Патч безопасности

Скрытие портов извне и обращение сервисов по имени внутри сети

manufacturer/configs/grafana/provisioning/datasources/datasource.yaml

@@ -3,5 +3,5 @@ datasources:
   - name: Prometheus
     type: prometheus
     access: proxy
-    url: http://10.10.1.3:9090
+    url: http://stransit-test-prometheus:9090
     isDefault: true

manufacturer/configs/prometheus/prometheus.yml

@@ -5,4 +5,4 @@ scrape_configs:
   - job_name: 'apache'
     metrics_path: '/metrics'
     static_configs:
-      - targets: ['10.10.1.5:9117']
+      - targets: ['stransit-test-exporter:9117']

manufacturer/container/apache/Dockerfile

@@ -4,4 +4,6 @@ RUN docker-php-ext-install mysqli
 
 RUN a2enmod status
 RUN a2enmod rewrite
-RUN a2enmod headers
+RUN a2enmod headers
+RUN a2enmod proxy
+RUN a2enmod proxy_http

manufacturer/container/services/docker-compose.yml

@@ -30,7 +30,7 @@ services:
     build:
       context: ../../../.
       dockerfile: manufacturer/container/apache/Dockerfile
-    image: stransit-test-apache:v1
+    image: stransit-test-apache:v1.1
     container_name: stransit-test-apache
     networks:
       stransit-test-metrics:
@@ -52,15 +52,12 @@ services:
     networks:
       stransit-test-metrics:
         ipv4_address: 10.10.1.5
-    ports:
+    expose:
-      - mode: ingress
+      - 9117
-        target: 9117
-        published: "9117"
-        protocol: tcp
     depends_on:
       - stransit-test-apache
     restart: unless-stopped
-    entrypoint: /bin/apache_exporter  --scrape_uri="http://10.10.1.2/server-status?auto"
+    entrypoint: /bin/apache_exporter  --scrape_uri="http://stransit-test-apache/server-status?auto"
 
   stransit-test-prometheus:
     image: prom/prometheus:v3.1.0
@@ -70,8 +67,8 @@ services:
     networks:
       stransit-test-metrics:
         ipv4_address: 10.10.1.3
-    ports:
+    expose:
-      - "9090:9090"
+      - 9090
     depends_on:
       - stransit-test-exporter
 
@@ -85,6 +82,7 @@ services:
       - "3000:3000"
     environment:
       GF_SECURITY_ADMIN_PASSWORD: ${GF_SECURITY_ADMIN_PASSWORD}
+      GF_SERVER_SERVE_FROM_SUB_PATH: true
     volumes:
       - grafana_data:/var/lib/grafana
       - ../../configs/grafana/provisioning:/etc/grafana/provisioning