refactor: move traefik configuration to docker-compose files via labels

adguardhome/compose.yaml

@@ -19,8 +19,30 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.adguard.rule=Host(`adguard.forust.xyz`)"
+      - "traefik.http.routers.adguard.entrypoints=websecure"
+      - "traefik.http.routers.adguard.middlewares=security-headers"
+      - "traefik.http.routers.adguard.service=adguard"
+      - "traefik.http.routers.adguard.tls=true"
+      - "traefik.http.services.adguard.loadbalancer.server.port=3000"
+
+      # Local Router
+      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.local`) || Host(`adguard.local`)"
+      - "traefik.http.routers.adguard-local.entrypoints=websecure"
+      - "traefik.http.routers.adguard-local.middlewares=security-headers"
+      - "traefik.http.routers.adguard-local.service=adguard"
+      - "traefik.http.routers.adguard-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.local`)"
+      - "traefik.http.routers.adguard-dev.entrypoints=websecure"
+      - "traefik.http.routers.adguard-dev.middlewares=security-headers"
+      - "traefik.http.routers.adguard-dev.service=adguard"
+      - "traefik.http.routers.adguard-dev.tls=true"
+
       - glance.name=adguard
-      # - glance.icon=si:adguard
       - glance.url=https://adguard.forust.xyz/
       - glance.description=AdGuard Home is a network-wide software for blocking ads.
 networks:

dockmon/compose.yaml

@@ -20,8 +20,32 @@ services:
       labels:
          - "traefik.enable=true"
          - "traefik.docker.network=traefik-proxy"
+
+         # Prod Router
+         - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
+         - "traefik.http.routers.dockmon.entrypoints=websecure"
+         - "traefik.http.routers.dockmon.middlewares=security-headers,dockmon-auth"
+         - "traefik.http.routers.dockmon.service=dockmon"
+         - "traefik.http.routers.dockmon.tls=true"
+         - "traefik.http.services.dockmon.loadbalancer.server.port=443"
+         - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
+         - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
+
+         # Local Router
+         - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.local`) || Host(`dockmon.local`)"
+         - "traefik.http.routers.dockmon-local.entrypoints=websecure"
+         - "traefik.http.routers.dockmon-local.middlewares=security-headers"
+         - "traefik.http.routers.dockmon-local.service=dockmon"
+         - "traefik.http.routers.dockmon-local.tls=true"
+
+         # Dev Router
+         - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.local`)"
+         - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
+         - "traefik.http.routers.dockmon-dev.middlewares=security-headers"
+         - "traefik.http.routers.dockmon-dev.service=dockmon"
+         - "traefik.http.routers.dockmon-dev.tls=true"
+
          - glance.name=dockmon
-      # - glance.icon=sh:dockmon
          - glance.url=https://dockmon.forust.xyz/
          - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
 

gitea/compose.yaml

@@ -25,6 +25,28 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
+      - "traefik.http.routers.gitea.entrypoints=websecure"
+      - "traefik.http.routers.gitea.middlewares=security-headers"
+      - "traefik.http.routers.gitea.service=gitea"
+      - "traefik.http.routers.gitea.tls=true"
+      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
+
+      # Local Router
+      - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.local`) || Host(`gitea.local`)"
+      - "traefik.http.routers.gitea-local.entrypoints=websecure"
+      - "traefik.http.routers.gitea-local.middlewares=security-headers"
+      - "traefik.http.routers.gitea-local.service=gitea"
+      - "traefik.http.routers.gitea-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.gitea-dev.rule=Host(`gitea.gigaforust.local`)"
+      - "traefik.http.routers.gitea-dev.entrypoints=websecure"
+      - "traefik.http.routers.gitea-dev.middlewares=security-headers"
+      - "traefik.http.routers.gitea-dev.service=gitea"
+      - "traefik.http.routers.gitea-dev.tls=true"
     ports:
       - "2221:22"
     depends_on:

glance/compose.yaml

@@ -12,6 +12,24 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
+      - "traefik.http.routers.glance.entrypoints=websecure"
+      - "traefik.http.routers.glance.middlewares=security-headers"
+      - "traefik.http.routers.glance.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.glance-local.rule=Host(`glance.workstation.local`) || Host(`glance.local`)"
+      - "traefik.http.routers.glance-local.entrypoints=websecure"
+      - "traefik.http.routers.glance-local.middlewares=security-headers"
+      - "traefik.http.routers.glance-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.glance-dev.rule=Host(`glance.gigaforust.local`)"
+      - "traefik.http.routers.glance-dev.entrypoints=websecure"
+      - "traefik.http.routers.glance-dev.middlewares=security-headers"
+      - "traefik.http.routers.glance-dev.tls=true"
     networks:
       - traefik-proxy
     dns:

