refactor: move traefik configuration to docker-compose files via labels

penpot/compose.yaml

@@ -26,12 +26,13 @@
 x-flags: &penpot-flags
   PENPOT_FLAGS: disable-email-verification enable-prepl-server disable-secure-session-cookies login-with-github
 
-x-uri: &penpot-public-uri
+x-uri: &penpot-public-urш
   PENPOT_PUBLIC_URI: http://localhost:9001
 
-x-body-size: &penpot-http-body-size
+x-body-size:
   # Max body size (30MiB); Used for plain requests, should never be
   # greater than multi-part size
+  &penpot-http-body-size
   PENPOT_HTTP_SERVER_MAX_BODY_SIZE: 31457280
 
   # Max multipart body size (350MiB)
@@ -56,7 +57,7 @@ volumes:
   penpot_postgres_v15:
   penpot_assets:
   penpot_traefik:
-  # penpot_minio:
+    # penpot_minio:
 
 services:
   ## Traefik service declaration example. Consider using it if you are going to expose
@@ -99,19 +100,34 @@ services:
       - penpot
       - traefik-proxy
 
-    # labels:
-      # - "traefik.enable=true"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
 
-      # ## HTTPS: example of labels for the case where penpot will be exposed to the
-      # ## internet with HTTPS using traefik.
+      # Prod Router
+      - "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)"
+      - "traefik.http.routers.penpot.entrypoints=websecure"
+      - "traefik.http.routers.penpot.middlewares=security-headers"
+      - "traefik.http.routers.penpot.service=penpot"
+      - "traefik.http.routers.penpot.tls=true"
+      - "traefik.http.services.penpot.loadbalancer.server.port=8080"
 
-      # - "traefik.http.routers.penpot-https.rule=Host(`<DOMAIN_NAME>`)"
-      # - "traefik.http.routers.penpot-https.entrypoints=websecure"
-      # - "traefik.http.routers.penpot-https.tls.certresolver=letsencrypt"
-      # - "traefik.http.routers.penpot-https.tls=true"
+      # Local Router
+      - "traefik.http.routers.penpot-local.rule=Host(`penpot.workstation.local`) || Host(`penpot.local`)"
+      - "traefik.http.routers.penpot-local.entrypoints=websecure"
+      - "traefik.http.routers.penpot-local.middlewares=security-headers"
+      - "traefik.http.routers.penpot-local.service=penpot"
+      - "traefik.http.routers.penpot-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.penpot-dev.rule=Host(`penpot.gigaforust.local`)"
+      - "traefik.http.routers.penpot-dev.entrypoints=websecure"
+      - "traefik.http.routers.penpot-dev.middlewares=security-headers"
+      - "traefik.http.routers.penpot-dev.service=penpot"
+      - "traefik.http.routers.penpot-dev.tls=true"
 
     environment:
-      << : [*penpot-flags, *penpot-http-body-size]
+      <<: [ *penpot-flags, *penpot-http-body-size ]
 
   penpot-backend:
     image: "penpotapp/backend:${PENPOT_VERSION:-latest}"
@@ -132,7 +148,7 @@ services:
     ## Configuration envronment variables for the backend container.
 
     environment:
-      << : [*penpot-flags, *penpot-public-uri, *penpot-http-body-size, *penpot-secret-key]
+      <<: [ *penpot-flags, *penpot-public-uri, *penpot-http-body-size, *penpot-secret-key ]
 
       ## The PREPL host. Mainly used for external programatic access to penpot backend
       ## (example: admin). By default it will listen on `localhost` but if you are going to use
@@ -174,7 +190,6 @@ services:
 
       PENPOT_TELEMETRY_ENABLED: true
       PENPOT_TELEMETRY_REFERER: compose
-
       # PENPOT_SMTP_DEFAULT_FROM: no-reply@example.com
       # PENPOT_SMTP_DEFAULT_REPLY_TO: no-reply@example.com
       # PENPOT_SMTP_HOST: penpot-mailcatch
@@ -196,7 +211,7 @@ services:
       - penpot
 
     environment:
-      << : [*penpot-secret-key]
+      <<: [ *penpot-secret-key ]
       # Don't touch it; this uses an internal docker network to
       # communicate with the frontend.
       PENPOT_PUBLIC_URI: http://penpot-frontend:8080
@@ -210,7 +225,7 @@ services:
     stop_signal: SIGINT
 
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U penpot"]
+      test: [ "CMD-SHELL", "pg_isready -U penpot" ]
       interval: 2s
       timeout: 10s
       retries: 5
@@ -233,7 +248,7 @@ services:
     restart: always
 
     healthcheck:
-      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
+      test: [ "CMD-SHELL", "valkey-cli ping | grep PONG" ]
       interval: 1s
       timeout: 3s
       retries: 5
@@ -246,7 +261,6 @@ services:
       # You can increase the max memory size if you have sufficient resources,
       # although this should not be necessary.
       - VALKEY_EXTRA_FLAGS=--maxmemory 128mb --maxmemory-policy volatile-lfu
-
   ## A mailcatch service, used as temporal SMTP server. You can access via HTTP to the
   ## port 1080 for read all emails the penpot platform has sent. Should be only used as a
   ## temporal solution while no real SMTP provider is configured.