Etiquettes Traefik alignees sur l'installation, tmpfs gunicorn, dependances bornees

compose.yaml

@@ -24,6 +24,7 @@ services:
     read_only: true
     tmpfs:
       - /tmp:size=32m,mode=1777
+      - /app/.gunicorn:size=8m,mode=0700,uid=10001,gid=10001
     security_opt: ["no-new-privileges:true"]
     cap_drop: [ALL]
     deploy:
@@ -33,19 +34,42 @@ services:
       driver: json-file
       options: {max-size: "10m", max-file: "3"}
     labels:
-      traefik.enable: "true"
-      traefik.docker.network: traefik_front_network
-      traefik.http.routers.enclume.rule: Host(`${ENCLUME_DOMAINE:?definir ENCLUME_DOMAINE}`)
-      traefik.http.routers.enclume.entrypoints: websecure
-      traefik.http.routers.enclume.tls.certresolver: ${TRAEFIK_RESOLVER:-cloudflare}
-      traefik.http.routers.enclume.middlewares: enclume-entetes,enclume-limite
-      traefik.http.services.enclume.loadbalancer.server.port: "8080"
-      traefik.http.middlewares.enclume-entetes.headers.stsSeconds: "31536000"
-      traefik.http.middlewares.enclume-entetes.headers.stsIncludeSubdomains: "true"
-      traefik.http.middlewares.enclume-entetes.headers.frameDeny: "true"
-      traefik.http.middlewares.enclume-entetes.headers.contentTypeNosniff: "true"
-      traefik.http.middlewares.enclume-limite.ratelimit.average: "60"
-      traefik.http.middlewares.enclume-limite.ratelimit.burst: "120"
+      # Watchtower volontairement absent : les versions sont epinglees dans .env
+      # et le retour arriere repose sur ce controle. Une mise a jour automatique
+      # le rendrait illusoire.
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik_front_network"
+# HTTP
+      - "traefik.http.routers.enclume-http.rule=Host(`${ENCLUME_DOMAINE:?definir ENCLUME_DOMAINE}`)"
+      - "traefik.http.routers.enclume-http.entrypoints=http"
+      - "traefik.http.routers.enclume-http.priority=49"
+# HTTPS
+      - "traefik.http.routers.enclume-https.rule=Host(`${ENCLUME_DOMAINE}`)"
+      - "traefik.http.routers.enclume-https.entrypoints=https"
+      - "traefik.http.routers.enclume-https.tls=true"
+      - "traefik.http.routers.enclume-https.priority=50"
+      - "traefik.http.routers.enclume-https.service=enclume-https-service"
+      - "traefik.http.routers.enclume-https.middlewares=enclume-middlewares,enclume-limite"
+      - "traefik.http.routers.enclume-https.observability.accesslogs=true"
+      - "traefik.http.routers.enclume-https.observability.metrics=true"
+      - "traefik.http.routers.enclume-https.observability.tracing=true"
+# Middleware
+      - "traefik.http.middlewares.enclume-middlewares.headers.STSSeconds=15552000"
+      - "traefik.http.middlewares.enclume-middlewares.headers.forceSTSHeader=true"
+      - "traefik.http.middlewares.enclume-middlewares.headers.STSIncludeSubdomains=true"
+      - "traefik.http.middlewares.enclume-middlewares.headers.STSPreload=true"
+      - "traefik.http.middlewares.enclume-middlewares.headers.frameDeny=true"
+      # Site public : une limite de debit evite qu'un script ne monopolise la generation.
+      - "traefik.http.middlewares.enclume-limite.ratelimit.average=60"
+      - "traefik.http.middlewares.enclume-limite.ratelimit.burst=120"
+# Service
+      - "traefik.http.services.enclume-https-service.loadbalancer.server.port=8080"
+# Homepage
+      - "homepage.group=Supervision"
+      - "homepage.name=Enclume"
+      - "homepage.icon=centreon.png"
+      - "homepage.href=https://${ENCLUME_DOMAINE}"
+      - "homepage.description=Generateur CLAPI Centreon"
 
   catalog-sync:
     image: ${ENCLUME_REGISTRY:-registry.tips-of-mine.com}/enclume/catalog-sync:${ENCLUME_TAG:?definir ENCLUME_TAG dans .env}
@@ -57,6 +81,9 @@ services:
       CATALOG_DEST: /catalogue
       SYNC_INTERVAL: ${SYNC_INTERVAL:-300}
       RELOAD_URL: http://web:8080/recharger
+    depends_on:
+      web:
+        condition: service_healthy
     volumes:
       - catalogue:/catalogue
     networks: [back_network_enclume]