
+          host: ${{ env.SSH_HOST }}
+          username: ${{ env.SSH_USER }}
+          key: ${{ env.SSH_PRIVATE_KEY }}
+          port: ${{ env.SSH_PORT }}
+          script: |
+            set -e
+            cd ${{ env.REMOTE_PREPROD_PATH }}
+            
+            echo "Running E2E tests..."
+            python3 -m venv .venv
+            . .venv/bin/activate
+            
+            # Export env vars
+            set -a
+            . preprod.env
+            set +a
+            
+            pip install -r tests/e2e/requirements.txt
+            
+            # Run tests
+            if pytest tests/e2e/; then
+              echo "Tests passed!"
+              # Cleanup on success
+              docker compose --env-file preprod.env -f docker-compose.yaml -f docker-compose.prod.yaml down --remove-orphans
+            else
+              echo "Tests failed!"
+              # Optional: Cleanup on failure? Or keep for debugging?
+              # User's previous script had it after, implying it runs if pytest succeeds (due to set -e).
+              # I will fail the step.
+              exit 1
+            fi
+
   # ------------------------------------------------------------------
   # STAGE 4: DEPLOY PRODUCTION
   # ------------------------------------------------------------------
   deploy_prod:
     name: Deploy (Production)
     runs-on: ubuntu-latest
-    needs: [deploy_staging]
+    needs: [deploy_preprod]
     if: github.ref == 'refs/heads/main'
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -126,6 +189,10 @@ jobs:
             # Create venv to avoid polluting system python
             python3 -m venv .venv
             . .venv/bin/activate
+            # Export env vars so pytest can see them
+            set -a
+            . prod.env
+            set +a
             pip install -r tests/e2e/requirements.txt
             pytest tests/e2e/
 

docker-compose.dev.yaml

@@ -0,0 +1,12 @@
+services:
+  traefik:
+    networks:
+      - proxy
+      - staging-network
+networks:
+  legacy-nginx:
+    name: proxy
+    external: true
+  staging-network:
+    name: staging_proxy
+    external: true

docker-compose.preprod.yaml

@@ -0,0 +1,13 @@
+services:
+  traefik:
+    networks:
+      - proxy
+      - legacy-nginx
+      - shared-network
+networks:
+  legacy-nginx:
+    name: proxy
+    external: true
+  shared-network:
+    name: prod_shared-network
+    external: true

docker-compose.prod.yaml

@@ -3,7 +3,10 @@ services:
     networks:
       - proxy
       - legacy-nginx
+      - shared-network
 networks:
   legacy-nginx:
     name: proxy
     external: true
+  shared-network:
+    external: false

docker-compose.yaml

@@ -51,5 +51,8 @@ services:
       - traefik.http.routers.https.tls.certresolver=letsencrypt
 networks:
   proxy:
+  shared_network:
+    name: prod_shared-network
+    external: true
 volumes:
   letsencrypt:

preprod.env

@@ -0,0 +1,9 @@
+PORT=8081
+HTTPS_PORT=447
+ENV=preprod
+NETWORK_NAME=proxy
+CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
+DOMAIN=preprod.kovagoadi.hu
+ACME_BYPASS=false
+TRAEFIK_LEGACY_OPT="--providers.file.directory=/etc/traefik"
+CI=true

preprod/forward-to-legacy-nginx.yaml

@@ -0,0 +1,47 @@
+# ./traefik/forward-to-legacy-nginx.yaml
+
+tcp:
+  routers:
+    # Router for HTTPS (Passthrough)
+    nginx-legacy-router-secure:
+      rule: "HostSNI(`*`)"
+      service: nginx-legacy-service-secure
+      # Passthrough must be true for SSL to reach Nginx encrypted
+      tls:
+        passthrough: true
+      priority: 10
+      entryPoints:
+        - "https"
+
+  services:
+    # Service defining the external IP
+    nginx-legacy-service-secure:
+      loadBalancer:
+        servers:
+          # This is the actual external IP and Port of your Nginx
+          - address: "webserver:443"
+
+http:
+  routers:
+    # 1. TRAEFIK-MANAGED ACME HANDLER (Removed manual router)
+    traefik-acme-handler:
+      rule: "Host(`test-whoami.kovagoadi.hu`) && PathPrefix(`/.well-known/acme-challenge/`)"
+      entryPoints:
+        - "web"
+      service: "acme-http@internal" # This is the internal service name
+      priority: 1000                # High priority to ensure it wins
+
+    # 2. THE HTTP CATCH-ALL (Sends other ACME and HTTP to Nginx)
+    nginx-legacy-router:
+      rule: "HostRegexp(`^.+$`)"
+      service: nginx-legacy-service
+      # Low priority ensures specific containers are handled first, but before the default acme-handler
+      priority: 90
+      entryPoints:
+        - "web"
+
+  services:
+    nginx-legacy-service:
+      loadBalancer:
+        servers:
+          - url: "http://webserver:80"

