From 0bd06e03e484a76324aadadb92f90e8d14b71ab6 Mon Sep 17 00:00:00 2001 From: vl Date: Mon, 21 Sep 2026 22:20:36 +0200 Subject: [PATCH] fix: route the panel through a dedicated Traefik entrypoint MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A router priority cannot escape an entrypoint's HTTP→HTTPS redirection: Traefik applies it before routing. The device paths therefore listen on their own port, which never redirects. That turns out to be the better arrangement anyway. Nothing but the four device paths is reachable on 2300, and Traefik guarantees it rather than application code — a stronger property than refusing the other routes after the fact. Requires the matching `device` entrypoint in the shared traefik.yml. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_012cSY9pVhZmJUKNN7wf1Myd --- docker-compose.prod.yml | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index bc64563..7f5237d 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -56,15 +56,21 @@ services: # be revoked from Paramètres → Appareils. The image URL is an unguessable # content hash. # - # The priority beats the entrypoint-wide HTTP→HTTPS redirection, which is - # otherwise applied to everything on :80. Remove this block the day the - # firmware learns the new roots, and set DEVICE_ALLOW_HTTP=false — the - # application refuses plain requests without it. + # It listens on its own entrypoint rather than on :80. Traefik applies an + # entrypoint's HTTP→HTTPS redirection before routing, so no router + # priority can escape it — the port has to be one that never redirects. + # That also makes the restriction structural: nothing but these four + # paths is reachable on 2300, and it is Traefik that guarantees it rather + # than application code. + # + # Requires the matching `device` entrypoint in the shared traefik.yml. + # Remove this block the day the firmware learns the new roots, and set + # DEVICE_ALLOW_HTTP=false — the application refuses plain requests + # without it. traefik.http.routers.horaires-device.rule: >- Host(`${APP_DOMAIN}`) && (PathPrefix(`/api/setup`) || PathPrefix(`/api/display`) || PathPrefix(`/api/log`) || PathPrefix(`/api/device/`)) - traefik.http.routers.horaires-device.entrypoints: web - traefik.http.routers.horaires-device.priority: "2147483647" + traefik.http.routers.horaires-device.entrypoints: device traefik.http.routers.horaires-device.service: horaires backup: