Merge branch 'main' into landing
This commit is contained in:
@@ -0,0 +1,70 @@
|
||||
|
||||
|
||||
#===============================
|
||||
# Basic auth credentials
|
||||
#===============================
|
||||
#
|
||||
#
|
||||
#
|
||||
#===============================
|
||||
|
||||
#===============================================
|
||||
#BEGIN TRAEFIK ENVIRONMENT VARIABLES ===========
|
||||
#===============================================
|
||||
|
||||
#===============================================
|
||||
# General Traefik Environment Variables
|
||||
#===============================================
|
||||
HOST=hostname
|
||||
EMAIL=your@email.here
|
||||
CF_DNS_API_TOKEN=API_TOKEN_HERE
|
||||
CF_EMAIL=your_cloudflare@email.here
|
||||
TZ=Europe/Berlin
|
||||
|
||||
#===============================================
|
||||
# Dockmon Traefik Configuration File
|
||||
#===============================================
|
||||
DOCKMON_APPNAME=dockmon
|
||||
DOCKMON_SUBDOMEN=dockmon
|
||||
#===============================================
|
||||
# Dashboard Traefik Environment Variables
|
||||
#===============================================
|
||||
DASHBOARD_APPNAME=traefik
|
||||
DASHBOARD_SUBDOMEN=traefik
|
||||
#===============================================
|
||||
# Watercrawl Traefik Environment Variables
|
||||
#===============================================
|
||||
WATERCRAWL_APPNAME=watercrawl
|
||||
WATERCRAWL_SUBDOMEN=watercrawl
|
||||
#===============================================
|
||||
# n8n Traefik Environment Variables
|
||||
#===============================================
|
||||
N8N_APPNAME=n8n
|
||||
N8N_SUBDOMEN=n8n
|
||||
#===============================================
|
||||
# Glance Traefik Environment Variables
|
||||
#===============================================
|
||||
GLANCE_APPNAME=glance
|
||||
GLANCE_SUBDOMEN=glance
|
||||
#===============================================
|
||||
# AdGuard Traefik Environment Variables
|
||||
#===============================================
|
||||
ADGUARD_APPNAME=adguard
|
||||
ADGUARD_SUBDOMEN=adguard
|
||||
#===============================================
|
||||
# Portainer Traefik Environment Variables
|
||||
#===============================================
|
||||
PORTAINER_APPNAME=portainer
|
||||
PORTAINER_SUBDOMEN=portainer
|
||||
#===============================================
|
||||
# Nextcloud Traefik Environment Variables
|
||||
#===============================================
|
||||
NEXTCLOUD_APPNAME=nextcloud
|
||||
NEXTCLOUD_SUBDOMEN=nextcloud
|
||||
#===============================================
|
||||
# Aio Traefik Environment Variables
|
||||
#===============================================
|
||||
NEXTCLOUD_AIO_APPNAME=nextcloud-aio
|
||||
NEXTCLOUD_AIO_SUBDOMEN=nextcloud-aio
|
||||
# END OF TRAEFIK ENVIRONMENT VARIABLES
|
||||
#===============================================
|
||||
@@ -0,0 +1,21 @@
|
||||
services:
|
||||
termix:
|
||||
image: ghcr.io/lukegus/termix:latest
|
||||
container_name: termix
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "3331:8080"
|
||||
volumes:
|
||||
- ./termix-data:/app/data
|
||||
environment:
|
||||
PORT: "8080"
|
||||
networks:
|
||||
- traefik-proxy
|
||||
|
||||
networks:
|
||||
traefik-proxy:
|
||||
external: true
|
||||
|
||||
volumes:
|
||||
termix-data:
|
||||
driver: local
|
||||
@@ -0,0 +1,328 @@
|
||||
http:
|
||||
routers:
|
||||
# Traefik Dashboard (ADMIN, local only)
|
||||
traefik-dashboard:
|
||||
rule: "Host(`traefik.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: api@internal
|
||||
middlewares:
|
||||
# - auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Nextcloud AIO Interface (ADMIN, local is better)
|
||||
nextcloud-aio:
|
||||
