85 lines
2.4 KiB
Docker
85 lines
2.4 KiB
Docker
FROM golang:1.24-alpine AS builder
|
|
WORKDIR /app
|
|
|
|
# Installer les dépendances système
|
|
RUN apk add --no-cache git ca-certificates tzdata gcc musl-dev
|
|
|
|
# Copier go mod files
|
|
COPY backend/gestion/go.mod backend/gestion/go.sum ./
|
|
|
|
# Configurer Go et télécharger les dépendances
|
|
ENV GOPROXY=https://proxy.golang.org,direct
|
|
ENV GOSUMDB=sum.golang.org
|
|
ENV CGO_ENABLED=0
|
|
|
|
# Télécharger les dépendances
|
|
RUN go mod download
|
|
|
|
# Copier tout le code source
|
|
COPY backend/gestion/ .
|
|
|
|
# Build le binaire
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
|
|
-ldflags="-w -s -X main.Version=1.0.0 -X main.BuildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
|
|
-o /app/server .
|
|
|
|
# =========================================================
|
|
# Stage 2: Runtime
|
|
# =========================================================
|
|
FROM alpine:latest AS runtime
|
|
|
|
# Installer les dépendances runtime
|
|
RUN apk --no-cache add ca-certificates tzdata wget
|
|
|
|
# Créer l'utilisateur avec UID/GID fixes
|
|
RUN addgroup -g 101 app && adduser -u 101 -S app -G app
|
|
|
|
|
|
WORKDIR /app
|
|
|
|
# Copier le binaire et les fichiers nécessaires
|
|
COPY --from=builder /app/server .
|
|
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
|
|
|
|
# Copier l'entrypoint
|
|
COPY docker/backend/entrypoint.sh .
|
|
RUN chmod +x entrypoint.sh
|
|
|
|
# ✅ Créer le dossier uploads et donner ownership AVANT de changer d'utilisateur
|
|
RUN mkdir -p /app/uploads/images /app/uploads/videos && \
|
|
chown -R app:app /app
|
|
|
|
# Passer à l'utilisateur non-root
|
|
USER app
|
|
|
|
EXPOSE 8080
|
|
|
|
ENTRYPOINT ["./entrypoint.sh"]
|
|
|
|
# =========================================================
|
|
# Stage 3: WAF (Nginx + ModSecurity)
|
|
# =========================================================
|
|
FROM owasp/modsecurity-crs:nginx-alpine AS waf
|
|
|
|
USER root
|
|
|
|
# Logs ModSecurity
|
|
RUN mkdir -p /var/log/modsec && chown -R nginx:nginx /var/log/modsec
|
|
|
|
# Certificats SSL
|
|
RUN mkdir -p /etc/nginx/certs
|
|
COPY docker/backend/certs/cert.pem /etc/nginx/certs/cert.pem
|
|
COPY docker/backend/certs/key.pem /etc/nginx/certs/key.pem
|
|
RUN chown -R nginx:nginx /etc/nginx/certs && chmod 640 /etc/nginx/certs/key.pem
|
|
|
|
COPY docker/backend/nginx.conf /etc/nginx/conf.d/app.conf
|
|
COPY docker/backend/custom-rules.conf /etc/nginx/modsec/custom-rules.conf
|
|
RUN echo "Include /etc/nginx/modsec/custom-rules.conf" > /etc/nginx/modsec/custom-includes.conf
|
|
|
|
RUN rm -f /etc/nginx/templates/conf.d/default.conf.template || true
|
|
RUN chown -R nginx:nginx /usr/share/nginx/html
|
|
|
|
USER nginx
|
|
EXPOSE 80 443
|
|
CMD ["nginx", "-g", "daemon off;"]
|