chore: add helm chart and docker

2026-07-27 21:06:11 +02:00
parent 23a4f280c6
commit 356604fba4
46 changed files with 1390 additions and 0 deletions
@@ -0,0 +1,84 @@
+---
+# HTTP → HTTPS redirect
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gestion-http
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "gestion-traefik.labels" . | nindent 4 }}
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`{{ .Values.domain }}`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: noop@internal
+          kind: TraefikService
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: {{ .Release.Namespace }}
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+# HTTPS — routes principales
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gestion-https
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "gestion-traefik.labels" . | nindent 4 }}
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    # API backend — WAF + headers + rate limit
+    - match: Host(`{{ .Values.domain }}`) && (PathPrefix(`/api/`) || PathPrefix(`/webhook/`))
+      kind: Rule
+      priority: 20
+      middlewares:
+        - name: waf-chain
+      services:
+        - name: {{ .Values.backend.serviceName }}
+          namespace: {{ .Values.servicesNamespace }}
+          port: {{ .Values.backend.servicePort }}
+
+    # Fichiers uploadés — WAF désactivé dans les règles Coraza pour ce path
+    - match: Host(`{{ .Values.domain }}`) && PathPrefix(`/uploads/`)
+      kind: Rule
+      priority: 15
+      middlewares:
+        - name: security-headers
+      services:
+        - name: {{ .Values.backend.serviceName }}
+          namespace: {{ .Values.servicesNamespace }}
+          port: {{ .Values.backend.servicePort }}
+
+    # Frontend SPA — WAF + headers + rate limit
+    - match: Host(`{{ .Values.domain }}`)
+      kind: Rule
+      priority: 1
+      middlewares:
+        - name: waf-chain
+      services:
+        - name: {{ .Values.frontend.serviceName }}
+          namespace: {{ .Values.servicesNamespace }}
+          port: {{ .Values.frontend.servicePort }}
+
+  tls:
+    {{- if eq .Values.tls.mode "letsencrypt" }}
+    certResolver: letsencrypt
+    {{- else }}
+    secretName: {{ .Values.tls.secretName }}
+    {{- end }}
+    domains:
+      - main: {{ .Values.domain }}