From ce80873ac280c93ceb9fc0db22c871ee06915372 Mon Sep 17 00:00:00 2001 From: mr-forust Date: Fri, 14 Nov 2025 01:08:32 +0200 Subject: [PATCH] cloudflare + letsencrypt --- gitea-docker-compose.yaml | 10 ++- traefik-docker-compose.yaml | 35 +++++++-- traefik/dynamic/services.yml | 135 ++++++++++++++++++++++++++--------- 3 files changed, 136 insertions(+), 44 deletions(-) diff --git a/gitea-docker-compose.yaml b/gitea-docker-compose.yaml index 4efcb3b..8f510ac 100644 --- a/gitea-docker-compose.yaml +++ b/gitea-docker-compose.yaml @@ -10,6 +10,9 @@ services: - GITEA__database__NAME=gitea - GITEA__database__USER=gitea - GITEA__database__PASSWD=gitea + - GITEA__server__DOMAIN=gitea.forust.xyz + - GITEA__server__ROOT_URL=https://gitea.forust.xyz/ + - GITEA__server__SSH_DOMAIN=gitea.forust.xyz restart: always networks: - gitea @@ -19,13 +22,13 @@ services: - /etc/timezone:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro labels: - - traefik.enable=true - - traefik.docker.network=traefik-proxy + - "traefik.enable=true" + - "traefik.docker.network=traefik-proxy" ports: - # - "3200:3000" - "222:22" depends_on: - db + db: image: docker.io/library/postgres:14 restart: always @@ -37,6 +40,7 @@ services: - gitea volumes: - ./volumes/gitea/postgres:/var/lib/postgresql/data + networks: gitea: external: false diff --git a/traefik-docker-compose.yaml b/traefik-docker-compose.yaml index 2a79e71..614306c 100644 --- a/traefik-docker-compose.yaml +++ b/traefik-docker-compose.yaml @@ -14,26 +14,49 @@ services: - "--entryPoints.websecure.http.tls=true" - "--entryPoints.web.http.redirections.entryPoint.to=websecure" - "--entryPoints.web.http.redirections.entryPoint.scheme=https" - - "--serversTransport.insecureSkipVerify=true" - "--providers.file.directory=/etc/traefik/dynamic" - "--providers.file.watch=true" + + # Let's Encrypt STAGING + - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}" + - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json" + - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory" + - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true" + - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web" + + # Cloudflare - получение реальных IP + - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22" + - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22" + + # Логирование для отладки + - "--log.level=DEBUG" + - "--log.filePath=/var/log/traefik/traefik.log" + - "--accesslog=true" + - "--accesslog.filepath=/var/log/traefik/access.log" + labels: - "traefik.enable=true" - "traefik.docker.network=traefik-proxy" - glance.name=Traefik - # - glance.icon=si:traefik - glance.url=https://traefik.${HOST}/ - - glance.description=Traefik is a modern reverse proxy and load balancer that makes deploying microservices easy. + - glance.description=Traefik is a modern reverse proxy and load balancer + ports: - "80:80" - "443:443" - - "8080:8080" + volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - - ./traefik/certs:/certs:ro + - ./traefik/letsencrypt:/letsencrypt - ./traefik/dynamic:/etc/traefik/dynamic:ro + - ./traefik/logs:/var/log/traefik + - ./traefik/certs:/certs:ro + networks: - - traefik-proxy + - traefik-proxy + + environment: + - TZ=Europe/Bratislava networks: traefik-proxy: diff --git a/traefik/dynamic/services.yml b/traefik/dynamic/services.yml index 2473cba..a4a0b55 100644 --- a/traefik/dynamic/services.yml +++ b/traefik/dynamic/services.yml @@ -2,102 +2,112 @@ http: routers: # Traefik Dashboard traefik-dashboard: - rule: "Host(`traefik.workstation`)" + rule: "Host(`traefik.forust.xyz`)" entryPoints: - websecure service: api@internal - tls: {} + middlewares: + - auth + - security-headers + tls: + certResolver: letsencrypt # Portainer portainer: - rule: "Host(`portainer.workstation`)" + rule: "Host(`portainer.forust.xyz`)" entryPoints: - websecure service: portainer - tls: {} + middlewares: + - security-headers + tls: + certResolver: letsencrypt # AdGuard Home - adguard-redirect: - rule: "Host(`adguard.workstation`)" - entryPoints: - - web - middlewares: - - redirect-https - service: adguard - - adguard-secure: - rule: "Host(`adguard.workstation`)" + adguard: + rule: "Host(`adguard.forust.xyz`)" entryPoints: - websecure service: adguard - tls: {} + middlewares: + - security-headers + tls: + certResolver: letsencrypt - # Nextcloud AIO Interface + # Nextcloud AIO Interface (локальный) nextcloud-aio: rule: "Host(`nextcloud-aio.workstation`)" entryPoints: - websecure service: nextcloud-aio + middlewares: + - security-headers tls: {} # Nextcloud Main nextcloud: - rule: "Host(`nextcloud.workstation`)" + rule: "Host(`nextcloud.forust.xyz`)" entrypoints: - websecure service: nextcloud middlewares: - nextcloud-chain - tls: {} + tls: + certResolver: letsencrypt # Dockmon dockmon: - rule: "Host(`dockmon.workstation`)" + rule: "Host(`dockmon.forust.xyz`)" entryPoints: - websecure service: dockmon - tls: {} + middlewares: + - dockmon-auth + - security-headers + tls: + certResolver: letsencrypt - # Glance + # Glance (локальный) glance: rule: "Host(`glance.workstation`)" entryPoints: - websecure service: glance + middlewares: + - security-headers tls: {} - # Watercrawl (edu_master) + # Watercrawl (локальный) watercrawl: rule: "Host(`watercrawl.workstation`)" entryPoints: - websecure service: watercrawl + middlewares: + - security-headers tls: {} # N8N n8n: - rule: "Host(`n8n.workstation`)" + rule: "Host(`n8n.forust.xyz`)" entryPoints: - websecure service: n8n - tls: {} - - # Gitea Redirect - gitea-redirect: - rule: "Host(`gitea.workstation`)" - entryPoints: - - web middlewares: - - redirect-https - service: gitea + - security-headers + tls: + certResolver: letsencrypt # Gitea gitea: - rule: "Host(`gitea.workstation`)" + rule: "Host(`gitea.forust.xyz`)" entryPoints: - websecure service: gitea - tls: {} + middlewares: + - security-headers + tls: + certResolver: letsencrypt services: # Portainer @@ -105,6 +115,7 @@ http: loadBalancer: servers: - url: "https://portainer:9443" + serversTransport: insecureTransport # AdGuard Home adguard: @@ -117,6 +128,7 @@ http: loadBalancer: servers: - url: "https://nextcloud-aio-mastercontainer:8080" + serversTransport: insecureTransport # Nextcloud Main nextcloud: @@ -129,6 +141,7 @@ http: loadBalancer: servers: - url: "https://dockmon:443" + serversTransport: insecureTransport # Glance glance: @@ -154,6 +167,10 @@ http: servers: - url: "http://gitea:3000" + serversTransports: + insecureTransport: + insecureSkipVerify: true + middlewares: # HTTPS Redirect redirect-https: @@ -161,6 +178,40 @@ http: scheme: https permanent: true + # Basic Auth для Traefik Dashboard + auth: + basicAuth: + users: + - "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9." + realm: "Traefik Dashboard" + + # Basic Auth для Dockmon + dockmon-auth: + basicAuth: + users: + - "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1" + realm: "Dockmon Access" + + # Cloudflare IP Whitelist (опционально) + cloudflare-ipwhitelist: + ipWhiteList: + sourceRange: + - "173.245.48.0/20" + - "103.21.244.0/22" + - "103.22.200.0/22" + - "103.31.4.0/22" + - "141.101.64.0/18" + - "108.162.192.0/18" + - "190.93.240.0/20" + - "188.114.96.0/20" + - "197.234.240.0/22" + - "198.41.128.0/17" + - "162.158.0.0/15" + - "104.16.0.0/13" + - "104.24.0.0/14" + - "172.64.0.0/13" + - "131.0.72.0/22" + # Security Headers security-headers: headers: @@ -171,15 +222,29 @@ http: stsPreload: true stsSeconds: 31536000 customFrameOptionsValue: "SAMEORIGIN" + customResponseHeaders: + X-Content-Type-Options: "nosniff" + Referrer-Policy: "strict-origin-when-cross-origin" + # Nextcloud specific headers nextcloud-secure-headers: headers: hostsProxyHeaders: - "X-Forwarded-Host" + - "X-Forwarded-Proto" referrerPolicy: "same-origin" + customFrameOptionsValue: "SAMEORIGIN" + # Rate limiting + rate-limit: + rateLimit: + average: 100 + burst: 50 + period: 1m + + # Nextcloud chain nextcloud-chain: chain: middlewares: - - redirect-https - nextcloud-secure-headers + - security-headers \ No newline at end of file