homepage/compose.yaml

@@ -8,6 +8,31 @@ services:
       - ./files:/usr/share/nginx/html
     networks:
       - traefik-proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)"
+      - "traefik.http.routers.forust-homepage.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage.middlewares=security-headers"
+      - "traefik.http.routers.forust-homepage.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage.tls=true"
+      - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
+
+      # Local Router
+      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.local`) || Host(`landing.local`)"
+      - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-local.middlewares=security-headers"
+      - "traefik.http.routers.forust-homepage-local.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.local`)"
+      - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers"
+      - "traefik.http.routers.forust-homepage-dev.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage-dev.tls=true"
 
 networks:
   traefik-proxy:

metube/compose.yaml

@@ -16,6 +16,28 @@ services:
       - traefik.enable=true
       - "traefik.docker.network=traefik-proxy"
 
+      # Prod Router
+      - "traefik.http.routers.metube.rule=Host(`metube.forust.xyz`)"
+      - "traefik.http.routers.metube.entrypoints=websecure"
+      - "traefik.http.routers.metube.middlewares=security-headers,metube-auth"
+      - "traefik.http.routers.metube.service=metube"
+      - "traefik.http.routers.metube.tls=true"
+      - "traefik.http.services.metube.loadbalancer.server.port=8081"
+
+      # Local Router
+      - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.local`) || Host(`metube.local`)"
+      - "traefik.http.routers.metube-local.entrypoints=websecure"
+      - "traefik.http.routers.metube-local.middlewares=security-headers,metube-auth"
+      - "traefik.http.routers.metube-local.service=metube"
+      - "traefik.http.routers.metube-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.metube-dev.rule=Host(`metube.gigaforust.local`)"
+      - "traefik.http.routers.metube-dev.entrypoints=websecure"
+      - "traefik.http.routers.metube-dev.middlewares=security-headers,metube-auth"
+      - "traefik.http.routers.metube-dev.service=metube"
+      - "traefik.http.routers.metube-dev.tls=true"
+
     networks:
       - traefik-proxy
 networks:

n8n/compose.yaml

@@ -28,6 +28,29 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.n8n.rule=Host(`n8n.forust.xyz`)"
+      - "traefik.http.routers.n8n.entrypoints=websecure"
+      - "traefik.http.routers.n8n.middlewares=security-headers"
+      - "traefik.http.routers.n8n.service=n8n"
+      - "traefik.http.routers.n8n.tls=true"
+      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
+
+      # Local Router
+      - "traefik.http.routers.n8n-local.rule=Host(`n8n.workstation.local`) || Host(`n8n.local`)"
+      - "traefik.http.routers.n8n-local.entrypoints=websecure"
+      - "traefik.http.routers.n8n-local.middlewares=security-headers"
+      - "traefik.http.routers.n8n-local.service=n8n"
+      - "traefik.http.routers.n8n-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.n8n-dev.rule=Host(`n8n.gigaforust.local`)"
+      - "traefik.http.routers.n8n-dev.entrypoints=websecure"
+      - "traefik.http.routers.n8n-dev.middlewares=security-headers"
+      - "traefik.http.routers.n8n-dev.service=n8n"
+      - "traefik.http.routers.n8n-dev.tls=true"
+
       - glance.name=n8n
       - glance.icon=si:n8n
       - glance.url=https://n8n.forust.xyz/

nextcloud/compose.yaml

@@ -18,13 +18,38 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router - DISABLED per user request
+      # - "traefik.http.routers.nextcloud-aio.rule=Host(`nextcloud-aio.forust.xyz`)"
+      # - "traefik.http.routers.nextcloud-aio.entrypoints=websecure"
+      # - "traefik.http.routers.nextcloud-aio.middlewares=security-headers"
+      # - "traefik.http.routers.nextcloud-aio.service=nextcloud-aio"
+      # - "traefik.http.routers.nextcloud-aio.tls=true"
+      # - "traefik.http.services.nextcloud-aio.loadbalancer.server.port=8080"
+      # - "traefik.http.services.nextcloud-aio.loadbalancer.server.scheme=https"
+      # - "traefik.http.services.nextcloud-aio.loadbalancer.serverstransport=insecureTransport@file"
+
+      # Local Router
+      - "traefik.http.routers.nextcloud-aio-local.rule=Host(`nextcloud-aio.workstation.local`) || Host(`nextcloud-aio.local`)"
+      - "traefik.http.routers.nextcloud-aio-local.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud-aio-local.middlewares=security-headers"
+      - "traefik.http.routers.nextcloud-aio-local.service=nextcloud-aio"
+      - "traefik.http.routers.nextcloud-aio-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.nextcloud-aio-dev.rule=Host(`nextcloud-aio.gigaforust.local`)"
+      - "traefik.http.routers.nextcloud-aio-dev.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud-aio-dev.middlewares=security-headers"
+      - "traefik.http.routers.nextcloud-aio-dev.service=nextcloud-aio"
+      - "traefik.http.routers.nextcloud-aio-dev.tls=true"
+
       - glance.name=Nextcloud
       # - glance.icon=si:nextcloud
       - glance.url=https://nextcloud.forust.xyz/
       - glance.description=Nextcloud is a suite of client-server software for creating and using file hosting services.
 
