From 78469021edb4c4084480a6cd5080f47d126d1128 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sat, 27 Jun 2026 17:23:24 +0100
Subject: [PATCH] docker-compose: force ASPNETCORE_URLS=HTTP only in dev per
 service

The runtime services were trying to bind HTTPS even though the
compose file only mapped HTTP ports. Symptom on first start:

  fail: Microsoft.Extensions.Hosting.Internal.Host[11]
        Hosting failed to start
        System.InvalidOperationException: Unable to configure
        HTTPS endpoint. No server certificate was specified,
        and the default developer certificate could not be found
        or is out of date.

The root cause is appsettings-org.Development.json which sets
  Site.Authority = https://localhost:5001
combined with Kestrel's auto-detection of https_port from the
listening URL. ASP.NET Core 9 promotes any 'Authority' / 'Url'
property to a Kestrel binding target unless ASPNETCORE_URLS is
explicitly set.

Fix: add an environment: block on each runtime service pinning
ASPNETCORE_URLS to the HTTP-only form, plus empty
ASPNETCORE_HTTPS_PORT to suppress auto-detection. This forces
HTTP-only binding on the 'machine vierge' criterion of Jalon 0,
where no cert is available.

For production HTTPS, the existing commented # - '5001:5001' /
# volumes: /etc/letsencrypt blocks stay the way to enable it:
uncomment the port, uncomment the volume, and add a
Kestrel:Endpoints:Https block in appsettings-org.json that
points at the Let's Encrypt cert files.
---
 docker-compose.yaml | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/docker-compose.yaml b/docker-compose.yaml
index a91492f8..d8e46871 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -30,9 +30,18 @@ services:
       secrets:
         - yavsc_appsettings
     env_file: .env
+    # ASPNETCORE_URLS forcé à HTTP seul en dev. Le HTTPS (port 5001)
+    # est désactivé par défaut parce qu'aucun certificat n'est
+    # disponible sur la machine hôte du critère Jalon 0 ; pour
+    # l'activer en prod, décommenter le port 5001, monter
+    # /etc/letsencrypt en volume (template commenté ci-dessous), et
+    # ajouter Kestrel:Endpoints:Https dans appsettings-org.json.
+    environment:
+      ASPNETCORE_URLS: "http://+:5000"
+      ASPNETCORE_HTTPS_PORT: ""
     ports:
       - "5000:5000"
-      # - "5001:5001"   # HTTPS : décommenter avec le volume letsencrypt
+      # - "5001:5001"   # HTTPS : activer avec le volume letsencrypt ci-dessous
     depends_on:
       db:
         condition: service_healthy
@@ -53,9 +62,14 @@ services:
       secrets:
         - yavsc_appsettings
     env_file: .env
+    # ASPNETCORE_URLS forcé à HTTP seul en dev. Voir commentaire détaillé
+    # dans le service `web` ci-dessus ; même logique pour l'API.
+    environment:
+      ASPNETCORE_URLS: "http://+:5002"
+      ASPNETCORE_HTTPS_PORT: ""
     ports:
       - "5002:5002"
-      # - "5003:5003"   # HTTPS : décommenter avec le volume letsencrypt
+      # - "5003:5003"   # HTTPS : activer avec le volume letsencrypt ci-dessous
     depends_on:
       db:
         condition: service_healthy
@@ -78,9 +92,14 @@ services:
       secrets:
         - yavsc_appsettings
     env_file: .env
+    # ASPNETCORE_URLS forcé à HTTP seul en dev. Voir commentaire détaillé
+    # dans le service `web` ci-dessus ; même logique pour les blogs.
+    environment:
+      ASPNETCORE_URLS: "http://+:5004"
+      ASPNETCORE_HTTPS_PORT: ""
     ports:
       - "5004:5004"
-      # - "5005:5005"   # HTTPS : décommenter avec le volume letsencrypt
+      # - "5005:5005"   # HTTPS : activer avec le volume letsencrypt ci-dessous
     depends_on:
       db:
         condition: service_healthy