preprod/route-to-staging-dev.yaml

@@ -0,0 +1,33 @@
+http:
+  routers:
+    # Router for HTTP (Port 80)
+    staging:
+      rule: "HostRegexp(`^.+\\.staging\\.kovagoadi\\.hu$`) || HostRegexp(`^.+\\.dev\\.kovagoadi\\.hu$`)"
+      entryPoints:
+        - "web"
+      service: "dev-staging"
+      priority: 1000
+  services:
+    dev-staging:
+      loadBalancer:
+        servers:
+          - url: "http://staging-traefik-1:80"
+
+tcp:
+  routers:
+    # Router for HTTPS (Passthrough)
+    dev-staging-secure:
+      rule: "HostSNIRegexp(`^.+\\.staging\\.kovagoadi\\.hu$`) || HostSNIRegexp(`^.+\\.dev\\.kovagoadi\\.hu$`)"
+      service: "dev-staging-secure"
+      # Passthrough must be true for SSL to reach Nginx encrypted
+      tls:
+        passthrough: true
+      priority: 1000
+      entryPoints:
+        - "https"
+  services:  
+    dev-staging-secure:
+      loadBalancer:
+        servers:
+          # Note: Ensure Traefik trusts the cert at .85 or set insecureSkipVerify
+          - address: "staging-traefik-1:443"

prod/route-to-staging-dev.yaml

@@ -11,7 +11,7 @@ http:
     dev-staging:
       loadBalancer:
         servers:
-          - url: "http://staging:8080"
+          - url: "http://staging-traefik-1:80"
 
 tcp:
   routers:
@@ -30,4 +30,4 @@ tcp:
       loadBalancer:
         servers:
           # Note: Ensure Traefik trusts the cert at .85 or set insecureSkipVerify
-          - address: "staging:445"
+          - address: "staging-traefik-1:443"

tests/e2e/test_traefik.py

@@ -3,108 +3,108 @@ import requests
 import os
 
 # Configuration
-DOMAIN = os.getenv("DOMAIN", "dev.kovagoadi.hu")
+DOMAIN = os.getenv("DOMAIN", "asdasd.kovagoadi.hu")
-PORT = os.getenv("PORT", "898")
+PORT = os.getenv("PORT", "10000")
-HTTPS_PORT = os.getenv("HTTPS_PORT", "446")
+HTTPS_PORT = os.getenv("HTTPS_PORT", "10001")
 
-BASE_URL = f"http://127.0.0.1:{PORT}"
+BASE_URL = f"http://192.168.1.85:{PORT}"
-HTTPS_BASE_URL = f"https://127.0.0.1:{HTTPS_PORT}"
+HTTPS_BASE_URL = f"https://192.168.1.85:{HTTPS_PORT}"
 HOST_HEADER = f"test-whoami.{DOMAIN}"
 
