[Env] #1321078 - Close ports and add traefik labels

Author: PierreGauthier

.github/workflows/deploy-int.yml.orig

@@ -42,7 +42,7 @@ up: .env ## Start the docker hub in detached mode (no logs)
 	@$(DOCKER_COMP) up --detach
 
 up-connectors: .env ## Start the docker hub in detached mode with connectors conf (no logs)
-	@$(DOCKER_COMP) -f compose.yml -f compose.override.yml -f compose.connectors.yml up --detach
+	@$(DOCKER_COMP) -f compose.yml -f compose.override.yml -f docker/compose/compose.connectors.yml up --detach
 
 start: build up ## Build and start the containers
 

Makefile

@@ -56,15 +56,3 @@ services:
     environment:
       - PUBLIC_URL=https://${SERVER_NAME:-gally.localhost}/example
       - REACT_APP_API_URL=https://${SERVER_NAME:-gally.localhost}/${API_ROUTE_PREFIX:-api}
-
-###> doctrine/doctrine-bundle ###
-  database:
-    ports:
-      - target: 5432
-        published: 5432
-        protocol: tcp
-###< doctrine/doctrine-bundle ###
-
-  redis:
-    ports:
-      - '6379:6379'

compose.override.yml

@@ -3,8 +3,8 @@ services:
     build:
       context: ./docker/proxy
     ports:
-      - "80:80"
-      - "443:443"
+      - "${HTTP_PORT:-80}:80"
+      - "${HTTPS_PORT:-443}:443"
     volumes:
       - ./docker/certbot/certs:/etc/nginx/certs
       - ./docker/certbot/www:/var/www/certbot
@@ -35,6 +35,15 @@ services:
       - BACKEND_PORT=80
       - PHP_UPSTREAM=php
       - VARNISH_SIZE=512M
+    labels:
+      - traefik.enable=true
+      # Serve gally over http
+      - traefik.http.routers.gally-http.rule=Host(`${SERVER_NAME:-gally.localhost}`)
+      - traefik.http.routers.gally-http.entrypoints=http
+      # Serve gally over https
+      - traefik.http.routers.gally-https.rule=Host(`${SERVER_NAME:-gally.localhost}`)
+      - traefik.http.routers.gally-https.entrypoints=https
+      - traefik.http.routers.gally-https.tls=true
 
   router:
     build:
@@ -148,8 +157,8 @@ services:
         soft: -1
         hard: -1
     ports:
-      - 9200:9200
-      - 9600:9600    
+      - 9200
+      - 9600    
     healthcheck:
       test: test $$(curl -uadmin:$${OPENSEARCH_INITIAL_ADMIN_PASSWORD:-!ChangeMe0!} -k --write-out %{http_code} --fail --silent --output /dev/null https://localhost:9200/_cluster/health?wait_for_status=green&timeout=5s) -eq 200
       interval: 10s

compose.yml

@@ -1,3 +1,4 @@
+# Add this compose file to your docker compose command if you want to use gally to develop connector locally
 services:
   proxy:
     networks:

compose.connectors.yml docker/compose/compose.connectors.ymlcompose.connectors.yml renamed to docker/compose/compose.connectors.yml

@@ -1,3 +1,4 @@
+# Add this compose file to your docker compose command if you want to use gally with elasticsearch 7 (NB opensearch 2 is recommended)
 services:
   search:
     build:

compose.elasticsearch7.yml docker/compose/compose.elasticsearch7.ymlcompose.elasticsearch7.yml renamed to docker/compose/compose.elasticsearch7.yml

@@ -1,3 +1,4 @@
+# Add this compose file to your docker compose command if you want to use gally with elasticsearch 8 (NB opensearch 2 is recommended)
 services:
   search:
     build:

compose.elasticsearch8.yml docker/compose/compose.elasticsearch8.ymlcompose.elasticsearch8.yml renamed to docker/compose/compose.elasticsearch8.yml

@@ -1,3 +1,4 @@
+# Add this compose file to your docker compose command if you want to enable gpu acceleration for vector computation (WIP)
 services:  
   search-ml:
     build:

compose.with_gpu.yml docker/compose/compose.with_gpu.ymlcompose.with_gpu.yml renamed to docker/compose/compose.with_gpu.yml

@@ -0,0 +1,20 @@
+# Example file for a reverse proxy with traefik, you can run it with 
+# "docker compose -f docker/traefik.yml up -d"
+# /!\ Be careful traefik will need port 80 nd 443 of your system.
+
+name: reverse-proxy
+services:
+  reverse-proxy:
+    # The official v3 Traefik docker image
+    image: traefik:v3.2
+    # Enables the web UI and tells Traefik to listen to docker
+    command:
+        - "--providers.docker=true"
+        - "--providers.docker.exposedbydefault=false"
+        - "--entrypoints.http.address=:80"
+        - "--entrypoints.https.address=:443"
+        - "--api.insecure=true"
+    network_mode: host
+    volumes:
+      # So that Traefik can listen to the Docker events
+      - /var/run/docker.sock:/var/run/docker.sock