ci: remplace Traefik par Fabio/Consul (pattern sonic)

- docker-compose.yml : labels SERVICE_* Registrator, réseau sonic external, container_name explicite, name COMPOSE_PROJECT_NAME - pipeline : APP_DOMAIN (au lieu de DOMAIN), ACME sonic-acme-1 pour TLS, test-deploy sans suffixe -1 (container_name fixe) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix: sync package-lock.json avec package.json
2026-03-23 15:25:06 +01:00 · 2026-03-23 15:02:47 +01:00 · 2026-03-23 14:59:42 +01:00 · 2026-03-23 14:41:32 +01:00 · 2026-03-23 14:32:04 +01:00 · 2026-03-23 14:25:24 +01:00
3 changed files with 243 additions and 96 deletions
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -1,75 +1,225 @@
 when:
-  branch: main
-  event: push
+  - branch: main
+    event: push

 steps:
-  test-backend:
+
+  - name: security-check
+    image: alpine:3.20
+    commands:
+      - |
+        if [ -f .env ]; then
+          echo "ERREUR: .env ne doit pas etre commite dans le depot"
+          exit 1
+        fi
+      - 'grep -q "^\.env$" .gitignore || (echo "ERREUR: .env manquant dans .gitignore" && exit 1)'
+      - echo "Security check OK"
+
+  - name: test-backend
    image: python:3.11-slim
    commands:
      - cd backend
      - pip install --no-cache-dir -r requirements.txt
      - pytest app/tests/ -v --tb=short

-  test-frontend:
+  - name: test-frontend
    image: node:20-slim
    commands:
      - cd frontend
      - npm ci
      - npm run build

-  docker-backend:
-    image: woodpeckerci/plugin-docker-buildx
+  # NOTE: volumes + pas de from_secret : compatible
+  - name: build-backend
+    image: docker:27-cli
    depends_on:
      - test-backend
-    settings:
-      repo: ${CI_FORGE_URL}/${CI_REPO}
-      dockerfile: docker/backend.Dockerfile
-      context: .
-      tag:
-        - latest
-        - ${CI_COMMIT_SHA:0:8}
-      target: production
-      registry:
-        from_secret: docker_registry
-      username:
-        from_secret: docker_username
-      password:
-        from_secret: docker_password
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    commands:
+      - docker build -t libredecision-backend:latest -f docker/backend.Dockerfile --target production .
+      - echo "Image backend construite"

-  docker-frontend:
-    image: woodpeckerci/plugin-docker-buildx
+  # NOTE: volumes + pas de from_secret : compatible
+  - name: build-frontend
+    image: docker:27-cli
    depends_on:
      - test-frontend
-    settings:
-      repo: ${CI_FORGE_URL}/${CI_REPO}
-      dockerfile: docker/frontend.Dockerfile
-      context: .
-      tag:
-        - latest
-        - ${CI_COMMIT_SHA:0:8}
-      target: production
-      registry:
-        from_secret: docker_registry
-      username:
-        from_secret: docker_username
-      password:
-        from_secret: docker_password
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    commands:
+      - docker build -t libredecision-frontend:latest -f docker/frontend.Dockerfile --target production .
+      - echo "Image frontend construite"

-  deploy:
-    image: appleboy/drone-ssh
+  # NOTE: volumes + pas de from_secret : compatible
+  - name: sbom-generate
+    image: alpine:3.20
    depends_on:
-      - docker-backend
-      - docker-frontend
-    settings:
-      host:
-        from_secret: deploy_host
-      username:
-        from_secret: deploy_username
-      key:
-        from_secret: deploy_key
-      port: 22
-      script:
-        - cd /opt/libredecision
-        - docker compose -f docker/docker-compose.yml pull
-        - docker compose -f docker/docker-compose.yml up -d --remove-orphans
-        - docker image prune -f
+      - build-backend
+      - build-frontend
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    commands:
+      - apk add --no-cache curl
+      - curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin latest
+      - mkdir -p .reports
+      - syft libredecision-backend:latest -o cyclonedx-json --file .reports/sbom-backend.cyclonedx.json
+      - syft libredecision-frontend:latest -o cyclonedx-json --file .reports/sbom-frontend.cyclonedx.json
+      - echo "SBOM generes"
+
+  # NOTE: volumes + pas de from_secret : compatible
+  - name: sbom-scan
+    image: aquasec/trivy:latest
+    depends_on:
+      - sbom-generate
+    volumes:
+      - /home/syoul/trivy-cache:/root/.cache/trivy
+    commands:
+      - trivy sbom --format json --output .reports/trivy-backend.json .reports/sbom-backend.cyclonedx.json
+      - trivy sbom --format json --output .reports/trivy-frontend.json .reports/sbom-frontend.cyclonedx.json
+      - echo "Scan CVE termine"
+
+  # NOTE: from_secret + pas de volumes : compatible
+  - name: sbom-publish
+    image: alpine/curl:latest
+    depends_on:
+      - sbom-scan
+    environment:
+      DTRACK_TOKEN:
+        from_secret: dependency_track_token
+      DTRACK_DOMAIN:
+        from_secret: dtrack_domain
+    commands:
+      - |
+        VERSION=$(date +%Y-%m-%d)-$(echo "$CI_COMMIT_SHA" | cut -c1-8)
+        for COMPONENT in backend frontend; do
+          HTTP=$(curl -s -o /tmp/dtrack-resp.txt -w "%{http_code}" -X POST "https://$DTRACK_DOMAIN/api/v1/bom" \
+            -H "X-Api-Key: $DTRACK_TOKEN" \
+            -F "autoCreate=true" \
+            -F "projectName=libredecision-$COMPONENT" \
+            -F "projectVersion=$VERSION" \
+            -F "bom=@.reports/sbom-$COMPONENT.cyclonedx.json")
+          echo "HTTP $HTTP ($COMPONENT) : $(cat /tmp/dtrack-resp.txt)"
+          [ "$HTTP" -ge 200 ] && [ "$HTTP" -lt 300 ] || exit 1
+        done
+
+  # NOTE: from_secret + pas de volumes : compatible
+  - name: write-env
+    image: alpine:3.20
+    depends_on:
+      - sbom-publish
+    environment:
+      APP_DOMAIN:
+        from_secret: app_domain
+      POSTGRES_PASSWORD:
+        from_secret: postgres_password
+      SECRET_KEY:
+        from_secret: secret_key
+    commands:
+      - echo "APP_DOMAIN=$APP_DOMAIN" > .env.deploy
+      - echo "POSTGRES_PASSWORD=$POSTGRES_PASSWORD" >> .env.deploy
+      - echo "SECRET_KEY=$SECRET_KEY" >> .env.deploy
+      - OWNER=$(echo "$CI_REPO_OWNER" | tr 'A-Z' 'a-z') && REPO=$(echo "$CI_REPO_NAME" | tr 'A-Z' 'a-z') && BRANCH=$(echo "$CI_COMMIT_BRANCH" | tr 'A-Z/' 'a-z-') && echo "COMPOSE_PROJECT_NAME=$OWNER-$REPO-$BRANCH" >> .env.deploy
+      - echo ".env.deploy cree ($(wc -c < .env.deploy) octets)"
+
+  - name: test-env
+    image: alpine:3.20
+    depends_on:
+      - write-env
+    commands:
+      - |
+        [ -f .env.deploy ] || { echo "FAIL: .env.deploy introuvable"; exit 1; }
+        echo "PASS: .env.deploy present"
+      - |
+        VAL=$(grep '^COMPOSE_PROJECT_NAME=' .env.deploy | cut -d= -f2)
