Paul Schneider
78469021ed
The runtime services were trying to bind HTTPS even though the
compose file only mapped HTTP ports. Symptom on first start:
fail: Microsoft.Extensions.Hosting.Internal.Host[11]
Hosting failed to start
System.InvalidOperationException: Unable to configure
HTTPS endpoint. No server certificate was specified,
and the default developer certificate could not be found
or is out of date.
The root cause is appsettings-org.Development.json which sets
Site.Authority = https://localhost:5001
combined with Kestrel's auto-detection of https_port from the
listening URL. ASP.NET Core 9 promotes any 'Authority' / 'Url'
property to a Kestrel binding target unless ASPNETCORE_URLS is
explicitly set.
Fix: add an environment: block on each runtime service pinning
ASPNETCORE_URLS to the HTTP-only form, plus empty
ASPNETCORE_HTTPS_PORT to suppress auto-detection. This forces
HTTP-only binding on the 'machine vierge' criterion of Jalon 0,
where no cert is available.
For production HTTPS, the existing commented # - '5001:5001' /
# volumes: /etc/letsencrypt blocks stay the way to enable it:
uncomment the port, uncomment the volume, and add a
Kestrel:Endpoints:Https block in appsettings-org.json that
points at the Let's Encrypt cert files.
128 lines
3.9 KiB
YAML
128 lines
3.9 KiB
YAML
services:
|
|
# ---------- PostgreSQL ----------
|
|
db:
|
|
image: postgres:16
|
|
env_file: .env
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
networks:
|
|
- yavsc-internal
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 20s
|
|
|
|
# ---------- Yavsc.Org (front web) ----------
|
|
# Construit depuis le stage `web-runtime` du Dockerfile multi-stage.
|
|
# ASPNETCORE_URLS=http://+:5000 (HTTP seul en dev). Pour activer
|
|
# HTTPS en prod, décommenter le port 5001, monter /etc/letsencrypt
|
|
# en volume, et configurer Kestrel:Certificates dans
|
|
# appsettings-org.json (cf. CONTRIBUTING.md).
|
|
web:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
target: web-runtime
|
|
args:
|
|
BUILD_ENV_TAG: debian12-dotnet10-android36-v1
|
|
secrets:
|
|
- yavsc_appsettings
|
|
env_file: .env
|
|
# ASPNETCORE_URLS forcé à HTTP seul en dev. Le HTTPS (port 5001)
|
|
# est désactivé par défaut parce qu'aucun certificat n'est
|
|
# disponible sur la machine hôte du critère Jalon 0 ; pour
|
|
# l'activer en prod, décommenter le port 5001, monter
|
|
# /etc/letsencrypt en volume (template commenté ci-dessous), et
|
|
# ajouter Kestrel:Endpoints:Https dans appsettings-org.json.
|
|
environment:
|
|
ASPNETCORE_URLS: "http://+:5000"
|
|
ASPNETCORE_HTTPS_PORT: ""
|
|
ports:
|
|
- "5000:5000"
|
|
# - "5001:5001" # HTTPS : activer avec le volume letsencrypt ci-dessous
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
networks:
|
|
- yavsc-internal
|
|
- yavsc-public
|
|
# volumes:
|
|
# - /etc/letsencrypt:/etc/letsencrypt:ro
|
|
|
|
# ---------- Yavsc.Api (API REST principale) ----------
|
|
api:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
target: api-runtime
|
|
args:
|
|
BUILD_ENV_TAG: debian12-dotnet10-android36-v1
|
|
secrets:
|
|
- yavsc_appsettings
|
|
env_file: .env
|
|
# ASPNETCORE_URLS forcé à HTTP seul en dev. Voir commentaire détaillé
|
|
# dans le service `web` ci-dessus ; même logique pour l'API.
|
|
environment:
|
|
ASPNETCORE_URLS: "http://+:5002"
|
|
ASPNETCORE_HTTPS_PORT: ""
|
|
ports:
|
|
- "5002:5002"
|
|
# - "5003:5003" # HTTPS : activer avec le volume letsencrypt ci-dessous
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
networks:
|
|
- yavsc-internal
|
|
- yavsc-public
|
|
# volumes:
|
|
# - /etc/letsencrypt:/etc/letsencrypt:ro
|
|
|
|
# ---------- Yavsc.Blogs (backend API headless des blogs) ----------
|
|
# Déployé sur un sous-domaine dédié en production (ex: blogs.yavsc.example).
|
|
# cf. doc/architecture/decoupage-organisation.md.
|
|
blogs:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
target: blogs-runtime
|
|
args:
|
|
BUILD_ENV_TAG: debian12-dotnet10-android36-v1
|
|
secrets:
|
|
- yavsc_appsettings
|
|
env_file: .env
|
|
# ASPNETCORE_URLS forcé à HTTP seul en dev. Voir commentaire détaillé
|
|
# dans le service `web` ci-dessus ; même logique pour les blogs.
|
|
environment:
|
|
ASPNETCORE_URLS: "http://+:5004"
|
|
ASPNETCORE_HTTPS_PORT: ""
|
|
ports:
|
|
- "5004:5004"
|
|
# - "5005:5005" # HTTPS : activer avec le volume letsencrypt ci-dessous
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
networks:
|
|
- yavsc-internal
|
|
- yavsc-public
|
|
# volumes:
|
|
# - /etc/letsencrypt:/etc/letsencrypt:ro
|
|
|
|
volumes:
|
|
pgdata:
|
|
|
|
networks:
|
|
# Réseau interne : seuls les services Yavsc et la base s'y voient.
|
|
yavsc-internal:
|
|
internal: false
|
|
# Réseau public : exposé à l'hôte via les ports mappés.
|
|
yavsc-public:
|
|
|
|
secrets:
|
|
# appsettings-org.json vit à src/Yavsc.Org/appsettings-org.json
|
|
# (non commité). BuildKit le monte dans
|
|
# /run/secrets/yavsc_appsettings pendant le build de chaque image
|
|
# runtime via le Dockerfile multi-stage.
|
|
yavsc_appsettings:
|
|
file: ./src/Yavsc.Org/appsettings-org.json
|