alpinux.cedrica5l/alpinux.site.2026
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: admin.alpinux.org — sous-domaine dédié conforme à la convention ISPConfig

Browse source 
Remplace portail.alpinux.org.admin.conf (snippet incorrectement formaté)
par scripts/admin.alpinux.org.vhost.conf : VirtualHost complet HTTP+HTTPS,
reverse proxy Gunicorn port 5002, même structure que les autres vhosts.

admin/app.py : supprime x_prefix=1 du ProxyFix (plus de sous-chemin /admin/)
admin/.env.example : client Keycloak renommé admin-alpinux
scripts/alpinux-admin.service : description mise à jour

redirect_uri Keycloak attendu : https://admin.alpinux.org/auth/callback

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Cédrix 2026-05-03 16:01:47 +02:00
parent 60eb8bc952
commit 80574a83f3
5 changed files with 40 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
admin/.env.example
View file

@ -1,6 +1,6 @@
SECRET_KEY=changez-moi-avec-une-valeur-aleatoire-longue
ALPID_CLIENT_ID=alpinux-admin
ALPID_CLIENT_ID=admin-alpinux
ALPID_CLIENT_SECRET=
ALPID_DISCOVERY_URL=https://alpid.alpinux.org/realms/alpinux/.well-known/openid-configuration

4
admin/app.py
View file

@ -8,8 +8,8 @@ import builds
app = Flask(__name__)
app.secret_key = os.environ["SECRET_KEY"]
# Gère X-Forwarded-Proto et X-Script-Name envoyés par Apache
app.wsgi_app = ProxyFix(app.wsgi_app, x_proto=1, x_prefix=1)
# Gère X-Forwarded-Proto envoyé par Apache
app.wsgi_app = ProxyFix(app.wsgi_app, x_proto=1)
# ── OIDC AlpID ────────────────────────────────────────────────────
oauth = OAuth(app)

36
scripts/admin.alpinux.org.vhost.conf Normal file
View file

@ -0,0 +1,36 @@
# Apache vhost pour admin.alpinux.org
# À créer via ISPConfig : Sites > Ajouter un site web
# Domaine : admin.alpinux.org
# Activer SSL Let's Encrypt dans ISPConfig
#
# L'app admin Flask tourne derrière Gunicorn sur 127.0.0.1:5002
<VirtualHost *:80>
ServerName admin.alpinux.org
Redirect permanent / https://admin.alpinux.org/
</VirtualHost>
<VirtualHost *:443>
ServerName admin.alpinux.org
# ── Proxy vers Gunicorn ──────────────────────────────────────
ProxyPreserveHost On
ProxyPass / http://127.0.0.1:5002/
ProxyPassReverse / http://127.0.0.1:5002/
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"
# ── Sécurité ─────────────────────────────────────────────────
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
# ── Logs ─────────────────────────────────────────────────────
ErrorLog /var/log/apache2/admin.alpinux.org-error.log
CustomLog /var/log/apache2/admin.alpinux.org-access.log combined
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/admin.alpinux.org/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/admin.alpinux.org/privkey.pem
</VirtualHost>

2
scripts/alpinux-admin.service
View file

@ -3,7 +3,7 @@
# puis : sudo systemctl enable --now alpinux-admin
[Unit]
Description=Alpinux Admin — interface de déploiement (Flask + Gunicorn)
Description=Alpinux Admin — admin.alpinux.org (Flask + Gunicorn)
After=network.target
[Service]

10
scripts/portail.alpinux.org.admin.conf
View file

@ -1,10 +0,0 @@
# Bloc à ajouter dans le VirtualHost HTTPS de portail.alpinux.org
# (dans ISPConfig : Sites > portail.alpinux.org > Directives Apache personnalisées)
#
# L'app admin Flask tourne sur Gunicorn à 127.0.0.1:5002
# ── Admin Alpinux : /admin/ → Gunicorn port 5002 ────────────────
ProxyPass /admin/ http://127.0.0.1:5002/
ProxyPassReverse /admin/ http://127.0.0.1:5002/
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Script-Name "/admin"