Merge branch 'main' into metube
This commit is contained in:
@@ -0,0 +1,69 @@
|
||||
services:
|
||||
traefik:
|
||||
image: traefik:v3.5
|
||||
container_name: traefik
|
||||
restart: unless-stopped
|
||||
command:
|
||||
# API
|
||||
- "--api.insecure=false"
|
||||
- "--api.dashboard=true"
|
||||
|
||||
# Providers
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--providers.docker.network=traefik-proxy"
|
||||
- "--providers.file.directory=/etc/traefik/dynamic"
|
||||
- "--providers.file.watch=true"
|
||||
|
||||
# EntryPoints
|
||||
- "--entryPoints.web.address=:80"
|
||||
- "--entryPoints.websecure.address=:443"
|
||||
- "--entryPoints.websecure.http.tls=true"
|
||||
- "--entryPoints.web.http.redirections.entryPoint.to=websecure"
|
||||
- "--entryPoints.web.http.redirections.entryPoint.scheme=https"
|
||||
- "--entryPoints.ssh.address=:2221"
|
||||
|
||||
# Let's Encrypt STAGING. CURRENTLY USING CF ORIGIN CA INSTEAD
|
||||
# - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
|
||||
# - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
|
||||
# - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
|
||||
# - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
|
||||
# - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
|
||||
|
||||
# Cloudflare
|
||||
- "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
|
||||
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
|
||||
|
||||
# Logging
|
||||
- "--log.level=INFO"
|
||||
- "--log.filePath=/var/log/traefik/traefik.log"
|
||||
- "--accesslog=true"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik-proxy"
|
||||
- glance.name=Traefik
|
||||
- glance.url=https://traefik.forust.xyz/
|
||||
- glance.description=Traefik is a modern reverse proxy and load balancer
|
||||
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- ./dynamic:/etc/traefik/dynamic:ro
|
||||
- ./certs:/certs:ro
|
||||
- ./logs:/var/log/traefik
|
||||
# - ./traefik/letsencrypt:/letsencrypt
|
||||
|
||||
networks:
|
||||
- traefik-proxy
|
||||
|
||||
environment:
|
||||
- TZ=Europe/Bratislava
|
||||
|
||||
networks:
|
||||
traefik-proxy:
|
||||
external: true
|
||||
@@ -1,6 +1,6 @@
|
||||
http:
|
||||
routers:
|
||||
# Traefik Dashboard
|
||||
# Traefik Dashboard (ADMIN, local only)
|
||||
traefik-dashboard:
|
||||
rule: "Host(`traefik.workstation`)"
|
||||
entryPoints:
|
||||
@@ -10,7 +10,16 @@ http:
|
||||
# - auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
# certResolver: letsencrypt
|
||||
|
||||
# Nextcloud AIO Interface (ADMIN, local is better)
|
||||
nextcloud-aio:
|
||||
rule: "Host(`nextcloud-aio.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: nextcloud-aio
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# MeTube
|
||||
metube:
|
||||
@@ -24,7 +33,7 @@ http:
|
||||
tls:
|
||||
certResolver: letsencrypt
|
||||
|
||||
# Portainer
|
||||
# Portainer (public (account required))
|
||||
portainer:
|
||||
rule: "Host(`portainer.forust.xyz`)"
|
||||
entryPoints:
|
||||
@@ -32,31 +41,20 @@ http:
|
||||
service: portainer
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls:
|
||||
certResolver: letsencrypt
|
||||
tls: {}
|
||||
|
||||
# AdGuard Home
|
||||
# AdGuard Home (public (account required))
|
||||
adguard:
|
||||
rule: "Host(`adguard.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: adguard
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls:
|
||||
certResolver: letsencrypt
|
||||
|
||||
# Nextcloud AIO Interface (локальный)
|
||||
nextcloud-aio:
|
||||
rule: "Host(`nextcloud-aio.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: nextcloud-aio
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Nextcloud Main
|
||||
|
||||
# Nextcloud Main (public (account required))
|
||||
nextcloud:
|
||||
rule: "Host(`nextcloud.forust.xyz`)"
|
||||
entrypoints:
|
||||
@@ -64,10 +62,9 @@ http:
|
||||
service: nextcloud
|
||||
middlewares:
|
||||
- nextcloud-chain
|
||||
tls:
|
||||
certResolver: letsencrypt
|
||||
tls: {}
|
||||
|
||||
# Dockmon
|
||||
# Dockmon (public (account required))
|
