chore: initial hub repo structure

2026-07-09 22:08:26 +07:00
commit b31fe9d188
83 changed files with 7969 additions and 0 deletions
@@ -0,0 +1,57 @@
+http:
+  routers:
+    # ── React SPA (domain root) ──
+    react:
+      rule: 'Host(`asepharyana.my.id`) || Host(`asepharyana.web.id`)'
+      entryPoints:
+        - websecure
+      tls: {}
+      service: react-service
+
+    # ── Scraper API ──
+    scraper:
+      rule: 'Host(`scraper.asepharyana.my.id`) || Host(`api.asepharyana.my.id`) || Host(`scraper.asepharyana.web.id`) || Host(`api.asepharyana.web.id`)'
+      entryPoints:
+        - websecure
+      tls: {}
+      middlewares:
+        - common-chain@file
+      service: scraper-service
+
+    # ── Elysia API ──
+    elysia:
+      rule: 'Host(`elysia.asepharyana.my.id`) || Host(`elysia.asepharyana.web.id`)'
+      entryPoints:
+        - websecure
+      tls: {}
+      middlewares:
+        - common-chain@file
+      service: elysia-service
+
+    # ── Rust Auth API ──
+    rust-auth:
+      rule: 'Host(`auth.asepharyana.my.id`) || Host(`auth.asepharyana.web.id`)'
+      entryPoints:
+        - websecure
+      tls: {}
+      middlewares:
+        - common-chain@file
+      service: rust-auth-service
+
+  services:
+    react-service:
+      loadBalancer:
+        servers:
+          - url: 'http://react-web:80'
+    scraper-service:
+      loadBalancer:
+        servers:
+          - url: 'http://scraper-api:4091'
+    elysia-service:
+      loadBalancer:
+        servers:
+          - url: 'http://elysia-api:4092'
+    rust-auth-service:
+      loadBalancer:
+        servers:
+          - url: 'http://rust-auth:3000'
@@ -0,0 +1,74 @@
+http:
+  middlewares:
+    secure-headers:
+      headers:
+        sslRedirect: true
+        forceSTSHeader: true
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        frameDeny: true
+        contentTypeNosniff: true
+        browserXSSFilter: true
+        referrerPolicy: 'same-origin'
+        customResponseHeaders:
+          X-Content-Type-Options: 'nosniff'
+          X-Frame-Options: 'DENY'
+          X-XSS-Protection: '1; mode=block'
+          Referrer-Policy: 'same-origin'
+          Permissions-Policy: 'geolocation=(), microphone=(), camera=()'
+    compress:
+      compress:
+        minResponseBodyBytes: 256
+        excludedContentTypes:
+          - 'image/*'
+          - 'application/octet-stream'
+    retry:
+      retry:
+        attempts: 3
+    rate-limit:
+      rateLimit:
+        average: 100
+        burst: 50
+    buffer:
+      buffering:
+        maxRequestBodyBytes: 10485760
+        maxResponseBodyBytes: 10485760
+        memRequestBodyBytes: 1048576
+        memResponseBodyBytes: 1048576
+    admin-chain:
+      chain:
+        middlewares:
+          - secure-headers
+          - compress
+          - retry
+
+    # ── Useful Plugins ──
+    real-ip:
+      plugin:
+        real-ip:
+          excludednetworks:
+            - '127.0.0.1/32'
+          realipheader: 'CF-Connecting-IP'
+
+    block-sensitive-paths:
+      plugin:
+        blockpath:
+          regex:
+            - "^/\\.env"
+            - "^/\\.git"
+            - '^/wp-admin'
+            - "^/wp-login\\.php"
+            - "^/config\\.php"
+
+    # ── Common Chain ──
+    common-chain:
+      chain:
+        middlewares:
+          # - real-ip
+          # - block-sensitive-paths
+          - secure-headers
+          - compress
+          - retry
+          - rate-limit
+          - buffer
@@ -0,0 +1,14 @@
+tls:
+  certificates:
+    # Legacy production layout: asephstech.pem is paired with asephscloud.key.
+    - certFile: /etc/traefik/certs/asephstech.pem
+      keyFile: /etc/traefik/certs/asephscloud.key
+    - certFile: /etc/traefik/certs/asepharyana.my.id.pem
+      keyFile: /etc/traefik/certs/asepharyana.my.id.key
+    - certFile: /etc/traefik/certs/asepharyana.web.id.pem
+      keyFile: /etc/traefik/certs/asepharyana.web.id.key
+  stores:
+    default:
+      defaultCertificate:
+        certFile: /etc/traefik/certs/asephstech.pem
+        keyFile: /etc/traefik/certs/asephscloud.key