91 lines
3.9 KiB
YAML
91 lines
3.9 KiB
YAML
services:
|
|
traefik:
|
|
image: traefik:v3.5
|
|
container_name: traefik
|
|
restart: unless-stopped
|
|
command:
|
|
# API
|
|
- "--api.insecure=false"
|
|
- "--api.dashboard=true"
|
|
|
|
# Providers
|
|
- "--providers.docker=true"
|
|
- "--providers.docker.exposedbydefault=false"
|
|
- "--providers.docker.network=traefik-proxy"
|
|
- "--providers.file.directory=/etc/traefik/dynamic"
|
|
- "--providers.file.watch=true"
|
|
|
|
# EntryPoints
|
|
- "--entryPoints.web.address=:80"
|
|
- "--entryPoints.websecure.address=:443"
|
|
- "--entryPoints.websecure.http.tls=true"
|
|
- "--entryPoints.web.http.redirections.entryPoint.to=websecure"
|
|
- "--entryPoints.web.http.redirections.entryPoint.scheme=https"
|
|
- "--entryPoints.ssh.address=:2221"
|
|
|
|
# Let's Encrypt STAGING. CURRENTLY USING CF ORIGIN CA INSTEAD
|
|
# - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
|
|
# - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
|
|
# - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
|
|
# - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
|
|
# - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
|
|
|
|
# Cloudflare
|
|
- "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
|
|
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
|
|
|
|
# Logging
|
|
- "--log.level=INFO"
|
|
- "--log.filePath=/var/log/traefik/traefik.log"
|
|
- "--accesslog=true"
|
|
- "--accesslog.filepath=/var/log/traefik/access.log"
|
|
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=traefik-proxy"
|
|
|
|
# Prod Router (Dashboard) - DISABLED per user request
|
|
# - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
|
|
# - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
|
|
# - "traefik.http.routers.traefik-dashboard.middlewares=auth,security-headers"
|
|
# - "traefik.http.routers.traefik-dashboard.service=api@internal"
|
|
# - "traefik.http.routers.traefik-dashboard.tls=true"
|
|
|
|
# Local Router
|
|
- "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.internal`) || Host(`traefik.internal`)"
|
|
- "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure"
|
|
- "traefik.http.routers.traefik-dashboard-local.middlewares=auth,security-headers"
|
|
- "traefik.http.routers.traefik-dashboard-local.service=api@internal"
|
|
- "traefik.http.routers.traefik-dashboard-local.tls=true"
|
|
|
|
# Dev Router
|
|
- "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.internal`)"
|
|
- "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure"
|
|
- "traefik.http.routers.traefik-dashboard-dev.middlewares=security-headers"
|
|
- "traefik.http.routers.traefik-dashboard-dev.service=api@internal"
|
|
- "traefik.http.routers.traefik-dashboard-dev.tls=true"
|
|
|
|
- glance.name=Traefik
|
|
- glance.url=https://traefik.forust.xyz/
|
|
- glance.description=Traefik is a modern reverse proxy and load balancer
|
|
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- ./dynamic:/etc/traefik/dynamic:ro
|
|
- ./certs:/certs:ro
|
|
- ./logs:/var/log/traefik
|
|
# - ./traefik/letsencrypt:/letsencrypt
|
|
|
|
networks:
|
|
- traefik-proxy
|
|
|
|
environment:
|
|
- TZ=Europe/Bratislava
|
|
|
|
networks:
|
|
traefik-proxy:
|
|
external: true
|