Refactor Traefik configuration for improved TLS settings and service routing

traefik-docker-compose.yaml

@@ -8,22 +8,21 @@ services:
       - "--api.dashboard=true"
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
-    - "--providers.docker.network=proxy"
+      - "--providers.docker.network=traefik-proxy"
       - "--entryPoints.web.address=:80"
       - "--entryPoints.websecure.address=:443"
       - "--entryPoints.websecure.http.tls=true"
       - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
       - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
-    - --serversTransport.insecureSkipVerify=true
-    - "--providers.file.directory=/etc/traefik/dynamic/"
+      - "--serversTransport.insecureSkipVerify=true"
+      - "--providers.file.directory=/etc/traefik/dynamic"
       - "--providers.file.watch=true"
-    # Let's Encrypt
-    - "--certificatesresolvers.le.acme.email=${EMAIL:-bobrovod@national.shitposting.agency}"
-    - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
-    - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
     labels:
       - "traefik.enable=true"
-    - "traefik.docker.network=traefik-proxy"
+      - "traefik.http.routers.traefik.rule=Host(`traefik.workstation`)"
+      - "traefik.http.routers.traefik.entrypoints=websecure"
+      - "traefik.http.routers.traefik.service=api@internal"
+      - "traefik.http.routers.traefik.tls=true"
     ports:
       - "80:80"
       - "443:443"
@@ -32,9 +31,9 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./traefik/certs:/certs:ro
       - ./traefik/dynamic:/etc/traefik/dynamic:ro
-      - ./traefik/letsencrypt:/letsencrypt
     networks:
       - traefik-proxy 
+
 networks:
   traefik-proxy:
     external: true

traefik/dynamic/services.yml

@@ -6,8 +6,7 @@ http:
       entryPoints:
         - websecure
       service: api@internal
-      tls:
-        certResolver: le
+      tls: {}
 
     # Portainer
     portainer:
@@ -15,8 +14,7 @@ http:
       entryPoints:
         - websecure
       service: portainer
-      tls:
-        certResolver: le
+      tls: {}
 
     # AdGuard Home
     adguard-redirect:
@@ -32,8 +30,7 @@ http:
       entryPoints:
         - websecure
       service: adguard
-      tls:
-        certResolver: le
+      tls: {}
 
     # Nextcloud AIO Interface
     nextcloud-aio:
@@ -41,8 +38,7 @@ http:
       entryPoints:
         - websecure
       service: nextcloud-aio
-      tls:
-        certResolver: le
+      tls: {}
 
     # Nextcloud Main
     nextcloud:
@@ -50,8 +46,7 @@ http:
       entryPoints:
         - websecure
       service: nextcloud
-      tls:
-        certResolver: le
+      tls: {}
 
     # Dockmon
     dockmon:
@@ -59,8 +54,7 @@ http:
       entryPoints:
         - websecure
       service: dockmon
-      tls:
-        certResolver: le
+      tls: {}
 
     # Glance
     glance:
@@ -68,8 +62,7 @@ http:
       entryPoints:
         - websecure
       service: glance
-      tls:
-        certResolver: le
+      tls: {}
 
     # Watercrawl (edu_master)
     watercrawl:
@@ -77,8 +70,7 @@ http:
       entryPoints:
         - websecure
       service: watercrawl
-      tls:
-        certResolver: le
+      tls: {}
 
     # N8N
     n8n:
@@ -86,8 +78,7 @@ http:
       entryPoints:
         - websecure
       service: n8n
-      tls:
-        certResolver: le
+      tls: {}
 
   services:
     # Portainer

traefik/dynamic/tls.yml

@@ -1,4 +1,19 @@
 tls:
   certificates:
-    - certFile: /certs/workstation+3.pem
-      keyFile: /certs/workstation+3-key.pem
+    - certFile: /certs/workstation+1.pem
+      keyFile: /certs/workstation+1-key.pem
+  
+  stores:
+    default:
+      defaultCertificate:
+        certFile: /certs/workstation+1.pem
+        keyFile: /certs/workstation+1-key.pem
+  
+  options:
+    default:
+      minVersion: VersionTLS12
+      sniStrict: true
+      cipherSuites:
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305