cloudflare + letsencrypt

gitea-docker-compose.yaml

@@ -10,6 +10,9 @@ services:
       - GITEA__database__NAME=gitea
       - GITEA__database__USER=gitea
       - GITEA__database__PASSWD=gitea
+      - GITEA__server__DOMAIN=gitea.forust.xyz
+      - GITEA__server__ROOT_URL=https://gitea.forust.xyz/
+      - GITEA__server__SSH_DOMAIN=gitea.forust.xyz
     restart: always
     networks:
       - gitea
@@ -19,13 +22,13 @@ services:
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     labels:
-      - traefik.enable=true
+      - "traefik.enable=true"
-      - traefik.docker.network=traefik-proxy
+      - "traefik.docker.network=traefik-proxy"
     ports:
-      # - "3200:3000"
       - "222:22"
     depends_on:
       - db
+      
   db:
     image: docker.io/library/postgres:14
     restart: always
@@ -37,6 +40,7 @@ services:
       - gitea
     volumes:
       - ./volumes/gitea/postgres:/var/lib/postgresql/data
+      
 networks:
   gitea:
     external: false

traefik-docker-compose.yaml

@@ -14,26 +14,49 @@ services:
       - "--entryPoints.websecure.http.tls=true"
       - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
       - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
-      - "--serversTransport.insecureSkipVerify=true"
       - "--providers.file.directory=/etc/traefik/dynamic"
       - "--providers.file.watch=true"
+      
+      # Let's Encrypt STAGING
+      - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
+      
+      # Cloudflare - получение реальных IP
+      - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
+      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
+      
+      # Логирование для отладки
+      - "--log.level=DEBUG"
+      - "--log.filePath=/var/log/traefik/traefik.log"
+      - "--accesslog=true"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
+      
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
       - glance.name=Traefik
-      # - glance.icon=si:traefik
       - glance.url=https://traefik.${HOST}/
-      - glance.description=Traefik is a modern reverse proxy and load balancer that makes deploying microservices easy.
+      - glance.description=Traefik is a modern reverse proxy and load balancer
+      
     ports:
       - "80:80"
       - "443:443"
-      - "8080:8080"
+      
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./traefik/certs:/certs:ro
+      - ./traefik/letsencrypt:/letsencrypt
       - ./traefik/dynamic:/etc/traefik/dynamic:ro
+      - ./traefik/logs:/var/log/traefik
+      - ./traefik/certs:/certs:ro
+      
     networks:
-      - traefik-proxy 
+      - traefik-proxy
+      
+    environment:
+      - TZ=Europe/Bratislava
 
 networks:
   traefik-proxy:

traefik/dynamic/services.yml

@@ -2,102 +2,112 @@ http:
   routers:
     # Traefik Dashboard
     traefik-dashboard:
-      rule: "Host(`traefik.workstation`)"
+      rule: "Host(`traefik.forust.xyz`)"
       entryPoints:
         - websecure
       service: api@internal
-      tls: {}
+      middlewares:
+        - auth
+        - security-headers
+      tls:
+        certResolver: letsencrypt
 
     # Portainer
     portainer:
-      rule: "Host(`portainer.workstation`)"
+      rule: "Host(`portainer.forust.xyz`)"
       entryPoints:
         - websecure
       service: portainer
-      tls: {}
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
 
     # AdGuard Home
-    adguard-redirect:
+    adguard:
-      rule: "Host(`adguard.workstation`)"
+      rule: "Host(`adguard.forust.xyz`)"
-      entryPoints:
-        - web
-      middlewares:
-        - redirect-https
-      service: adguard
-
-    adguard-secure:
-      rule: "Host(`adguard.workstation`)"
       entryPoints:
         - websecure
       service: adguard
-      tls: {}
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
 
-    # Nextcloud AIO Interface
+    # Nextcloud AIO Interface (локальный)
     nextcloud-aio:
       rule: "Host(`nextcloud-aio.workstation`)"
       entryPoints:
         - websecure
       service: nextcloud-aio
+      middlewares:
+        - security-headers
       tls: {}
 
     # Nextcloud Main
     nextcloud:
-      rule: "Host(`nextcloud.workstation`)"
+      rule: "Host(`nextcloud.forust.xyz`)"
       entrypoints:
         - websecure
       service: nextcloud
       middlewares:
         - nextcloud-chain
-      tls: {}
+      tls:
+        certResolver: letsencrypt
 