-
+    environment:
-    environment: # Is needed when using any of the options below
+      # Is needed when using any of the options below
       AIO_DISABLE_BACKUP_SECTION: false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section
       APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
       APACHE_IP_BINDING: 0.0.0.0 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
@@ -53,6 +78,7 @@ networks:
   nextcloud-aio:
     driver: bridge
     external: false
-volumes: # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
+volumes:
+  # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
   nextcloud_aio_mastercontainer:
     name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work

penpot/compose.yaml

@@ -26,12 +26,13 @@
 x-flags: &penpot-flags
   PENPOT_FLAGS: disable-email-verification enable-prepl-server disable-secure-session-cookies login-with-github
 
-x-uri: &penpot-public-uri
+x-uri: &penpot-public-urш
   PENPOT_PUBLIC_URI: http://localhost:9001
 
-x-body-size: &penpot-http-body-size
+x-body-size:
   # Max body size (30MiB); Used for plain requests, should never be
   # greater than multi-part size
+  &penpot-http-body-size
   PENPOT_HTTP_SERVER_MAX_BODY_SIZE: 31457280
 
   # Max multipart body size (350MiB)
@@ -99,16 +100,31 @@ services:
       - penpot
       - traefik-proxy
 
-    # labels:
+    labels:
-      # - "traefik.enable=true"
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
 
-      # ## HTTPS: example of labels for the case where penpot will be exposed to the
+      # Prod Router
-      # ## internet with HTTPS using traefik.
+      - "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)"
+      - "traefik.http.routers.penpot.entrypoints=websecure"
+      - "traefik.http.routers.penpot.middlewares=security-headers"
+      - "traefik.http.routers.penpot.service=penpot"
+      - "traefik.http.routers.penpot.tls=true"
+      - "traefik.http.services.penpot.loadbalancer.server.port=8080"
 
-      # - "traefik.http.routers.penpot-https.rule=Host(`<DOMAIN_NAME>`)"
+      # Local Router
-      # - "traefik.http.routers.penpot-https.entrypoints=websecure"
+      - "traefik.http.routers.penpot-local.rule=Host(`penpot.workstation.local`) || Host(`penpot.local`)"
-      # - "traefik.http.routers.penpot-https.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.penpot-local.entrypoints=websecure"
-      # - "traefik.http.routers.penpot-https.tls=true"
+      - "traefik.http.routers.penpot-local.middlewares=security-headers"
+      - "traefik.http.routers.penpot-local.service=penpot"
+      - "traefik.http.routers.penpot-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.penpot-dev.rule=Host(`penpot.gigaforust.local`)"
+      - "traefik.http.routers.penpot-dev.entrypoints=websecure"
+      - "traefik.http.routers.penpot-dev.middlewares=security-headers"
+      - "traefik.http.routers.penpot-dev.service=penpot"
+      - "traefik.http.routers.penpot-dev.tls=true"
 
     environment:
       <<: [ *penpot-flags, *penpot-http-body-size ]
@@ -174,7 +190,6 @@ services:
 
       PENPOT_TELEMETRY_ENABLED: true
       PENPOT_TELEMETRY_REFERER: compose
-
       # PENPOT_SMTP_DEFAULT_FROM: no-reply@example.com
       # PENPOT_SMTP_DEFAULT_REPLY_TO: no-reply@example.com
       # PENPOT_SMTP_HOST: penpot-mailcatch
@@ -246,7 +261,6 @@ services:
       # You can increase the max memory size if you have sufficient resources,
       # although this should not be necessary.
       - VALKEY_EXTRA_FLAGS=--maxmemory 128mb --maxmemory-policy volatile-lfu
-
   ## A mailcatch service, used as temporal SMTP server. You can access via HTTP to the
   ## port 1080 for read all emails the penpot platform has sent. Should be only used as a
   ## temporal solution while no real SMTP provider is configured.