rule: "Host(`nextcloud-aio.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: nextcloud-aio
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Termix (public (account required))
|
||||
termix:
|
||||
rule: "Host(`termix.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: termix
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# MeTube
|
||||
metube:
|
||||
rule: "Host(`metube.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: metube
|
||||
middlewares:
|
||||
- metube-auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Portainer (public (account required))
|
||||
portainer:
|
||||
rule: "Host(`portainer.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: portainer
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Uptime Kuma
|
||||
uptime-kuma:
|
||||
rule: "Host(`uptime.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: uptime-kuma
|
||||
tls: {}
|
||||
|
||||
# AdGuard Home (public (account required))
|
||||
adguard:
|
||||
rule: "Host(`adguard.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: adguard
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
|
||||
# Nextcloud Main (public (account required))
|
||||
nextcloud:
|
||||
rule: "Host(`nextcloud.forust.xyz`)"
|
||||
entrypoints:
|
||||
- websecure
|
||||
service: nextcloud
|
||||
middlewares:
|
||||
- nextcloud-chain
|
||||
tls: {}
|
||||
|
||||
# Dockmon (public (account required))
|
||||
dockmon:
|
||||
rule: "Host(`dockmon.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: dockmon
|
||||
middlewares:
|
||||
# - dockmon-auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Gitea (public (account required))
|
||||
gitea:
|
||||
rule: "Host(`gitea.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
- ssh
|
||||
service: gitea
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# # Glance (local only)
|
||||
# glance:
|
||||
# rule: "Host(`glance.workstation`)"
|
||||
# entryPoints:
|
||||
# - websecure
|
||||
# service: glance
|
||||
# middlewares:
|
||||
# - security-headers
|
||||
# tls: {}
|
||||
|
||||
# Watercrawl (local only)
|
||||
watercrawl:
|
||||
rule: "Host(`watercrawl.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: watercrawl
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# N8N (local only)
|
||||
n8n:
|
||||
rule: "Host(`n8n.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: n8n
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
|
||||
services:
|
||||
# Portainer
|
||||
portainer:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://portainer:9443"
|
||||
serversTransport: insecureTransport
|
||||
|
||||
# AdGuard Home
|
||||
adguard:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://adguardhome:3000"
|
||||
|
||||
# Nextcloud AIO Interface
|
||||
nextcloud-aio:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://nextcloud-aio-mastercontainer:8080"
|
||||
serversTransport: insecureTransport
|
||||
|
||||
# Nextcloud Main
|
||||
nextcloud:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://nextcloud-aio-apache:11000"
|
||||
|
||||
# Uptime Kuma
|
||||
uptime-kuma:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://uptime-kuma:3001"
|
||||
|
||||
# Termix
|
||||
termix:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://termix:8080"
|
||||
|
||||
# Dockmon
|
||||
dockmon:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://dockmon:443"
|
||||
serversTransport: insecureTransport
|
||||
|
||||
# # Glance
|
||||
# glance:
|
||||
# loadBalancer:
|
||||
# servers:
|
||||
# - url: "http://glance:8080"
|
||||
|
||||
# Watercrawl
|
||||
watercrawl:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://nginx:80"
|
||||
|
||||
# N8N
|
||||
n8n:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://n8n:5678"
|
||||
|
||||
# Gitea
|
||||
