From 4fecb4789760fae0e6ba09d71a017a005cfd8af3 Mon Sep 17 00:00:00 2001 From: Tyler Adam Martinez Date: Tue, 18 Aug 2026 18:24:20 -0500 Subject: [PATCH 1/2] fix(docker-compose): stop exposing Traefik's insecure dashboard/API publicly --- docker-compose.development.yml | 6 ------ docker-compose.production.yml | 6 ------ 2 files changed, 12 deletions(-) diff --git a/docker-compose.development.yml b/docker-compose.development.yml index ad06bc27..ceea3c74 100644 --- a/docker-compose.development.yml +++ b/docker-compose.development.yml @@ -12,8 +12,6 @@ services: VITE_API_URL: https://metermanager-dev.pvacd.com/api/v1 env_file: - ./frontend/.env.devserver - ports: - - "5173:80" depends_on: - api - traefik @@ -63,8 +61,6 @@ services: --port 8000 --proxy-headers --root-path /api/v1 - ports: - - "8000:8000" volumes: - ./api:/app/api depends_on: @@ -90,7 +86,6 @@ services: traefik: image: "traefik:v2.11" command: - - "--api.insecure=true" - "--providers.docker=true" - "--providers.docker.exposedbydefault=false" - "--entrypoints.web.address=:80" @@ -106,7 +101,6 @@ services: ports: - "80:80" - "443:443" - - "8080:8080" volumes: - "/var/run/docker.sock:/var/run/docker.sock:ro" - ./letsencrypt:/letsencrypt diff --git a/docker-compose.production.yml b/docker-compose.production.yml index e627ca55..17c67148 100644 --- a/docker-compose.production.yml +++ b/docker-compose.production.yml @@ -12,8 +12,6 @@ services: VITE_API_URL: https://metermanager.pvacd.com/api/v1 env_file: - ./frontend/.env.production - ports: - - "5173:80" depends_on: - api - traefik @@ -63,8 +61,6 @@ services: --port 8000 --proxy-headers --root-path /api/v1 - ports: - - "8000:8000" volumes: - ./api:/app/api depends_on: @@ -90,7 +86,6 @@ services: traefik: image: "traefik:v2.11" command: - - "--api.insecure=true" - "--providers.docker=true" - "--providers.docker.exposedbydefault=false" - "--entrypoints.web.address=:80" @@ -106,7 +101,6 @@ services: ports: - "80:80" - "443:443" - - "8080:8080" volumes: - "/var/run/docker.sock:/var/run/docker.sock:ro" - ./letsencrypt:/letsencrypt From 9898a0952a97632f77bf3e63c5e437637cde50f2 Mon Sep 17 00:00:00 2001 From: Tyler Adam Martinez Date: Tue, 18 Aug 2026 18:42:03 -0500 Subject: [PATCH 2/2] fix(docker-compose): add explicit routing for frontend & backend services --- docker-compose.development.yml | 16 +++++++--------- docker-compose.production.yml | 16 +++++++--------- 2 files changed, 14 insertions(+), 18 deletions(-) diff --git a/docker-compose.development.yml b/docker-compose.development.yml index ceea3c74..4c1983fe 100644 --- a/docker-compose.development.yml +++ b/docker-compose.development.yml @@ -20,7 +20,7 @@ services: # Current PVACD hostname - "traefik.http.routers.frontend.rule=Host(`metermanager-dev.pvacd.com`)" - - "traefik.http.routers.frontend.entrypoints=websecure,web" + - "traefik.http.routers.frontend.entrypoints=websecure" - "traefik.http.routers.frontend.tls=true" - "traefik.http.routers.frontend.tls.certresolver=myresolver" @@ -36,9 +36,8 @@ services: - "traefik.http.middlewares.pvacd-redirect.redirectregex.replacement=https://metermanager-dev.pvacd.com/$${1}" - "traefik.http.middlewares.pvacd-redirect.redirectregex.permanent=true" - # - "traefik.http.routers.frontend-insecure.middlewares=force-secure" - # - "traefik.http.middlewares.force-secure.redirectscheme.scheme=https" - # - "traefik.http.middlewares.force-secure.redirectscheme.permanent=true" + - "traefik.http.routers.frontend.priority=10" + - "traefik.http.services.frontend.loadbalancer.server.port=80" api: build: @@ -69,19 +68,18 @@ services: - ./api/.env_devserver labels: - "traefik.enable=true" + - "traefik.http.routers.api.rule=Host(`metermanager-dev.pvacd.com`) && PathPrefix(`/api/v1`)" - "traefik.http.routers.api.entrypoints=websecure" - "traefik.http.routers.api.tls=true" - "traefik.http.routers.api.tls.certresolver=myresolver" + - "traefik.http.routers.api.priority=100" + - "traefik.http.routers.api.middlewares=api-sp" - "traefik.http.middlewares.api-sp.stripprefix.prefixes=/api/v1" - "traefik.http.middlewares.api-sp.stripprefix.forceSlash=false" - - "traefik.http.routers.api-insecure.rule=Host(`metermanager-dev.pvacd.com`) && PathPrefix(`/api/v1`)" - - "traefik.http.routers.api-insecure.entrypoints=web" - # - "traefik.http.routers.api-insecure.middlewares=force-secure" - # - "traefik.http.middlewares.force-secure.redirectscheme.scheme=https" - # - "traefik.http.middlewares.force-secure.redirectscheme.permanent=true" + - "traefik.http.services.api.loadbalancer.server.port=8000" traefik: image: "traefik:v2.11" diff --git a/docker-compose.production.yml b/docker-compose.production.yml index 17c67148..1f4bf8d9 100644 --- a/docker-compose.production.yml +++ b/docker-compose.production.yml @@ -20,7 +20,7 @@ services: # Current PVACD hostname - "traefik.http.routers.frontend.rule=Host(`metermanager.pvacd.com`)" - - "traefik.http.routers.frontend.entrypoints=websecure,web" + - "traefik.http.routers.frontend.entrypoints=websecure" - "traefik.http.routers.frontend.tls=true" - "traefik.http.routers.frontend.tls.certresolver=myresolver" @@ -36,9 +36,8 @@ services: - "traefik.http.middlewares.pvacd-redirect.redirectregex.replacement=https://metermanager.pvacd.com/$${1}" - "traefik.http.middlewares.pvacd-redirect.redirectregex.permanent=true" - # - "traefik.http.routers.frontend-insecure.middlewares=force-secure" - # - "traefik.http.middlewares.force-secure.redirectscheme.scheme=https" - # - "traefik.http.middlewares.force-secure.redirectscheme.permanent=true" + - "traefik.http.routers.frontend.priority=10" + - "traefik.http.services.frontend.loadbalancer.server.port=80" api: build: @@ -69,19 +68,18 @@ services: - ./api/.env_production labels: - "traefik.enable=true" + - "traefik.http.routers.api.rule=Host(`metermanager.pvacd.com`) && PathPrefix(`/api/v1`)" - "traefik.http.routers.api.entrypoints=websecure" - "traefik.http.routers.api.tls=true" - "traefik.http.routers.api.tls.certresolver=myresolver" + - "traefik.http.routers.api.priority=100" + - "traefik.http.routers.api.middlewares=api-sp" - "traefik.http.middlewares.api-sp.stripprefix.prefixes=/api/v1" - "traefik.http.middlewares.api-sp.stripprefix.forceSlash=false" - - "traefik.http.routers.api-insecure.rule=Host(`metermanager.pvacd.com`) && PathPrefix(`/api/v1`)" - - "traefik.http.routers.api-insecure.entrypoints=web" - # - "traefik.http.routers.api-insecure.middlewares=force-secure" - # - "traefik.http.middlewares.force-secure.redirectscheme.scheme=https" - # - "traefik.http.middlewares.force-secure.redirectscheme.permanent=true" + - "traefik.http.services.api.loadbalancer.server.port=8000" traefik: image: "traefik:v2.11"