portainer/compose.yaml

@@ -14,8 +14,32 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.portainer.rule=Host(`portainer.forust.xyz`)"
+      - "traefik.http.routers.portainer.entrypoints=websecure"
+      - "traefik.http.routers.portainer.middlewares=security-headers"
+      - "traefik.http.routers.portainer.service=portainer"
+      - "traefik.http.routers.portainer.tls=true"
+      - "traefik.http.services.portainer.loadbalancer.server.port=9443"
+      - "traefik.http.services.portainer.loadbalancer.server.scheme=https"
+      - "traefik.http.services.portainer.loadbalancer.serverstransport=insecureTransport@file"
+
+      # Local Router
+      - "traefik.http.routers.portainer-local.rule=Host(`portainer.workstation.local`) || Host(`portainer.local`)"
+      - "traefik.http.routers.portainer-local.entrypoints=websecure"
+      - "traefik.http.routers.portainer-local.middlewares=security-headers"
+      - "traefik.http.routers.portainer-local.service=portainer"
+      - "traefik.http.routers.portainer-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.portainer-dev.rule=Host(`portainer.gigaforust.local`)"
+      - "traefik.http.routers.portainer-dev.entrypoints=websecure"
+      - "traefik.http.routers.portainer-dev.middlewares=security-headers"
+      - "traefik.http.routers.portainer-dev.service=portainer"
+      - "traefik.http.routers.portainer-dev.tls=true"
+
       - glance.name=Portainer
-      # - glance.icon=si:portainer
       - glance.url=https://portainer.forust.xyz/
       - glance.description=Portainer is a lightweight management UI which allows you to easily manage your Docker environments.
 

termix/compose.yaml

@@ -9,6 +9,31 @@ services:
       - ./termix-data:/app/data
     environment:
       PORT: "8080"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.termix.rule=Host(`termix.forust.xyz`)"
+      - "traefik.http.routers.termix.entrypoints=websecure"
+      - "traefik.http.routers.termix.middlewares=security-headers"
+      - "traefik.http.routers.termix.service=termix"
+      - "traefik.http.routers.termix.tls=true"
+      - "traefik.http.services.termix.loadbalancer.server.port=8080"
+
+      # Local Router
+      - "traefik.http.routers.termix-local.rule=Host(`termix.workstation.local`) || Host(`termix.local`)"
+      - "traefik.http.routers.termix-local.entrypoints=websecure"
+      - "traefik.http.routers.termix-local.middlewares=security-headers"
+      - "traefik.http.routers.termix-local.service=termix"
+      - "traefik.http.routers.termix-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.termix-dev.rule=Host(`termix.gigaforust.local`)"
+      - "traefik.http.routers.termix-dev.entrypoints=websecure"
+      - "traefik.http.routers.termix-dev.middlewares=security-headers"
+      - "traefik.http.routers.termix-dev.service=termix"
+      - "traefik.http.routers.termix-dev.tls=true"
     networks:
       - traefik-proxy
 

traefik/compose.yaml

@@ -40,9 +40,30 @@ services:
       - "--accesslog=true"
       - "--accesslog.filepath=/var/log/traefik/access.log"
 
-    labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router (Dashboard) - DISABLED per user request
+      # - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
+      # - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
+      # - "traefik.http.routers.traefik-dashboard.middlewares=auth,security-headers"
+      # - "traefik.http.routers.traefik-dashboard.service=api@internal"
+      # - "traefik.http.routers.traefik-dashboard.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.local`) || Host(`traefik.local`)"
+      - "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure"
+      - "traefik.http.routers.traefik-dashboard-local.middlewares=auth,security-headers"
+      - "traefik.http.routers.traefik-dashboard-local.service=api@internal"
+      - "traefik.http.routers.traefik-dashboard-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.local`)"
+      - "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure"
+      - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-headers"
+      - "traefik.http.routers.traefik-dashboard-dev.service=api@internal"
+      - "traefik.http.routers.traefik-dashboard-dev.tls=true"
+
       - glance.name=Traefik
       - glance.url=https://traefik.forust.xyz/
       - glance.description=Traefik is a modern reverse proxy and load balancer

uptime-kuma/compose.yaml

@@ -10,9 +10,25 @@ services:
       - "3001:3001"
     labels:
       - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.uptime-kuma.rule=Host(`uptime.forust.xyz`)"
+      - "traefik.http.routers.uptime-kuma.entrypoints=websecure"
+      - "traefik.http.routers.uptime-kuma.tls=true"
+      - "traefik.http.services.uptime-kuma.loadbalancer.server.port=3001"
+
+      # Local Router
+      - "traefik.http.routers.uptime-kuma-local.rule=Host(`uptime.workstation.local`) || Host(`uptime.local`)"
+      - "traefik.http.routers.uptime-kuma-local.entrypoints=websecure"
+      - "traefik.http.routers.uptime-kuma-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.uptime-kuma-dev.rule=Host(`uptime.gigaforust.local`)"
+      - "traefik.http.routers.uptime-kuma-dev.entrypoints=websecure"
+      - "traefik.http.routers.uptime-kuma-dev.tls=true"
     networks:
       - traefik-proxy
 networks:
   traefik-proxy:
     external: true
-