From e8e6fac420e3d8f05fe5fbe8d2f5a07112536c92 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Mon, 24 Aug 2026 21:09:22 +0200 Subject: [PATCH] fix(deploy): restore proxy compatibility port --- docker-compose.yml | 5 +++++ docs/verification/sec-002-ingress-compose.md | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 5f3b484..3928f06 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -125,6 +125,11 @@ services: - NEXT_PUBLIC_API_BASE_URL=${NEXT_PUBLIC_API_BASE_URL} expose: - "80" + # Compatibility ingress for the current production reverse proxy, which + # targets the host's port 3000 rather than Docker service discovery. Keep + # this until the operator-owned proxy is migrated onto jobtracker_shared. + ports: + - "3000:80" environment: - APP_PUBLIC_BASE_URL=${APP_PUBLIC_BASE_URL} depends_on: diff --git a/docs/verification/sec-002-ingress-compose.md b/docs/verification/sec-002-ingress-compose.md index 39de697..62aca19 100644 --- a/docs/verification/sec-002-ingress-compose.md +++ b/docs/verification/sec-002-ingress-compose.md @@ -6,7 +6,7 @@ Status: `VERIFIED LOCALLY`; operator Traefik and production checks remain. ## Implemented boundary - Production automation explicitly selects `docker-compose.yml`; the auto-loaded override was replaced by explicitly selected `docker-compose.dev.yml`. -- Base Compose publishes no frontend, backend, ai-service, or bundled-Ollama host port. Development adds 3000, 5202, and profile-scoped 11434. +- Base Compose retains the frontend's production compatibility port 3000 because the operator-owned reverse proxy still targets that host port. Backend, ai-service, and bundled Ollama remain unpublished; development additionally exposes backend 5202 and profile-scoped Ollama 11434. - Nginx and backend communicate over an internal dedicated CIDR; the backend accepts exactly one forwarded hop only from that CIDR. - Nginx derives its application server name from `APP_PUBLIC_BASE_URL`, rejects other Hosts except `/health`, and preserves Traefik's replaced proto/client headers rather than substituting internal HTTP. - Deploy preflight requires and validates the canonical origin and dedicated proxy CIDR. CI post-deploy commands use the production Compose file explicitly. @@ -31,7 +31,7 @@ No image was pulled and no production or persistent service was changed. Ephemer ## Limitations and production gates -- No Traefik configuration exists in this repository. Verify its exact `Host()` rule, TLS route, replacement of forwarding headers, selected Docker network, and hostile-Host rejection on the operator host. +- No Traefik configuration exists in this repository. Production verification proved it still targets host port 3000, so that compatibility ingress remains. Migrate Traefik onto `jobtracker_shared`, verify its exact `Host()` rule/TLS/header handling, then remove the host port in a coordinated release. - `WEB_PROXY_SUBNET` must be chosen after production Docker-network inventory. Deploys recover a missing value from a uniquely labelled existing Compose `web_proxy` network. On its first creation, the documented `172.31.250.0/29` candidate is accepted only after a complete Docker network inventory proves it does not overlap; unreadable or overlapping inventory remains fail-closed. - Host firewall and `docker ps`/published-port state are unverified. - The exact `nginx:1.29.8-alpine` base image was not installed locally. Syntax was checked with the existing local nginx frontend image; approved CI must build the pinned Dockerfile.