forust/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Wiki Activity

cloudflare + letsencrypt

Browse Source
This commit is contained in:
mr-forust
2025-11-14 01:08:32 +02:00
parent bf0a7fe383
commit ce80873ac2
3 changed files with 136 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gitea-docker-compose.yaml
+7 -3
View File
@@ -10,6 +10,9 @@ services:
- GITEA__database__NAME=gitea
- GITEA__database__USER=gitea
- GITEA__database__PASSWD=gitea
- GITEA__server__DOMAIN=gitea.forust.xyz
- GITEA__server__ROOT_URL=https://gitea.forust.xyz/
- GITEA__server__SSH_DOMAIN=gitea.forust.xyz
restart: always
networks:
- gitea
@@ -19,13 +22,13 @@ services:
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
labels:
- traefik.enable=true
- traefik.docker.network=traefik-proxy
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
ports:
# - "3200:3000"
- "222:22"
depends_on:
- db
db:
image: docker.io/library/postgres:14
restart: always
@@ -37,6 +40,7 @@ services:
- gitea
volumes:
- ./volumes/gitea/postgres:/var/lib/postgresql/data
networks:
gitea:
external: false
traefik-docker-compose.yaml
+28 -5
View File
@@ -14,27 +14,50 @@ services:
- "--entryPoints.websecure.http.tls=true"
- "--entryPoints.web.http.redirections.entryPoint.to=websecure"
- "--entryPoints.web.http.redirections.entryPoint.scheme=https"
- "--serversTransport.insecureSkipVerify=true"
- "--providers.file.directory=/etc/traefik/dynamic"
- "--providers.file.watch=true"
# Let's Encrypt STAGING
- "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
- "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
- "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
- "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
# Cloudflare - получение реальных IP
- "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
# Логирование для отладки
- "--log.level=DEBUG"
- "--log.filePath=/var/log/traefik/traefik.log"
- "--accesslog=true"
- "--accesslog.filepath=/var/log/traefik/access.log"
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- glance.name=Traefik
# - glance.icon=si:traefik
- glance.url=https://traefik.${HOST}/
- glance.description=Traefik is a modern reverse proxy and load balancer that makes deploying microservices easy.
- glance.description=Traefik is a modern reverse proxy and load balancer
ports:
- "80:80"
- "443:443"
- "8080:8080"
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./traefik/certs:/certs:ro
- ./traefik/letsencrypt:/letsencrypt
- ./traefik/dynamic:/etc/traefik/dynamic:ro
- ./traefik/logs:/var/log/traefik
- ./traefik/certs:/certs:ro
networks:
- traefik-proxy
environment:
- TZ=Europe/Bratislava
networks:
traefik-proxy:
external: true
traefik/dynamic/services.yml
+100 -35
View File
@@ -2,102 +2,112 @@ http:
routers:
# Traefik Dashboard
traefik-dashboard:
rule: "Host(`traefik.workstation`)"
rule: "Host(`traefik.forust.xyz`)"
entryPoints:
- websecure
service: api@internal
tls: {}
middlewares:
- auth
- security-headers
tls:
certResolver: letsencrypt
# Portainer
portainer:
rule: "Host(`portainer.workstation`)"
rule: "Host(`portainer.forust.xyz`)"
entryPoints:
- websecure
service: portainer
tls: {}
middlewares:
- security-headers
tls:
certResolver: letsencrypt
# AdGuard Home
adguard-redirect:
rule: "Host(`adguard.workstation`)"
entryPoints:
- web
middlewares:
- redirect-https
service: adguard
adguard-secure:
rule: "Host(`adguard.workstation`)"
adguard:
rule: "Host(`adguard.forust.xyz`)"
entryPoints:
- websecure
service: adguard
tls: {}
middlewares:
- security-headers
