From 155bb8d02b19beb1bca57106299cc4806015c2fd Mon Sep 17 00:00:00 2001 From: mr-forust Date: Tue, 18 Nov 2025 14:41:41 +0100 Subject: [PATCH] refactor: Sepparate traefik services --- traefik/dynamic/dynamic.bak | 328 +++++++++++++++++++++++++++++++++++ traefik/dynamic/dynamic.yml | 75 -------- traefik/dynamic/services.yml | 75 ++++++++ 3 files changed, 403 insertions(+), 75 deletions(-) create mode 100644 traefik/dynamic/dynamic.bak create mode 100644 traefik/dynamic/services.yml diff --git a/traefik/dynamic/dynamic.bak b/traefik/dynamic/dynamic.bak new file mode 100644 index 0000000..dc39b9b --- /dev/null +++ b/traefik/dynamic/dynamic.bak @@ -0,0 +1,328 @@ +http: + routers: + # Traefik Dashboard (ADMIN, local only) + traefik-dashboard: + rule: "Host(`traefik.workstation`)" + entryPoints: + - websecure + service: api@internal + middlewares: + # - auth + - security-headers + tls: {} + + # Nextcloud AIO Interface (ADMIN, local is better) + nextcloud-aio: + rule: "Host(`nextcloud-aio.workstation`)" + entryPoints: + - websecure + service: nextcloud-aio + middlewares: + - security-headers + tls: {} + + # Termix (public (account required)) + termix: + rule: "Host(`termix.forust.xyz`)" + entryPoints: + - websecure + service: termix + middlewares: + - security-headers + tls: {} + + # MeTube + metube: + rule: "Host(`metube.forust.xyz`)" + entryPoints: + - websecure + service: metube + middlewares: + - metube-auth + - security-headers + tls: {} + + # Portainer (public (account required)) + portainer: + rule: "Host(`portainer.forust.xyz`)" + entryPoints: + - websecure + service: portainer + middlewares: + - security-headers + tls: {} + + # Uptime Kuma + uptime-kuma: + rule: "Host(`uptime.forust.xyz`)" + entryPoints: + - websecure + service: uptime-kuma + tls: {} + + # AdGuard Home (public (account required)) + adguard: + rule: "Host(`adguard.forust.xyz`)" + entryPoints: + - websecure + service: adguard + middlewares: + - security-headers + tls: {} + + + # Nextcloud Main (public (account required)) + nextcloud: + rule: "Host(`nextcloud.forust.xyz`)" + entrypoints: + - websecure + service: nextcloud + middlewares: + - nextcloud-chain + tls: {} + + # Dockmon (public (account required)) + dockmon: + rule: "Host(`dockmon.forust.xyz`)" + entryPoints: + - websecure + service: dockmon + middlewares: + # - dockmon-auth + - security-headers + tls: {} + + # Gitea (public (account required)) + gitea: + rule: "Host(`gitea.forust.xyz`)" + entryPoints: + - websecure + - ssh + service: gitea + middlewares: + - security-headers + tls: {} + + # # Glance (local only) + # glance: + # rule: "Host(`glance.workstation`)" + # entryPoints: + # - websecure + # service: glance + # middlewares: + # - security-headers + # tls: {} + + # Watercrawl (local only) + watercrawl: + rule: "Host(`watercrawl.workstation`)" + entryPoints: + - websecure + service: watercrawl + middlewares: + - security-headers + tls: {} + + # N8N (local only) + n8n: + rule: "Host(`n8n.workstation`)" + entryPoints: + - websecure + service: n8n + middlewares: + - security-headers + tls: {} + + + services: + # Portainer + portainer: + loadBalancer: + servers: + - url: "https://portainer:9443" + serversTransport: insecureTransport + + # AdGuard Home + adguard: + loadBalancer: + servers: + - url: "http://adguardhome:3000" + + # Nextcloud AIO Interface + nextcloud-aio: + loadBalancer: + servers: + - url: "https://nextcloud-aio-mastercontainer:8080" + serversTransport: insecureTransport + + # Nextcloud Main + nextcloud: + loadBalancer: + servers: + - url: "http://nextcloud-aio-apache:11000" + + # Uptime Kuma + uptime-kuma: + loadBalancer: + servers: + - url: "http://uptime-kuma:3001" + + # Termix + termix: + loadBalancer: + servers: + - url: "http://termix:8080" + + # Dockmon + dockmon: + loadBalancer: + servers: + - url: "https://dockmon:443" + serversTransport: insecureTransport + + # # Glance + # glance: + # loadBalancer: + # servers: + # - url: "http://glance:8080" + + # Watercrawl + watercrawl: + loadBalancer: + servers: + - url: "http://nginx:80" + + # N8N + n8n: + loadBalancer: + servers: + - url: "http://n8n:5678" + + # Gitea + gitea: + loadBalancer: + servers: + - url: "http://gitea:3000" + # MeTube + metube: + loadBalancer: + servers: + - url: "http://metube:8081" + + serversTransports: + insecureTransport: + insecureSkipVerify: true + + middlewares: + # HTTPS Redirect + redirect-https: + redirectScheme: + scheme: https + permanent: true + + # Metube Basic Auth + metube-auth: + basicAuth: + users: + - "admin:$2y$05$3Q6gyLFW3NFNp4C6elnyfupntqB6VNB/tcIAeo8NEzvaqPxOjN0iC" + # - "jeepik:$2y$05$tIKrmhd7SYOe6yImRRAfpen7hpVdF8PnSbgBTCDZ.GI0Djx.Le2bq" + realm: "MeTube Access" + + # Basic Auth Traefik Dashboard + auth: + basicAuth: + users: + - "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9." + # - "jeepik:$2y$05$Q8QqJwSjpycVYONyk4id/.rDFApW9oL8tycRMlGttNySsDv71Rnsu" + # - "vv:" + realm: "Traefik Dashboard" + + # Basic Auth Dockmon + dockmon-auth: + basicAuth: + users: + - "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1" + realm: "Dockmon Access" + + # Cloudflare IP Whitelist + cloudflare-ipwhitelist: + ipWhiteList: + sourceRange: + - "173.245.48.0/20" + - "103.21.244.0/22" + - "103.22.200.0/22" + - "103.31.4.0/22" + - "141.101.64.0/18" + - "108.162.192.0/18" + - "190.93.240.0/20" + - "188.114.96.0/20" + - "197.234.240.0/22" + - "198.41.128.0/17" + - "162.158.0.0/15" + - "104.16.0.0/13" + - "104.24.0.0/14" + - "172.64.0.0/13" + - "131.0.72.0/22" + + # Security Headers + security-headers: + headers: + browserXssFilter: true + contentTypeNosniff: true + forceSTSHeader: true + stsIncludeSubdomains: true + stsPreload: true + stsSeconds: 31536000 + customFrameOptionsValue: "SAMEORIGIN" + customResponseHeaders: + X-Content-Type-Options: "nosniff" + Referrer-Policy: "strict-origin-when-cross-origin" + + # Nextcloud specific headers + nextcloud-secure-headers: + headers: + hostsProxyHeaders: + - "X-Forwarded-Host" + - "X-Forwarded-Proto" + referrerPolicy: "same-origin" + customFrameOptionsValue: "SAMEORIGIN" + + # Rate limiting + rate-limit: + rateLimit: + average: 100 + burst: 50 + period: 1m + + # Nextcloud chain + nextcloud-chain: + chain: + middlewares: + - nextcloud-secure-headers + - security-headers + +# TLS Configuration +tls: + certificates: + # Cloudflare Origin CA *.forust.xyz + - certFile: /certs/cloudflare.pem + keyFile: /certs/cloudflare.key + # Local certificate + - certFile: /certs/workstation+1.pem + keyFile: /certs/workstation+1-key.pem + + stores: + default: + defaultCertificate: + # Fallback local certificate + certFile: /certs/workstation+1.pem + keyFile: /certs/workstation+1-key.pem + + options: + default: + minVersion: VersionTLS12 + sniStrict: true + cipherSuites: + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 \ No newline at end of file diff --git a/traefik/dynamic/dynamic.yml b/traefik/dynamic/dynamic.yml index dc39b9b..f3681dc 100644 --- a/traefik/dynamic/dynamic.yml +++ b/traefik/dynamic/dynamic.yml @@ -134,81 +134,6 @@ http: tls: {} - services: - # Portainer - portainer: - loadBalancer: - servers: - - url: "https://portainer:9443" - serversTransport: insecureTransport - - # AdGuard Home - adguard: - loadBalancer: - servers: - - url: "http://adguardhome:3000" - - # Nextcloud AIO Interface - nextcloud-aio: - loadBalancer: - servers: - - url: "https://nextcloud-aio-mastercontainer:8080" - serversTransport: insecureTransport - - # Nextcloud Main - nextcloud: - loadBalancer: - servers: - - url: "http://nextcloud-aio-apache:11000" - - # Uptime Kuma - uptime-kuma: - loadBalancer: - servers: - - url: "http://uptime-kuma:3001" - - # Termix - termix: - loadBalancer: - servers: - - url: "http://termix:8080" - - # Dockmon - dockmon: - loadBalancer: - servers: - - url: "https://dockmon:443" - serversTransport: insecureTransport - - # # Glance - # glance: - # loadBalancer: - # servers: - # - url: "http://glance:8080" - - # Watercrawl - watercrawl: - loadBalancer: - servers: - - url: "http://nginx:80" - - # N8N - n8n: - loadBalancer: - servers: - - url: "http://n8n:5678" - - # Gitea - gitea: - loadBalancer: - servers: - - url: "http://gitea:3000" - # MeTube - metube: - loadBalancer: - servers: - - url: "http://metube:8081" - serversTransports: insecureTransport: insecureSkipVerify: true diff --git a/traefik/dynamic/services.yml b/traefik/dynamic/services.yml new file mode 100644 index 0000000..c53d2ac --- /dev/null +++ b/traefik/dynamic/services.yml @@ -0,0 +1,75 @@ +http: + services: + # Portainer + portainer: + loadBalancer: + servers: + - url: "https://portainer:9443" + serversTransport: insecureTransport + + # AdGuard Home + adguard: + loadBalancer: + servers: + - url: "http://adguardhome:3000" + + # Nextcloud AIO Interface + nextcloud-aio: + loadBalancer: + servers: + - url: "https://nextcloud-aio-mastercontainer:8080" + serversTransport: insecureTransport + + # Nextcloud Main + nextcloud: + loadBalancer: + servers: + - url: "http://nextcloud-aio-apache:11000" + + # Uptime Kuma + uptime-kuma: + loadBalancer: + servers: + - url: "http://uptime-kuma:3001" + + # Termix + termix: + loadBalancer: + servers: + - url: "http://termix:8080" + + # Dockmon + dockmon: + loadBalancer: + servers: + - url: "https://dockmon:443" + serversTransport: insecureTransport + + # # Glance + # glance: + # loadBalancer: + # servers: + # - url: "http://glance:8080" + + # Watercrawl + watercrawl: + loadBalancer: + servers: + - url: "http://nginx:80" + + # N8N + n8n: + loadBalancer: + servers: + - url: "http://n8n:5678" + + # Gitea + gitea: + loadBalancer: + servers: + - url: "http://gitea:3000" + # MeTube + metube: + loadBalancer: + servers: + - url: "http://metube:8081"