Hedi Kalboussi
1e90a85359
- 6 docs racine (README, HANDOVER, ARCHITECTURE, DECISIONS, INSTALL, OPERATIONS) - 9 docs thématiques dans docs/ - 10 templates docker-compose dans configs/ - 7 scripts Python/Shell d'import Furious vers Zitadel - 2 matrices RBAC Etat infra au 5 juin 2026 : - 88 users Furious importes dans Zitadel - 8 roles RBAC crees et attribues - Intranet filtre les cartes selon role (Approche A) - 7 outils SSO operationnels
64 lines
2.0 KiB
Plaintext
64 lines
2.0 KiB
Plaintext
services:
|
|
traefik:
|
|
image: traefik:v3.7.1
|
|
container_name: traefik
|
|
restart: unless-stopped
|
|
command:
|
|
# Dashboard sécurisé
|
|
- "--api.dashboard=true"
|
|
- "--api.insecure=false"
|
|
|
|
# Découverte Docker
|
|
- "--providers.docker=true"
|
|
- "--providers.docker.exposedbydefault=false"
|
|
- "--providers.docker.network=web"
|
|
|
|
# Config file dynamique
|
|
- "--providers.file.filename=/etc/traefik/dynamic.yml"
|
|
- "--providers.file.watch=true"
|
|
|
|
# Entrypoints
|
|
- "--entrypoints.web.address=:80"
|
|
- "--entrypoints.websecure.address=:443"
|
|
|
|
# Redirection HTTP → HTTPS
|
|
- "--entrypoints.web.http.redirections.entrypoint.to=websecure"
|
|
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
|
|
|
|
# Let's Encrypt
|
|
- "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
|
|
- "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
|
|
- "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
|
|
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
|
|
|
|
# Logs
|
|
- "--log.level=INFO"
|
|
- "--accesslog=true"
|
|
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- ./letsencrypt:/letsencrypt
|
|
- ./dynamic.yml:/etc/traefik/dynamic.yml:ro
|
|
|
|
networks:
|
|
- web
|
|
|
|
labels:
|
|
# Dashboard accessible via traefik.<domain>
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN}`)"
|
|
- "traefik.http.routers.traefik.entrypoints=websecure"
|
|
- "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.traefik.service=api@internal"
|
|
- "traefik.http.routers.traefik.middlewares=traefik-auth"
|
|
# Basic auth (à remplacer par hash htpasswd réel)
|
|
- "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_DASHBOARD_AUTH}"
|
|
|
|
networks:
|
|
web:
|
|
external: true
|