chore: add waf

docker/docker-compose-prod.yml

@@ -6,6 +6,7 @@ services:
         build:
             context: ..
             dockerfile: docker/backend/Dockerfile
+            target: runtime
         container_name: gestion-backend
         restart: unless-stopped
         environment:
@@ -26,8 +27,7 @@ services:
             - TOMTOM_API_KEY=${TOMTOM_API_KEY}
             - API_PORT=${API_PORT:-8080}
         volumes:
-            # ✅ Volume partagé pour les uploads (même volume que le frontend)
-            - frontend_uploads:/app/uploads
+            - backend_uploads:/app/uploads
         networks:
             - gestion-network
         depends_on:
@@ -37,28 +37,29 @@ services:
                 condition: service_healthy
 
     # =========================================================
-    # Frontend Nginx + ModSecurity
+    # WAF (Nginx + ModSecurity)
     # =========================================================
-    frontend:
+    waf:
         build:
             context: ..
-            dockerfile: docker/frontend/Dockerfile
-        container_name: gestion-frontend
+            dockerfile: docker/backend/Dockerfile
+            target: waf
+        container_name: gestion-waf
         restart: unless-stopped
         environment:
             - DISABLE_MODSEC_ENV_SUBST=true
             - PARANOIA=2
             - ANOMALY_INBOUND=5
             - ANOMALY_OUTBOUND=4
-            - BACKEND_HOST=backend
-            - BACKEND_PORT=${API_PORT:-8080}
         ports:
             - "80:80"
+            - "443:443"
         volumes:
-            # ✅ Volume partagé pour les uploads (accessible via nginx)
-            - frontend_uploads:/usr/share/nginx/html/uploads
+            - backend_uploads:/usr/share/nginx/html/uploads:ro
         networks:
             - gestion-network
+        depends_on:
+            - backend
 
     # =========================================================
     # PostgreSQL
@@ -132,6 +133,5 @@ volumes:
         driver: local
     redis_data:
         driver: local
-    # ✅ Volume partagé entre backend et frontend
-    frontend_uploads:
+    backend_uploads:
         driver: local