-@pytest.fixture(scope="session", autouse=True)
+# @pytest.fixture(scope="session", autouse=True)
-def mock_webserver():
+# def mock_webserver():
-    """Start ephemeral mock webserver containers and configure Traefik."""
+#     """Start ephemeral mock webserver containers and configure Traefik."""
-    import time
+#     import time
-    
+#     
-    # Skip ephemeral mocks in CI environment; test against real services
+#     # Skip ephemeral mocks in CI environment; test against real services
-    if os.getenv("CI"):
+#     if os.getenv("CI"):
-        print("CI environment detected. Skipping ephemeral mock setup; testing against real services.")
+#         print("CI environment detected. Skipping ephemeral mock setup; testing against real services.")
-        yield
+#         yield
-        return
+#         return
-
+# 
-    # In CI (Docker-in-Docker), we need to use the HOST path for volumes, not the container path.
+#     # In CI (Docker-in-Docker), we need to use the HOST path for volumes, not the container path.
-    # The workflow mounts the project root to /app, but the Docker daemon is on the host.
+#     # The workflow mounts the project root to /app, but the Docker daemon is on the host.
-    # We pass PROJECT_ROOT env var to the test container to tell it where the files are on the HOST.
+#     # We pass PROJECT_ROOT env var to the test container to tell it where the files are on the HOST.
-    cwd = os.getenv("PROJECT_ROOT", os.getcwd())
+#     cwd = os.getenv("PROJECT_ROOT", os.getcwd())
-    certs_dir = os.path.join(cwd, "tests/mock_nginx/certs")
+#     certs_dir = os.path.join(cwd, "tests/mock_nginx/certs")
-    image = "nginx:alpine"
+#     image = "nginx:alpine"
-    
+#     
-    # Define mocks
+#     # Define mocks
-    mocks = [
+#     mocks = [
-        {
+#         {
-            "name": "mock-legacy-ephemeral",
+#             "name": "mock-legacy-ephemeral",
-            "alias": "webserver",
+#             "alias": "webserver",
-            "conf": os.path.join(cwd, "tests/mock_nginx/legacy.conf"),
+#             "conf": os.path.join(cwd, "tests/mock_nginx/legacy.conf"),
-            "ports": ["80", "443"]
+#             "ports": ["80", "443"]
-        },
+#         },
-        {
+#         {
-            "name": "mock-staging-ephemeral",
+#             "name": "mock-staging-ephemeral",
-            "alias": "mock",
+#             "alias": "mock",
-            "conf": os.path.join(cwd, "tests/mock_nginx/staging.conf"),
+#             "conf": os.path.join(cwd, "tests/mock_nginx/staging.conf"),
-            "ports": ["8080", "445"]
+#             "ports": ["8080", "445"]
-        }
+#         }
-    ]
+#     ]
-    
+#     
-    # Cleanup and Start Mocks
+#     # Cleanup and Start Mocks
-    mock_ips = {}
+#     mock_ips = {}
-    for mock in mocks:
+#     for mock in mocks:
-        subprocess.run(["docker", "rm", "-f", mock["name"]], capture_output=True)
+#         subprocess.run(["docker", "rm", "-f", mock["name"]], capture_output=True)
-        cmd = [
+#         cmd = [
-            "docker", "run", "-d", "--rm",
+#             "docker", "run", "-d", "--rm",
-            "--name", mock["name"],
+#             "--name", mock["name"],
-            "--network", "proxy",
+#             "--network", "proxy",
-            "--network-alias", mock["alias"],
+#             "--network-alias", mock["alias"],
-            "-v", f"{mock['conf']}:/etc/nginx/nginx.conf:ro",
+#             "-v", f"{mock['conf']}:/etc/nginx/nginx.conf:ro",
-            "-v", f"{certs_dir}:/etc/nginx/certs:ro",
+#             "-v", f"{certs_dir}:/etc/nginx/certs:ro",
-            image
+#             image
-        ]
+#         ]
-        
+#         
-        print(f"Starting {mock['name']}...")
+#         print(f"Starting {mock['name']}...")
-        result = subprocess.run(cmd, capture_output=True, text=True)
+#         result = subprocess.run(cmd, capture_output=True, text=True)
-        if result.returncode != 0:
+#         if result.returncode != 0:
-            print(f"STDOUT: {result.stdout}")
+#             print(f"STDOUT: {result.stdout}")
-            print(f"STDERR: {result.stderr}")
+#             print(f"STDERR: {result.stderr}")
-            pytest.fail(f"Failed to start {mock['name']}: {result.stderr}")
+#             pytest.fail(f"Failed to start {mock['name']}: {result.stderr}")
-            
+#             
-        # Inspect container to get IP
+#         # Inspect container to get IP
-        inspect_cmd = ["docker", "inspect", "-f", "{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}", mock["name"]]
+#         inspect_cmd = ["docker", "inspect", "-f", "{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}", mock["name"]]
-        inspect_res = subprocess.run(inspect_cmd, capture_output=True, text=True)
+#         inspect_res = subprocess.run(inspect_cmd, capture_output=True, text=True)
-        if inspect_res.returncode != 0:
+#         if inspect_res.returncode != 0:
-             pytest.fail(f"Failed to inspect {mock['name']}: {inspect_res.stderr}")
+#              pytest.fail(f"Failed to inspect {mock['name']}: {inspect_res.stderr}")
-        mock_ips[mock["alias"]] = inspect_res.stdout.strip()
+#         mock_ips[mock["alias"]] = inspect_res.stdout.strip()
-        print(f"{mock['name']} IP: {mock_ips[mock['alias']]}")
+#         print(f"{mock['name']} IP: {mock_ips[mock['alias']]}")
-
+# 
-    # Restart Traefik with IP env vars for extra_hosts
+#     # Restart Traefik with IP env vars for extra_hosts
-    print(f"Restarting Traefik with STAGING_IP={mock_ips['mock']} and LEGACY_IP={mock_ips['webserver']}...")
+#     print(f"Restarting Traefik with STAGING_IP={mock_ips['mock']} and LEGACY_IP={mock_ips['webserver']}...")
-    env = os.environ.copy()
+#     env = os.environ.copy()
-    env["STAGING_IP"] = mock_ips["mock"]
+#     env["STAGING_IP"] = mock_ips["mock"]
-    env["LEGACY_IP"] = mock_ips["webserver"]
+#     env["LEGACY_IP"] = mock_ips["webserver"]
-    
+#     
-    # In CI (Docker-in-Docker), we need to tell docker-compose that the project root 
+#     # In CI (Docker-in-Docker), we need to tell docker-compose that the project root 
-    # is the HOST path (PROJECT_ROOT), not the container path (/app).
+#     # is the HOST path (PROJECT_ROOT), not the container path (/app).
-    # This ensures volume mounts use the correct host paths.
+#     # This ensures volume mounts use the correct host paths.
-    if "PROJECT_ROOT" in os.environ:
+#     if "PROJECT_ROOT" in os.environ:
-        env["COMPOSE_PROJECT_DIR"] = os.environ["PROJECT_ROOT"]
+#         env["COMPOSE_PROJECT_DIR"] = os.environ["PROJECT_ROOT"]
-
+# 
-    # We need to recreate the container to pick up extra_hosts changes
+#     # We need to recreate the container to pick up extra_hosts changes
-    try:
+#     try:
-        subprocess.run(["docker-compose", "--env-file", "dev.env", "up", "-d", "--force-recreate", "--no-deps", "traefik"], env=env, check=True, capture_output=True, text=True)
+#         subprocess.run(["docker-compose", "--env-file", "preprod.env", "up", "-d", "--force-recreate", "--no-deps", "traefik"], env=env, check=True, capture_output=True, text=True)
-    except subprocess.CalledProcessError as e:
+#     except subprocess.CalledProcessError as e:
-        print(f"Docker Compose STDOUT: {e.stdout}")
+#         print(f"Docker Compose STDOUT: {e.stdout}")
-        print(f"Docker Compose STDERR: {e.stderr}")
+#         print(f"Docker Compose STDERR: {e.stderr}")
-        raise e
+#         raise e
-    
+#     
-    # Wait for everything to settle
+#     # Wait for everything to settle
-    time.sleep(5)
+#     time.sleep(5)
-    
+#     
-    yield
+#     yield
-    
+#     
-    print("Stopping mocks and restoring Traefik...")
+#     print("Stopping mocks and restoring Traefik...")
-    for mock in mocks:
+#     for mock in mocks:
-        subprocess.run(["docker", "stop", mock["name"]], capture_output=True)
+#         subprocess.run(["docker", "stop", mock["name"]], capture_output=True)
-    
+#     
-    # Restore Traefik to default (optional)
+#     # Restore Traefik to default (optional)
-    subprocess.run(["docker-compose", "--env-file", "dev.env", "up", "-d", "--force-recreate", "--no-deps", "traefik"], check=True)
+#     subprocess.run(["docker-compose", "--env-file", "preprod.env", "up", "-d", "--force-recreate", "--no-deps", "traefik"], check=True)
 