+        [ -z "$VAL" ] && echo "FAIL: COMPOSE_PROJECT_NAME vide" && exit 1
+        echo "PASS: COMPOSE_PROJECT_NAME = $VAL"
+      - |
+        VAL=$(grep '^APP_DOMAIN=' .env.deploy | cut -d= -f2)
+        [ -z "$VAL" ] && echo "FAIL: APP_DOMAIN vide" && exit 1
+        echo "PASS: APP_DOMAIN = $VAL"
+
+  # NOTE: volumes + pas de from_secret : compatible
+  # Fabio/Traefik routing géré via labels du docker-compose.yml
+  - name: deploy
+    image: docker:27-cli
+    depends_on:
+      - test-env
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /opt/libredecision:/opt/libredecision
+    commands:
+      - cp .env.deploy /opt/libredecision/.env
+      - chmod 600 /opt/libredecision/.env
+      - cp docker/docker-compose.yml /opt/libredecision/docker-compose.yml
+      # Arreter avant le challenge ACME : libere le webroot pour sonic-acme-1
+      - cd /opt/libredecision && docker compose stop
+      - |
+        DOMAIN=$(grep '^APP_DOMAIN=' /opt/libredecision/.env | cut -d= -f2)
+        ACME_EXIT=0
+        docker exec sonic-acme-1 /app/acme.sh \
+          --home /etc/acme.sh \
+          --issue -d "$DOMAIN" \
+          --webroot /usr/share/nginx/html \
+          --server letsencrypt \
+          --accountemail support+acme@asycn.io || ACME_EXIT=$?
+        if [ "$ACME_EXIT" -ne 0 ] && [ "$ACME_EXIT" -ne 2 ]; then
+          echo "ERREUR: acme.sh a echoue (exit $ACME_EXIT)"
+          exit 1
+        fi
+        docker exec sonic-acme-1 cp /etc/acme.sh/$DOMAIN/fullchain.cer /host/certs/$DOMAIN-cert.pem
+        docker exec sonic-acme-1 cp /etc/acme.sh/$DOMAIN/$DOMAIN.key /host/certs/$DOMAIN-key.pem
+        echo "TLS OK (acme exit $ACME_EXIT)"
+      # Images construites localement dans la pipeline : pas de docker compose pull
+      - cd /opt/libredecision && docker compose up -d --remove-orphans
+      - cd /opt/libredecision && docker compose ps
+
+  # Vérification que les containers sont running
+  - name: test-deploy
+    image: docker:27-cli
+    depends_on:
+      - deploy
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /opt/libredecision:/opt/libredecision
+    commands:
+      - |
+        PROJECT=$(grep '^COMPOSE_PROJECT_NAME=' /opt/libredecision/.env | cut -d= -f2)
+        for SVC in backend frontend; do
+          STATUS=$(docker inspect --format '{{.State.Status}}' "$PROJECT-$SVC" 2>/dev/null || echo "absent")
+          echo "$PROJECT-$SVC : $STATUS"
+          [ "$STATUS" = "running" ] || { echo "FAIL: $PROJECT-$SVC non running"; exit 1; }
+        done
+        echo "PASS: tous les containers running"
+
+  - name: healthcheck
+    image: alpine:3.20
+    depends_on:
+      - test-deploy
+    commands:
+      - apk add --no-cache --quiet curl
+      - |
+        SITE=$(grep '^APP_DOMAIN=' .env.deploy | cut -d= -f2)
+        TARGET="https://$SITE"
+        echo "Healthcheck $TARGET..."
+        MAX=60
+        i=0
+        until [ $i -ge $MAX ]; do
+          CODE=$(curl -sSo /dev/null -w "%{http_code}" "$TARGET" 2>/dev/null)
+          echo "Tentative $((i+1))/$MAX - HTTP $CODE"
+          if [ "$CODE" = "200" ] || [ "$CODE" = "301" ] || [ "$CODE" = "302" ]; then
+            echo "PASS: app repond sur $TARGET"
+            exit 0
+          fi
+          i=$((i+1))
+          sleep 10
+        done
+        echo "FAIL: app ne repond pas apres 10 minutes"
+        exit 1
+
+  - name: notify-failure
+    image: alpine:3.20
+    commands:
+      - 'echo "ECHEC pipeline #$CI_BUILD_NUMBER sur $CI_COMMIT_BRANCH ($CI_COMMIT_SHA)"'
+    when:
+      - status: failure
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -1,13 +1,14 @@
-version: "3.9"
+name: ${COMPOSE_PROJECT_NAME:-ehv-decision-main}

 services:
  postgres:
    image: postgres:16-alpine
-    restart: unless-stopped
+    container_name: ${COMPOSE_PROJECT_NAME:-ehv-decision-main}-postgres
+    restart: always
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-libredecision}
      POSTGRES_USER: ${POSTGRES_USER:-libredecision}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-change-me-in-production}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
@@ -18,61 +19,57 @@ services:
      start_period: 30s
    networks:
      - libredecision
+    # Pas de label SERVICE_* : postgres non exposé publiquement

  backend:
-    build:
-      context: ../
-      dockerfile: docker/backend.Dockerfile
-      target: production
-    restart: unless-stopped
+    image: libredecision-backend:latest
+    container_name: ${COMPOSE_PROJECT_NAME:-ehv-decision-main}-backend
+    restart: always
    depends_on:
      postgres:
        condition: service_healthy
    environment:
-      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-libredecision}:${POSTGRES_PASSWORD:-change-me-in-production}@postgres:5432/${POSTGRES_DB:-libredecision}
-      SECRET_KEY: ${SECRET_KEY:-change-me-in-production-with-a-real-secret-key}
+      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-libredecision}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-libredecision}
+      SECRET_KEY: ${SECRET_KEY}
      DEBUG: "false"
-      CORS_ORIGINS: '["https://${DOMAIN:-libredecision.org}"]'
+      CORS_ORIGINS: '["https://${APP_DOMAIN:-libredecision.org}"]'
      DUNITER_RPC_URL: ${DUNITER_RPC_URL:-wss://gdev.p2p.legal/ws}
      IPFS_API_URL: http://ipfs:5001
      IPFS_GATEWAY_URL: http://ipfs:8080
    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.libredecision-api.rule=Host(`${DOMAIN:-libredecision.org}`) && PathPrefix(`/api`)"
-      - "traefik.http.routers.libredecision-api.entrypoints=websecure"
-      - "traefik.http.routers.libredecision-api.tls.certresolver=letsencrypt"
-      - "traefik.http.services.libredecision-api.loadbalancer.server.port=8002"
+      # Registrator enregistre dans Consul, Fabio route automatiquement
+      - SERVICE_8002_NAME=${COMPOSE_PROJECT_NAME:-ehv-decision-main}-backend-8002
+      - SERVICE_8002_TAGS=urlprefix-${APP_DOMAIN:-libredecision.org}/api/*
+      # TCP : HTTP check échoue si le service redirige (301/302)
+      - SERVICE_8002_CHECK_TCP=true
    networks:
      - libredecision
-      - traefik
+      - sonic

  frontend:
-    build:
-      context: ../
-      dockerfile: docker/frontend.Dockerfile
-      target: production
-    restart: unless-stopped
+    image: libredecision-frontend:latest
+    container_name: ${COMPOSE_PROJECT_NAME:-ehv-decision-main}-frontend
+    restart: always
    depends_on:
      - backend
    environment:
-      NUXT_PUBLIC_API_BASE: https://${DOMAIN:-libredecision.org}/api/v1
+      NUXT_PUBLIC_API_BASE: https://${APP_DOMAIN:-libredecision.org}/api/v1
    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.libredecision-front.rule=Host(`${DOMAIN:-libredecision.org}`)"
-      - "traefik.http.routers.libredecision-front.entrypoints=websecure"
-      - "traefik.http.routers.libredecision-front.tls.certresolver=letsencrypt"
-      - "traefik.http.services.libredecision-front.loadbalancer.server.port=3000"
+      - SERVICE_3000_NAME=${COMPOSE_PROJECT_NAME:-ehv-decision-main}-frontend-3000
+      - SERVICE_3000_TAGS=urlprefix-${APP_DOMAIN:-libredecision.org}/*
+      - SERVICE_3000_CHECK_TCP=true
    networks:
-      - libredecision
-      - traefik
+      - sonic

  ipfs:
    image: ipfs/kubo:latest
-    restart: unless-stopped
+    container_name: ${COMPOSE_PROJECT_NAME:-ehv-decision-main}-ipfs
+    restart: always
    volumes:
      - ipfs-data:/data/ipfs
    networks:
      - libredecision
+    # Pas de label SERVICE_* : ipfs non exposé publiquement

 volumes:
  postgres-data:
@@ -81,5 +78,5 @@ volumes:
 networks:
  libredecision:
    driver: bridge
-  traefik:
+  sonic:
    external: true
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,11 +1,11 @@
 {
-  "name": "glibredecision",
+  "name": "libredecision",
  "version": "0.1.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
-      "name": "glibredecision",
+      "name": "libredecision",
      "version": "0.1.0",
      "hasInstallScript": true,
      "dependencies": {
@@ -7505,15 +7505,6 @@
        "url": "https://github.com/sponsors/wooorm"
      }
    },
-    "node_modules/commander": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-11.1.0.tgz",
-      "integrity": "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=16"
-      }
-    },
    "node_modules/commondir": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz",
@@ -15039,6 +15030,15 @@
        "url": "https://opencollective.com/svgo"
      }
    },
+    "node_modules/svgo/node_modules/commander": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-11.1.0.tgz",
+      "integrity": "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16"
+      }
+    },
    "node_modules/system-architecture": {
      "version": "0.1.0",
      "resolved": "https://registry.npmjs.org/system-architecture/-/system-architecture-0.1.0.tgz",
Author	SHA1	Message	Date
syoul	73c5bf148c	ci: remplace Traefik par Fabio/Consul (pattern sonic) - docker-compose.yml : labels SERVICE_* Registrator, réseau sonic external, container_name explicite, name COMPOSE_PROJECT_NAME - pipeline : APP_DOMAIN (au lieu de DOMAIN), ACME sonic-acme-1 pour TLS, test-deploy sans suffixe -1 (container_name fixe) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-23 15:25:06 +01:00
syoul	6509137892	fix: sync package-lock.json avec package.json Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-23 15:02:47 +01:00
syoul	488114791c	ci: build local sans registry, pattern sejeteralo - Suppression write-docker-creds et secrets docker_registry/username/password - build-backend/frontend : docker build local sur sonic (docker.sock) - sbom-generate : scan des images locales via docker.sock - docker-compose.yml : ajout image: libredecision-{backend,frontend}:latest - deploy : suppression docker compose pull (images locales) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-23 14:59:42 +01:00
syoul	3e702fdbf3	ci: remplace plugin-docker-buildx par docker:27-cli + socket Evite le mode privileged (non supporté par YunoHost Woodpecker). Pattern: write-docker-creds (from_secret) → docker-backend/frontend (volumes). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-23 14:41:32 +01:00
syoul	e24c2a65a0	launch pipeline	2026-03-23 14:32:04 +01:00
syoul	53fc9927ef	ci: refonte pipeline selon bonnes pratiques sonic - Format when/steps migré vers liste Woodpecker next - Séparation from_secret / volumes (bug Woodpecker) - Ajout security-check, SBOM (syft+trivy+dtrack), write-env, test-env, test-deploy, healthcheck, notify-failure - Deploy SSH → volumes Docker (docker.sock + /opt/libredecision) - privileged: true sur les steps docker-buildx Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-23 14:25:24 +01:00
syoul	a9599ba32a	ci: refonte pipeline selon bonnes pratiques sonic	2026-03-23 14:24:16 +01:00