Make explicit what was implicit: 'docker compose up' is not
expected to start everything on a bare host. Yavsc.Org (web)
requires an HTTPS signing certificate for IdentityServer8 in
Production mode, and the volume mount /etc/letsencrypt:/etc/letsencrypt:ro
is the documented way to supply it.
Two related changes:
- CONTRIBUTING.md, 'docker compose up' section: spell out that
db + api + blogs start cleanly on a bare host, web fails with
the documented IdentityServer error, and that the difference
between 'vierge' and 'configured' is exactly the cert volume.
- docker-compose.yaml, web service: expand the commented volumes
block to point at the same error message and reference the
'HTTPS en production' section in CONTRIBUTING.md, so an
operator reading the compose file knows what to uncomment
and where to look.
Update the 'HTTPS en production' section to match the new
docker-compose layout:
- explain why the per-service environment: block pinning
ASPNETCORE_URLS to HTTP-only and clearing ASPNETCORE_HTTPS_PORT
is required (appsettings-org.Development.json sets
Site.Authority to https://localhost:5001, which makes Kestrel
auto-detect an HTTPS endpoint and crash without a cert);
- give the exact 5-step recipe to enable HTTPS in production:
switch ASPNETCORE_URLS to a double-bind form, uncomment the
HTTPS port, uncomment the /etc/letsencrypt volume mount, add a
Kestrel:Endpoints:Https block in appsettings-org.json pointing
at the Let's Encrypt fullchain.pem + privkey.pem, and rebuild
the runtime image (since appsettings are baked via BuildKit
secret mount).
The previous section described three separate Dockerfile.runtime*
files, one per runtime service. After the multi-stage refactor
of Dockerfile (6f975f87) and the deletion of those three files
(4fc0ddb6), the section was stale.
Rewrite it to describe the new structure:
- one Dockerfile with multiple stages (build-env, publish-org /
api / blogs, web-runtime / api-runtime / blogs-runtime);
- Dockerfile.backend kept for the production image workflow;
- the BUILD_ENV_TAG ARG that propagates the build-env image
pin across the three locations where it has to be updated.
Update the 'Bumper l'image de build' section to point at the
new ARG location (was: a list of Dockerfile.runtime* files).
Update the isolated-build example to use --target web-runtime
instead of -f Dockerfile.runtime.
Also fix a structural regression introduced while editing: a
duplicate '## Conteneurisation' header and a missing
'## Sessions DDD' transition — both restored here.
Add a 'Conteneurisation' section covering:
- the three image families (build env, runtime per project);
- the yavsc-build-env pin on Docker Hub and the
dotnet-android-build-image sibling repo;
- the docker compose up flow (4 services, healthcheck-gated);
- how appsettings-org.json is injected via BuildKit secret mount
(file remains on the host, never lands in a layer);
- the HTTPS-in-prod recipe (uncomment ports 5001/5003/5005 +
/etc/letsencrypt volume + Kestrel:Certificates in
appsettings-org.json + ASPNETCORE_URLS override);
- the bump procedure when the build-env image is rebuilt
(rebuild + push with new tag, then update Dockerfile,
Dockerfile.backend, the three Dockerfile.runtime*, and
docker-compose.yaml in lockstep);
- an isolated build/run check for one runtime image.
Also corrects an outdated mention of 'build.args.BUILD_ENV_IMAGE'
(removed in the previous commit) — the lockstep list now points
at the docker-compose 'build' blocks instead.
Covers the last missing piece of Jalon 0 in ROADMAP.md:
'CONTRIBUTING.md (build, tests, conventions, DDD sessions)'
Sections:
- prerequisites (.NET 10, PostgreSQL, Node for Avalonia Browser,
Android SDK for PostIt.Android)
- first build + how to start Yavsc.Org in Development
- how to run the test suite
- code conventions (delegated to .editorconfig + a few extras)
- branches and commit messages (trunk-based, scoped imperatives)
- link to architecture/decoupage-organisation.md for the
per-project layout
- DDD sessions (link to doc/ddd-exploration-*.md + ROADMAP.md)
- security reminders (no secrets in git, user-secrets / env vars)
- pointer to GitHub issues + new DDD sessions for design Qs
