little more security

For more information see: toolshed/abra#534

README.md

@@ -21,6 +21,7 @@
 * `abra app deploy <app-name>`
 * Open the configured domain in your browser to create your user account (only works in case mail is configured correctly)
 * Give yourself admin rights by running `abra app cmd <app-name> app make_last_user_admin`
+* Deploy [swarm-cronjob](https://recipes.coopcloud.tech/swarm-cronjob) on your server if it is not running yet. This is needed for loomios cron container to be started to do hourly chores.
 
 ## Migration guide
 

compose.yml

@@ -10,8 +10,7 @@ x-redis-env: &redis-env
   REDIS_URL: redis://redis:6379
 
 x-environment: &default-env
-  <<: *db-env
-  <<: *redis-env
+  <<: [*db-env, *redis-env]
   CANONICAL_HOST: ${DOMAIN}
   VIRTUAL_HOST: ${DOMAIN}
   CHANNELS_URI: wss://channels.${DOMAIN}
@@ -33,7 +32,7 @@ x-environment: &default-env
 
 services:
   app:
-    image: loomio/loomio:v2.25.3
+    image: loomio/loomio:v2.25.4
     configs:
       - source: entrypoint
         target: /entrypoint.sh
@@ -71,10 +70,16 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=4.0.0+v2.25.3"
+        - "coop-cloud.${STACK_NAME}.version=4.0.2+v2.25.4"
         - "backupbot.backup:=${ENABLE_BACKUPS:-true}"
+        - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}"
+        - "traefik.http.middlewares.${STACK_NAME}.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
+        - "traefik.http.middlewares.${STACK_NAME}.headers.accesscontrolallowheaders=*"
+        - "traefik.http.middlewares.${STACK_NAME}.headers.accessControlAllowOriginList=https://*.${DOMAIN}"
+        - "traefik.http.middlewares.${STACK_NAME}.headers.accesscontrolmaxage=100"
+        - "traefik.http.middlewares.${STACK_NAME}.headers.addvaryheader=true"
   worker:
-    image: loomio/loomio:v2.25.3
+    image: loomio/loomio:v2.25.4
     configs:
       - source: entrypoint
         target: /entrypoint.sh
@@ -134,12 +139,24 @@ services:
     image: loomio/loomio_channel_server
     networks:
       - backend
+      - proxy
     depends_on:
       - redis
     environment:
       <<: *redis-env
+      VIRTUAL_HOST: channels.${DOMAIN}
+    deploy:
+      labels:
+        - "traefik.enable=true"
+        - "traefik.docker.network=proxy"
+        - "traefik.http.routers.channels${STACK_NAME}.rule=Host(`channels.${DOMAIN}`)"
+        - "traefik.http.routers.channels${STACK_NAME}.tls=true"
+        - "traefik.http.routers.channels${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.services.channels${STACK_NAME}.loadbalancer.server.port=5000"
+        - "traefik.http.routers.channels${STACK_NAME}.entrypoints=web-secure"
+
   cron:
-    image: loomio/loomio:v2.25.3
+    image: loomio/loomio:v2.25.4
     configs:
       - source: entrypoint
         target: /entrypoint.sh