vliaudat/ita-ito-horaires
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: route the panel through a dedicated Traefik entrypoint

Browse Source 
A router priority cannot escape an entrypoint's HTTP→HTTPS redirection:
Traefik applies it before routing. The device paths therefore listen on
their own port, which never redirects.

That turns out to be the better arrangement anyway. Nothing but the four
device paths is reachable on 2300, and Traefik guarantees it rather than
application code — a stronger property than refusing the other routes
after the fact.

Requires the matching `device` entrypoint in the shared traefik.yml.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012cSY9pVhZmJUKNN7wf1Myd
This commit is contained in:
vliaudat
2026-09-21 22:20:36 +02:00
co-authored by Claude Opus 5
parent eae3f89aca
commit 0bd06e03e4
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-compose.prod.yml
+12 -6
View File
@@ -56,15 +56,21 @@ services:
# be revoked from Paramètres → Appareils. The image URL is an unguessable
# content hash.
#
# The priority beats the entrypoint-wide HTTP→HTTPS redirection, which is
# otherwise applied to everything on :80. Remove this block the day the
# firmware learns the new roots, and set DEVICE_ALLOW_HTTP=false — the
# application refuses plain requests without it.
# It listens on its own entrypoint rather than on :80. Traefik applies an
# entrypoint's HTTP→HTTPS redirection before routing, so no router
# priority can escape it — the port has to be one that never redirects.
# That also makes the restriction structural: nothing but these four
# paths is reachable on 2300, and it is Traefik that guarantees it rather
# than application code.
#
# Requires the matching `device` entrypoint in the shared traefik.yml.
# Remove this block the day the firmware learns the new roots, and set
# DEVICE_ALLOW_HTTP=false — the application refuses plain requests
# without it.
traefik.http.routers.horaires-device.rule: >-
Host(`${APP_DOMAIN}`) && (PathPrefix(`/api/setup`) || PathPrefix(`/api/display`)
|| PathPrefix(`/api/log`) || PathPrefix(`/api/device/`))
traefik.http.routers.horaires-device.entrypoints: web
traefik.http.routers.horaires-device.priority: "2147483647"
traefik.http.routers.horaires-device.entrypoints: device
traefik.http.routers.horaires-device.service: horaires
backup: