CI/CD: ci, deploy-ift и deploy-stage через EventHubDevOps; фиксы calendar view, archive, API-тесты, traefik-coraza

docker/build-images.sh

@@ -1,6 +1,9 @@
 # Основной образ EventHub (единственный для нод)
 docker build -t eventhub:latest -f docker/Dockerfile .
 
+# Traefik + Coraza WAF (wasm встроен в образ, без plugins.traefik.io)
+docker build -t traefik-coraza:latest -f docker/traefik/Dockerfile docker/traefik
+
 # Сервис заглушка
 docker build -t fallback:latest -f docker/fallback/Dockerfile docker/fallback
 

docker/docker-compose.swarm.yml

@@ -4,7 +4,7 @@ version: "3.8"
 services:
   # ================== Балансировщик ==================
   traefik:
-    image: traefik:latest
+    image: traefik-coraza:latest
     command:
 #      - "--log.level=DEBUG"
       - "--api.insecure=true"
@@ -21,8 +21,7 @@ services:
       - "--accesslog=true"
       - "--accesslog.filepath=/var/log/traefik/access.log"
       - "--accesslog.format=json"
-      - "--experimental.plugins.coraza.modulename=github.com/jcchavezs/coraza-http-wasm-traefik"
-      - "--experimental.plugins.coraza.version=v0.3.0"
+      - "--experimental.localPlugins.coraza.modulename=github.com/jcchavezs/coraza-http-wasm-traefik"
     ports:
       - "80:80"
       - "443:443"
@@ -32,7 +31,6 @@ services:
       - "./traefik/certs:/etc/traefik/certs:ro"
       - "./traefik/dynamic_conf.yml:/etc/traefik/dynamic_conf.yml:ro"
       - "traefik-logs:/var/log/traefik"
-      - "traefik-plugins:/plugins-storage"
     networks:
       - eventhub-net
     deploy:
@@ -226,5 +224,4 @@ volumes:
   prometheus-data:
   grafana-data:
   traefik-logs:
-  loglynx-data:
-  traefik-plugins:
+  loglynx-data:

docker/docker-compose.yml

@@ -2,7 +2,7 @@
 services:
   # ================== Балансировщик (HTTPS/WSS, WAF, логи) ==================
   traefik:
-    image: traefik:latest
+    image: traefik-coraza:latest
     user: "0:1001"   # группа docker на хосте
     command:
       - "--api.insecure=true"
@@ -20,9 +20,8 @@ services:
       - "--accesslog=true"
       - "--accesslog.filepath=/var/log/traefik/access.log"
       - "--accesslog.format=json"
-      # Coraza WAF
-      - "--experimental.plugins.coraza.modulename=github.com/jcchavezs/coraza-http-wasm-traefik"
-      - "--experimental.plugins.coraza.version=v0.2.0"
+      # Coraza WAF (локальный wasm из образа)
+      - "--experimental.localPlugins.coraza.modulename=github.com/jcchavezs/coraza-http-wasm-traefik"
     ports:
       - "80:80"
       - "443:443"

docker/traefik/Dockerfile

@@ -0,0 +1,11 @@
+FROM traefik:v3.2.0
+
+ARG CORAZA_VERSION=v0.3.0
+ARG CORAZA_MODULE=github.com/jcchavezs/coraza-http-wasm-traefik
+
+RUN apk add --no-cache curl unzip \
+  && mkdir -p /plugins-local/src/github.com/jcchavezs/coraza-http-wasm-traefik \
+  && curl -fsSL -o /tmp/coraza.zip \
+       "https://github.com/jcchavezs/coraza-http-wasm-traefik/releases/download/${CORAZA_VERSION}/coraza-http-wasm-${CORAZA_VERSION}.zip" \
+  && unzip -q /tmp/coraza.zip -d /plugins-local/src/github.com/jcchavezs/coraza-http-wasm-traefik \
+  && rm /tmp/coraza.zip