||||
dockmon:
|
||||
rule: "Host(`dockmon.forust.xyz`)"
|
||||
entryPoints:
|
||||
@@ -76,20 +73,30 @@ http:
|
||||
middlewares:
|
||||
# - dockmon-auth
|
||||
- security-headers
|
||||
tls:
|
||||
certResolver: letsencrypt
|
||||
tls: {}
|
||||
|
||||
# Glance (локальный)
|
||||
glance:
|
||||
rule: "Host(`glance.workstation`)"
|
||||
# Gitea (public (account required))
|
||||
gitea:
|
||||
rule: "Host(`gitea.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: glance
|
||||
- ssh
|
||||
service: gitea
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Watercrawl (локальный)
|
||||
# # Glance (local only)
|
||||
# glance:
|
||||
# rule: "Host(`glance.workstation`)"
|
||||
# entryPoints:
|
||||
# - websecure
|
||||
# service: glance
|
||||
# middlewares:
|
||||
# - security-headers
|
||||
# tls: {}
|
||||
|
||||
# Watercrawl (local only)
|
||||
watercrawl:
|
||||
rule: "Host(`watercrawl.workstation`)"
|
||||
entryPoints:
|
||||
@@ -99,7 +106,7 @@ http:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# N8N
|
||||
# N8N (local only)
|
||||
n8n:
|
||||
rule: "Host(`n8n.workstation`)"
|
||||
entryPoints:
|
||||
@@ -108,18 +115,7 @@ http:
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
# certResolver: letsencrypt
|
||||
|
||||
# Gitea
|
||||
gitea:
|
||||
rule: "Host(`gitea.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: gitea
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls:
|
||||
certResolver: letsencrypt
|
||||
|
||||
services:
|
||||
# Portainer
|
||||
@@ -155,11 +151,11 @@ http:
|
||||
- url: "https://dockmon:443"
|
||||
serversTransport: insecureTransport
|
||||
|
||||
# Glance
|
||||
glance:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://glance:8080"
|
||||
# # Glance
|
||||
# glance:
|
||||
# loadBalancer:
|
||||
# servers:
|
||||
# - url: "http://glance:8080"
|
||||
|
||||
# Watercrawl
|
||||
watercrawl:
|
||||
@@ -172,7 +168,7 @@ http:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://n8n:5678"
|
||||
|
||||
|
||||
# Gitea
|
||||
gitea:
|
||||
loadBalancer:
|
||||
@@ -202,21 +198,21 @@ http:
|
||||
- "vv:$2y$05$oO.mQXBZSJq7aDRJF1iorudafu9HsrJCEfKb6Cev8UlzWOF8kzlY6"
|
||||
realm: "MeTube Access"
|
||||
|
||||
# Basic Auth для Traefik Dashboard
|
||||
# Basic Auth Traefik Dashboard
|
||||
auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
|
||||
realm: "Traefik Dashboard"
|
||||
|
||||
# Basic Auth для Dockmon
|
||||
# Basic Auth Dockmon
|
||||
dockmon-auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
|
||||
realm: "Dockmon Access"
|
||||
|
||||
# Cloudflare IP Whitelist (опционально)
|
||||
# Cloudflare IP Whitelist
|
||||
cloudflare-ipwhitelist:
|
||||
ipWhiteList:
|
||||
sourceRange:
|
||||
@@ -271,4 +267,30 @@ http:
|
||||
chain:
|
||||
middlewares:
|
||||
- nextcloud-secure-headers
|
||||
- security-headers
|
||||
- security-headers
|
||||
|
||||
# TLS Configuration
|
||||
tls:
|
||||
certificates:
|
||||
# Cloudflare Origin CA *.forust.xyz
|
||||
- certFile: /certs/cloudflare.pem
|
||||
keyFile: /certs/cloudflare.key
|
||||
# Local certificate
|
||||
- certFile: /certs/workstation+1.pem
|
||||
keyFile: /certs/workstation+1-key.pem
|
||||
|
||||
stores:
|
||||
default:
|
||||
defaultCertificate:
|
||||
# Fallback local certificate
|
||||
certFile: /certs/workstation+1.pem
|
||||
keyFile: /certs/workstation+1-key.pem
|
||||
|
||||
options:
|
||||
default:
|
||||
minVersion: VersionTLS12
|
||||
sniStrict: true
|
||||
cipherSuites:
|
||||
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|
||||
@@ -1,19 +0,0 @@
|
||||
tls:
|
||||
certificates:
|
||||
- certFile: /certs/workstation+1.pem
|
||||
keyFile: /certs/workstation+1-key.pem
|
||||
stores:
|
||||
default:
|
||||
defaultCertificate:
|
||||
certFile: /certs/cloudflare.pem
|
||||
keyFile: /certs/cloudflare.key
|
||||
|
||||
|
||||
options:
|
||||
default:
|
||||
minVersion: VersionTLS12
|
||||
sniStrict: true
|
||||
cipherSuites:
|
||||
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|
||||
Reference in New Issue
Block a user