     # Dockmon
     dockmon:
-      rule: "Host(`dockmon.workstation`)"
+      rule: "Host(`dockmon.forust.xyz`)"
       entryPoints:
         - websecure
       service: dockmon
-      tls: {}
+      middlewares:
+        - dockmon-auth
+        - security-headers
+      tls:
+        certResolver: letsencrypt
 
-    # Glance
+    # Glance (локальный)
     glance:
       rule: "Host(`glance.workstation`)"
       entryPoints:
         - websecure
       service: glance
+      middlewares:
+        - security-headers
       tls: {}
 
-    # Watercrawl (edu_master)
+    # Watercrawl (локальный)
     watercrawl:
       rule: "Host(`watercrawl.workstation`)"
       entryPoints:
         - websecure
       service: watercrawl
+      middlewares:
+        - security-headers
       tls: {}
 
     # N8N
     n8n:
-      rule: "Host(`n8n.workstation`)"
+      rule: "Host(`n8n.forust.xyz`)"
       entryPoints:
         - websecure
       service: n8n
-      tls: {}
-    
-    # Gitea Redirect
-    gitea-redirect:
-      rule: "Host(`gitea.workstation`)"
-      entryPoints:
-        - web
       middlewares:
-        - redirect-https
+        - security-headers
-      service: gitea
+      tls:
+        certResolver: letsencrypt
 
     # Gitea
     gitea:
-      rule: "Host(`gitea.workstation`)"
+      rule: "Host(`gitea.forust.xyz`)"
       entryPoints:
         - websecure
       service: gitea
-      tls: {}
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
 
   services:
     # Portainer
@@ -105,6 +115,7 @@ http:
       loadBalancer:
         servers:
           - url: "https://portainer:9443"
+        serversTransport: insecureTransport
 
     # AdGuard Home
     adguard:
@@ -117,6 +128,7 @@ http:
       loadBalancer:
         servers:
           - url: "https://nextcloud-aio-mastercontainer:8080"
+        serversTransport: insecureTransport
 
     # Nextcloud Main
     nextcloud:
@@ -129,6 +141,7 @@ http:
       loadBalancer:
         servers:
           - url: "https://dockmon:443"
+        serversTransport: insecureTransport
 
     # Glance
     glance:
@@ -154,6 +167,10 @@ http:
         servers:
           - url: "http://gitea:3000"
 
+  serversTransports:
+    insecureTransport:
+      insecureSkipVerify: true
+
   middlewares:
     # HTTPS Redirect
     redirect-https:
@@ -161,6 +178,40 @@ http:
         scheme: https
         permanent: true
 
+    # Basic Auth для Traefik Dashboard
+    auth:
+      basicAuth:
+        users:
+          - "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
+        realm: "Traefik Dashboard"
+
+    # Basic Auth для Dockmon
+    dockmon-auth:
+      basicAuth:
+        users:
+          - "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
+        realm: "Dockmon Access"
+    
+    # Cloudflare IP Whitelist (опционально)
+    cloudflare-ipwhitelist:
+      ipWhiteList:
+        sourceRange:
+          - "173.245.48.0/20"
+          - "103.21.244.0/22"
+          - "103.22.200.0/22"
+          - "103.31.4.0/22"
+          - "141.101.64.0/18"
+          - "108.162.192.0/18"
+          - "190.93.240.0/20"
+          - "188.114.96.0/20"
+          - "197.234.240.0/22"
+          - "198.41.128.0/17"
+          - "162.158.0.0/15"
+          - "104.16.0.0/13"
+          - "104.24.0.0/14"
+          - "172.64.0.0/13"
+          - "131.0.72.0/22"
+
     # Security Headers
     security-headers:
       headers:
@@ -171,15 +222,29 @@ http:
         stsPreload: true
         stsSeconds: 31536000
         customFrameOptionsValue: "SAMEORIGIN"
+        customResponseHeaders:
+          X-Content-Type-Options: "nosniff"
+          Referrer-Policy: "strict-origin-when-cross-origin"
 
+    # Nextcloud specific headers
     nextcloud-secure-headers:
       headers:
         hostsProxyHeaders:
           - "X-Forwarded-Host"
+          - "X-Forwarded-Proto"
         referrerPolicy: "same-origin"
+        customFrameOptionsValue: "SAMEORIGIN"
 
+    # Rate limiting
+    rate-limit:
+      rateLimit:
+        average: 100
+        burst: 50
+        period: 1m
+
+    # Nextcloud chain
     nextcloud-chain:
       chain:
         middlewares:
-          - redirect-https
           - nextcloud-secure-headers
+          - security-headers