backup: pre-hardening baseline

docker/Dockerfile

@@ -0,0 +1,20 @@
+FROM golang:1.23-alpine AS backend
+WORKDIR /app/backend
+COPY backend/go.mod backend/go.sum ./
+RUN go mod download
+COPY backend/ ./
+RUN go build -o /traefik-gui ./cmd/traefik-gui
+
+FROM node:20-alpine AS frontend
+WORKDIR /app/frontend
+COPY frontend/package.json frontend/package-lock.json* ./
+RUN npm ci || npm install
+COPY frontend/ ./
+RUN npm run build
+
+FROM alpine:3.19
+RUN apk add --no-cache ca-certificates
+COPY --from=backend /traefik-gui /usr/local/bin/traefik-gui
+COPY --from=frontend /app/frontend/dist /app/frontend/dist
+EXPOSE 8080
+ENTRYPOINT ["traefik-gui"]

docker/docker-compose.yml

@@ -0,0 +1,47 @@
+version: '3.8'
+
+services:
+  traefik-gui:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile
+    ports:
+      - "8080:8080"
+    environment:
+      - GUI_DB_PATH=/data/traefik-gui.db
+      - GUI_SESSION_SECRET=dev-secret-change-in-production-min-32-chars
+      - GUI_CORS_ORIGIN=http://localhost:5173
+      - GUI_ADDR=:8080
+      - GUI_DEV_MODE=true
+      - TRAEFIK_API_URL=http://traefik:8080/api
+    volumes:
+      - ./data:/data
+      - ./configs:/etc/traefik-gui/configs
+    depends_on:
+      - traefik
+    networks:
+      - traefik-gui-net
+
+  traefik:
+    image: traefik:v3.7
+    ports:
+      - "80:80"
+      - "443:443"
+      - "8081:8080"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./docker/traefik.dev.yml:/etc/traefik/traefik.yml:ro
+      - ./configs/dynamic:/etc/traefik/dynamic:ro
+    command:
+      - "--api.insecure=true"
+      - "--api.dashboard=true"
+      - "--log.level=DEBUG"
+    networks:
+      - traefik-gui-net
+
+networks:
+  traefik-gui-net:
+    driver: bridge
+
+volumes:
+  traefik-gui-data:

docker/traefik.dev.yml

@@ -0,0 +1,16 @@
+api:
+  dashboard: true
+  insecure: true
+entryPoints:
+  web:
+    address: ":80"
+  websecure:
+    address: ":443"
+  traefik:
+    address: ":8080"
+providers:
+  file:
+    directory: "/etc/traefik/dynamic"
+    watch: true
+log:
+  level: DEBUG