Nicolas Fryder
a7d7bc94de
Nouveau service apps/admin (admin.metalfrom.eu / admin.dev.metalfrom.eu) : - Frontend statique vanilla JS/CSS reprenant le design system du site (login, dashboard stats, table bands éditable, queue d'enrichissement, historique crawl_run, logs live, checkpoints, journal d'audit) - nginx reverse-proxy /admin/api/* et /admin/auth/* vers le service api interne (same-origin côté navigateur, pas de CORS cross-site nécessaire pour le cookie de session) apps/api : - Nouvelle auth dédiée au dashboard, séparée du token BM_IMPORT_TOKEN existant : login bcrypt + session JWT en cookie httpOnly/secure/ sameSite=strict, rate-limit + lockout après 5 échecs/15min, seeding du compte admin via env vars (jamais de mot de passe en clair en DB ou en git) - Routes /admin/api/* : stats, queue (breakdown priorité identique au crawler Python), bands (recherche/tri/pagination/édition + audit log), crawl-runs, crawl-checkpoints, logs, audit-log - trustProxy activé (Traefik + nginx en amont) apps/crawler : - log_event() écrit dans la nouvelle table crawl_log (run start/finish/ erreurs) pour que le dashboard affiche les logs sans exposer le socket Docker (choix délibéré : pas de docker.sock monté, accès DB only) migration 006_admin_dashboard.sql : admin_users, admin_login_attempts, admin_audit_log, crawl_log Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
107 lines
3.3 KiB
YAML
107 lines
3.3 KiB
YAML
services:
|
|
redis:
|
|
image: redis:7-alpine
|
|
command: ["redis-server", "--appendonly", "yes"]
|
|
volumes:
|
|
- bm_redis_data:/data
|
|
networks:
|
|
- coolify
|
|
|
|
geocoder-worker:
|
|
build:
|
|
context: apps/geocoder
|
|
working_dir: /app
|
|
environment:
|
|
DATABASE_URL: ${DATABASE_URL}
|
|
NOMINATIM_BASE: "https://nominatim.openstreetmap.org"
|
|
NOMINATIM_EMAIL: ${NOMINATIM_EMAIL}
|
|
NOMINATIM_USER_AGENT: ${NOMINATIM_USER_AGENT}
|
|
NOMINATIM_MIN_DELAY: "1.05"
|
|
NOMINATIM_JITTER: "0.35"
|
|
GEOCODE_MAX_PER_RUN: "5000"
|
|
command: ["python", "src/worker.py"]
|
|
networks:
|
|
- coolify
|
|
labels:
|
|
- traefik.enable=false
|
|
restart: unless-stopped
|
|
|
|
pgadmin:
|
|
image: dpage/pgadmin4:8
|
|
environment:
|
|
PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL}
|
|
PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD}
|
|
PGADMIN_CONFIG_SERVER_MODE: "True"
|
|
volumes:
|
|
- pgadmin_data:/var/lib/pgadmin
|
|
networks:
|
|
- coolify
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.docker.network=coolify
|
|
- traefik.http.routers.bm-pgadmin.rule=Host(`pgadmin.bm.nicolasfryder.ovh`)
|
|
- traefik.http.routers.bm-pgadmin.entrypoints=https
|
|
- traefik.http.routers.bm-pgadmin.tls=true
|
|
- traefik.http.routers.bm-pgadmin.tls.certresolver=letsencrypt
|
|
- traefik.http.services.bm-pgadmin.loadbalancer.server.port=80
|
|
|
|
api:
|
|
build:
|
|
context: apps/api
|
|
environment:
|
|
PORT: "3000"
|
|
DATABASE_URL: ${DATABASE_URL}
|
|
BM_IMPORT_TOKEN: ${BM_IMPORT_TOKEN}
|
|
CORS_ORIGINS: ${CORS_ORIGINS:-https://metalfrom.eu,https://www.metalfrom.eu}
|
|
ADMIN_JWT_SECRET: ${ADMIN_JWT_SECRET}
|
|
ADMIN_SEED_USERNAME: ${ADMIN_SEED_USERNAME}
|
|
ADMIN_SEED_PASSWORD_HASH: ${ADMIN_SEED_PASSWORD_HASH}
|
|
networks:
|
|
- coolify
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.docker.network=coolify
|
|
- traefik.http.routers.bm-api.rule=Host(`bm.nicolasfryder.ovh`)
|
|
- traefik.http.routers.bm-api.entrypoints=https
|
|
- traefik.http.routers.bm-api.tls=true
|
|
- traefik.http.routers.bm-api.tls.certresolver=letsencrypt
|
|
- traefik.http.services.bm-api.loadbalancer.server.port=3000
|
|
|
|
admin:
|
|
build:
|
|
context: apps/admin
|
|
networks:
|
|
- coolify
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.docker.network=coolify
|
|
- traefik.http.routers.bm-admin.rule=Host(`admin.metalfrom.eu`)
|
|
- traefik.http.routers.bm-admin.entrypoints=https
|
|
- traefik.http.routers.bm-admin.tls=true
|
|
- traefik.http.routers.bm-admin.tls.certresolver=letsencrypt
|
|
- traefik.http.services.bm-admin.loadbalancer.server.port=80
|
|
|
|
web:
|
|
build:
|
|
context: apps/web
|
|
networks:
|
|
- coolify
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.docker.network=coolify
|
|
- traefik.http.routers.bm-web.rule=Host(`metalfrom.eu`) || Host(`www.metalfrom.eu`)
|
|
- traefik.http.routers.bm-web.entrypoints=https
|
|
- traefik.http.routers.bm-web.tls=true
|
|
- traefik.http.routers.bm-web.tls.certresolver=letsencrypt
|
|
- traefik.http.routers.bm-web.tls.domains[0].main=metalfrom.eu
|
|
- traefik.http.routers.bm-web.tls.domains[0].sans=www.metalfrom.eu
|
|
- traefik.http.services.bm-web.loadbalancer.server.port=80
|
|
|
|
networks:
|
|
coolify:
|
|
external: true
|
|
name: coolify
|
|
|
|
volumes:
|
|
bm_redis_data:
|
|
pgadmin_data:
|