 def test_whoami_http_reachable():
     """Verify that the whoami service is reachable via HTTP."""
@@ -122,7 +122,7 @@ def test_whoami_https_reachable():
     # We use curl because requests doesn't support --resolve easily to force SNI with custom IP
     cmd = [
         "curl", "-s", "-k", "--fail",
-        "--resolve", f"{HOST_HEADER}:{HTTPS_PORT}:127.0.0.1",
+        "--resolve", f"{HOST_HEADER}:{HTTPS_PORT}:192.168.1.85",
         f"https://{HOST_HEADER}:{HTTPS_PORT}"
     ]
     try:
@@ -159,7 +159,7 @@ def test_unknown_host_https_passthrough():
     # unknown.com should hit the catch-all SNI router
     cmd = [
         "curl", "-s", "-k", "-i", "--fail",
-        "--resolve", f"tar.kovagoadi.hu:{HTTPS_PORT}:127.0.0.1",
+        "--resolve", f"tar.kovagoadi.hu:{HTTPS_PORT}:192.168.1.85",
         f"https://tar.kovagoadi.hu:{HTTPS_PORT}/login"
     ]
     try:
@@ -179,21 +179,21 @@ def test_staging_http_routing():
     except requests.exceptions.RequestException as e:
         pytest.fail(f"Failed to connect to {BASE_URL} with host {host}: {e}")
 