tls:
certResolver: letsencrypt
# Nextcloud AIO Interface
# Nextcloud AIO Interface (локальный)
nextcloud-aio:
rule: "Host(`nextcloud-aio.workstation`)"
entryPoints:
- websecure
service: nextcloud-aio
middlewares:
- security-headers
tls: {}
# Nextcloud Main
nextcloud:
rule: "Host(`nextcloud.workstation`)"
rule: "Host(`nextcloud.forust.xyz`)"
entrypoints:
- websecure
service: nextcloud
middlewares:
- nextcloud-chain
tls: {}
tls:
certResolver: letsencrypt
# Dockmon
dockmon:
rule: "Host(`dockmon.workstation`)"
rule: "Host(`dockmon.forust.xyz`)"
entryPoints:
- websecure
service: dockmon
tls: {}
middlewares:
- dockmon-auth
- security-headers
tls:
certResolver: letsencrypt
# Glance
# Glance (локальный)
glance:
rule: "Host(`glance.workstation`)"
entryPoints:
- websecure
service: glance
middlewares:
- security-headers
tls: {}
# Watercrawl (edu_master)
# Watercrawl (локальный)
watercrawl:
rule: "Host(`watercrawl.workstation`)"
entryPoints:
- websecure
service: watercrawl
middlewares:
- security-headers
tls: {}
# N8N
n8n:
rule: "Host(`n8n.workstation`)"
rule: "Host(`n8n.forust.xyz`)"
entryPoints:
- websecure
service: n8n
tls: {}
# Gitea Redirect
gitea-redirect:
rule: "Host(`gitea.workstation`)"
entryPoints:
- web
middlewares:
- redirect-https
service: gitea
- security-headers
tls:
certResolver: letsencrypt
# Gitea
gitea:
rule: "Host(`gitea.workstation`)"
rule: "Host(`gitea.forust.xyz`)"
entryPoints:
- websecure
service: gitea
tls: {}
middlewares:
- security-headers
tls:
certResolver: letsencrypt
services:
# Portainer
@@ -105,6 +115,7 @@ http:
loadBalancer:
servers:
- url: "https://portainer:9443"
serversTransport: insecureTransport
# AdGuard Home
adguard:
@@ -117,6 +128,7 @@ http:
loadBalancer:
servers:
- url: "https://nextcloud-aio-mastercontainer:8080"
serversTransport: insecureTransport
# Nextcloud Main
nextcloud:
@@ -129,6 +141,7 @@ http:
loadBalancer:
servers:
- url: "https://dockmon:443"
serversTransport: insecureTransport
# Glance
glance:
@@ -154,6 +167,10 @@ http:
servers:
- url: "http://gitea:3000"
serversTransports:
insecureTransport:
insecureSkipVerify: true
middlewares:
# HTTPS Redirect
redirect-https:
@@ -161,6 +178,40 @@ http:
scheme: https
permanent: true
# Basic Auth для Traefik Dashboard
auth:
basicAuth:
users:
- "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
realm: "Traefik Dashboard"
# Basic Auth для Dockmon
dockmon-auth:
basicAuth:
users:
- "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
realm: "Dockmon Access"
# Cloudflare IP Whitelist (опционально)
cloudflare-ipwhitelist:
ipWhiteList:
sourceRange:
- "173.245.48.0/20"
- "103.21.244.0/22"
- "103.22.200.0/22"
- "103.31.4.0/22"
- "141.101.64.0/18"
- "108.162.192.0/18"
- "190.93.240.0/20"
- "188.114.96.0/20"
- "197.234.240.0/22"
- "198.41.128.0/17"
- "162.158.0.0/15"
- "104.16.0.0/13"
- "104.24.0.0/14"
- "172.64.0.0/13"
- "131.0.72.0/22"
# Security Headers
security-headers:
headers:
@@ -171,15 +222,29 @@ http:
stsPreload: true
stsSeconds: 31536000
customFrameOptionsValue: "SAMEORIGIN"
customResponseHeaders:
X-Content-Type-Options: "nosniff"
Referrer-Policy: "strict-origin-when-cross-origin"
# Nextcloud specific headers
nextcloud-secure-headers:
headers:
hostsProxyHeaders:
- "X-Forwarded-Host"
- "X-Forwarded-Proto"
referrerPolicy: "same-origin"
customFrameOptionsValue: "SAMEORIGIN"
# Rate limiting
rate-limit:
rateLimit:
average: 100
burst: 50
period: 1m
# Nextcloud chain
nextcloud-chain:
chain:
middlewares:
- redirect-https
- nextcloud-secure-headers
- security-headers