-def test_dev_http_routing():
+# def test_dev_http_routing():
-    """Verify HTTP requests to *.dev.kovagoadi.hu are routed to the mock."""
+#     """Verify HTTP requests to *.dev.kovagoadi.hu are routed to the mock."""
-    host = "test-whoami.dev.kovagoadi.hu"
+#     host = "test-whoami.dev.kovagoadi.hu"
-    try:
+#     try:
-        response = requests.get(BASE_URL, headers={"Host": host}, timeout=5)
+#         response = requests.get(BASE_URL, headers={"Host": host}, timeout=5)
-        assert response.status_code == 200
+#         assert response.status_code == 200
-    except requests.exceptions.RequestException as e:
+#     except requests.exceptions.RequestException as e:
-        pytest.fail(f"Failed to connect to {BASE_URL} with host {host}: {e}")
+#         pytest.fail(f"Failed to connect to {BASE_URL} with host {host}: {e}")
 
 def test_staging_https_routing():
     """Verify HTTPS requests to *.staging.kovagoadi.hu are routed to the mock."""
     host = "test-whoami.staging.kovagoadi.hu"
     cmd = [
         "curl", "-s", "-k", "-i", "--fail",
-        "--resolve", f"{host}:{HTTPS_PORT}:127.0.0.1",
+        "--resolve", f"{host}:{HTTPS_PORT}:192.168.1.85",
         f"https://{host}:{HTTPS_PORT}"
     ]
     try:
@@ -204,18 +204,18 @@ def test_staging_https_routing():
     except subprocess.TimeoutExpired:
         pytest.fail("Curl timed out")
 
-def test_dev_https_routing():
+# def test_dev_https_routing():
-    """Verify HTTPS requests to *.dev.kovagoadi.hu are routed to the mock."""
+#     """Verify HTTPS requests to *.dev.kovagoadi.hu are routed to the mock."""
-    host = "test-whoami.dev.kovagoadi.hu"
+#     host = "test-whoami.dev.kovagoadi.hu"
-    cmd = [
+#     cmd = [
-        "curl", "-s", "-k", "-i", "--fail",
+#         "curl", "-s", "-k", "-i", "--fail",
-        "--resolve", f"{host}:{HTTPS_PORT}:127.0.0.1",
+#         "--resolve", f"{host}:{HTTPS_PORT}:192.168.1.85",
-        f"https://{host}:{HTTPS_PORT}"
+#         f"https://{host}:{HTTPS_PORT}"
-    ]
+#     ]
-    try:
+#     try:
-        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10, check=True)
+#         result = subprocess.run(cmd, capture_output=True, text=True, timeout=10, check=True)
-        assert result.returncode == 0
+#         assert result.returncode == 0
-    except subprocess.CalledProcessError as e:
+#     except subprocess.CalledProcessError as e:
-        pytest.fail(f"Curl failed with exit code {e.returncode}: {e.stderr}")
+#         pytest.fail(f"Curl failed with exit code {e.returncode}: {e.stderr}")
-    except subprocess.TimeoutExpired:
+#     except subprocess.TimeoutExpired:
-        pytest.fail("Curl timed out")
+#         pytest.fail("Curl timed out")