gitea:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://gitea:3000"
|
||||
# MeTube
|
||||
metube:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://metube:8081"
|
||||
|
||||
serversTransports:
|
||||
insecureTransport:
|
||||
insecureSkipVerify: true
|
||||
|
||||
middlewares:
|
||||
# HTTPS Redirect
|
||||
redirect-https:
|
||||
redirectScheme:
|
||||
scheme: https
|
||||
permanent: true
|
||||
|
||||
# Metube Basic Auth
|
||||
metube-auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "admin:$2y$05$3Q6gyLFW3NFNp4C6elnyfupntqB6VNB/tcIAeo8NEzvaqPxOjN0iC"
|
||||
# - "jeepik:$2y$05$tIKrmhd7SYOe6yImRRAfpen7hpVdF8PnSbgBTCDZ.GI0Djx.Le2bq"
|
||||
realm: "MeTube Access"
|
||||
|
||||
# Basic Auth Traefik Dashboard
|
||||
auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
|
||||
# - "jeepik:$2y$05$Q8QqJwSjpycVYONyk4id/.rDFApW9oL8tycRMlGttNySsDv71Rnsu"
|
||||
# - "vv:"
|
||||
realm: "Traefik Dashboard"
|
||||
|
||||
# Basic Auth Dockmon
|
||||
dockmon-auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
|
||||
realm: "Dockmon Access"
|
||||
|
||||
# Cloudflare IP Whitelist
|
||||
cloudflare-ipwhitelist:
|
||||
ipWhiteList:
|
||||
sourceRange:
|
||||
- "173.245.48.0/20"
|
||||
- "103.21.244.0/22"
|
||||
- "103.22.200.0/22"
|
||||
- "103.31.4.0/22"
|
||||
- "141.101.64.0/18"
|
||||
- "108.162.192.0/18"
|
||||
- "190.93.240.0/20"
|
||||
- "188.114.96.0/20"
|
||||
- "197.234.240.0/22"
|
||||
- "198.41.128.0/17"
|
||||
- "162.158.0.0/15"
|
||||
- "104.16.0.0/13"
|
||||
- "104.24.0.0/14"
|
||||
- "172.64.0.0/13"
|
||||
- "131.0.72.0/22"
|
||||
|
||||
# Security Headers
|
||||
security-headers:
|
||||
headers:
|
||||
browserXssFilter: true
|
||||
contentTypeNosniff: true
|
||||
forceSTSHeader: true
|
||||
stsIncludeSubdomains: true
|
||||
stsPreload: true
|
||||
stsSeconds: 31536000
|
||||
customFrameOptionsValue: "SAMEORIGIN"
|
||||
customResponseHeaders:
|
||||
X-Content-Type-Options: "nosniff"
|
||||
Referrer-Policy: "strict-origin-when-cross-origin"
|
||||
|
||||
# Nextcloud specific headers
|
||||
nextcloud-secure-headers:
|
||||
headers:
|
||||
hostsProxyHeaders:
|
||||
- "X-Forwarded-Host"
|
||||
- "X-Forwarded-Proto"
|
||||
referrerPolicy: "same-origin"
|
||||
customFrameOptionsValue: "SAMEORIGIN"
|
||||
|
||||
# Rate limiting
|
||||
rate-limit:
|
||||
rateLimit:
|
||||
average: 100
|
||||
burst: 50
|
||||
period: 1m
|
||||
|
||||
# Nextcloud chain
|
||||
nextcloud-chain:
|
||||
chain:
|
||||
middlewares:
|
||||
- nextcloud-secure-headers
|
||||
- security-headers
|
||||
|
||||
# TLS Configuration
|
||||
tls:
|
||||
certificates:
|
||||
# Cloudflare Origin CA *.forust.xyz
|
||||
- certFile: /certs/cloudflare.pem
|
||||
keyFile: /certs/cloudflare.key
|
||||
# Local certificate
|
||||
- certFile: /certs/workstation+1.pem
|
||||
keyFile: /certs/workstation+1-key.pem
|
||||
|
||||
stores:
|
||||
default:
|
||||
defaultCertificate:
|
||||
# Fallback local certificate
|
||||
certFile: /certs/workstation+1.pem
|
||||
keyFile: /certs/workstation+1-key.pem
|
||||
|
||||
options:
|
||||
default:
|
||||
minVersion: VersionTLS12
|
||||
sniStrict: true
|
||||
cipherSuites:
|
||||
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|
||||
+1
-310
@@ -1,313 +1,4 @@
|
||||
http:
|
||||
routers:
|
||||
# Traefik Dashboard (ADMIN, local only)
|
||||
traefik-dashboard:
|
||||
rule: "Host(`traefik.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: api@internal
|
||||
middlewares:
|
||||
# - auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Nextcloud AIO Interface (ADMIN, local is better)
|
||||
nextcloud-aio:
|
||||
rule: "Host(`nextcloud-aio.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: nextcloud-aio
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# MeTube
|
||||
metube:
|
||||
rule: "Host(`metube.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: metube
|
||||
middlewares:
|
||||
- metube-auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Portainer (public (account required))
|
||||
portainer:
|
||||
rule: "Host(`portainer.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: portainer
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# # Uptime Kuma
|
||||
# uptime-kuma:
|
||||
# rule: "Host(`uptime-kuma.forust.xyz`)"
|
||||
# entryPoints:
|
||||
# - websecure
|
||||
# service: uptime-kuma
|
||||
# # middlewares:
|
||||
# # - security-headers
|
||||
# tls: {}
|
||||
|
||||
# AdGuard Home (public (account required))
|
||||
adguard:
|
||||
rule: "Host(`adguard.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: adguard
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
|
||||
# Nextcloud Main (public (account required))
|
||||
nextcloud:
|
||||
rule: "Host(`nextcloud.forust.xyz`)"
|
||||
entrypoints:
|
||||
- websecure
|
||||
service: nextcloud
|
||||
middlewares:
|
||||
- nextcloud-chain
|
||||
tls: {}
|
||||
|
||||
# Dockmon (public (account required))
|
||||
dockmon:
|
||||
rule: "Host(`dockmon.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: dockmon
|
||||
middlewares:
|
||||
# - dockmon-auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Gitea (public (account required))
|
||||
gitea:
|
||||
rule: "Host(`gitea.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
- ssh
|
||||
service: gitea
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# # Glance (local only)
|
||||
# glance:
|
||||
# rule: "Host(`glance.workstation`)"
|
||||
# entryPoints:
|
||||
# - websecure
|
||||
# service: glance
|
||||
# middlewares:
|
||||
# - security-headers
|
||||
# tls: {}
|
||||
|
||||
# Watercrawl (local only)
|
||||
watercrawl:
|
||||
rule: "Host(`watercrawl.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: watercrawl
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# N8N (local only)
|
||||
n8n:
|
||||
rule: "Host(`n8n.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: n8n
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
|
||||
services:
|
||||
# Portainer
|
||||
portainer:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://portainer:9443"
|
||||
serversTransport: insecureTransport
|
||||
|
||||
# AdGuard Home
|
||||
adguard:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://adguardhome:3000"
|
||||
|
||||
# Nextcloud AIO Interface
|
||||
nextcloud-aio:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://nextcloud-aio-mastercontainer:8080"
|
||||
serversTransport: insecureTransport
|
||||
|
||||
# Nextcloud Main
|
||||
nextcloud:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://nextcloud-aio-apache:11000"
|
||||
|
||||
# # Uptime Kuma
|
||||
# uptime-kuma:
|
||||
# loadBalancer:
|
||||
# servers: "http://uptime-kuma:3001"
|
||||
|
||||
# Dockmon
|
||||
dockmon:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://dockmon:443"
|
||||
serversTransport: insecureTransport
|
||||
|
||||
# # Glance
|
||||
# glance:
|
||||
# loadBalancer:
|
||||
# servers:
|
||||
# - url: "http://glance:8080"
|
||||
|
||||
# Watercrawl
|
||||
watercrawl:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://nginx:80"
|
||||
|
||||
# N8N
|
||||
n8n:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://n8n:5678"
|
||||
|
||||
# Gitea
|
||||
gitea:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://gitea:3000"
|
||||
# MeTube
|
||||
metube:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://metube:8081"
|
||||
|
||||
serversTransports:
|
||||
insecureTransport:
|
||||
insecureSkipVerify: true
|
||||
|
||||
middlewares:
|
||||
# HTTPS Redirect
|
||||
redirect-https:
|
||||
redirectScheme:
|
||||
scheme: https
|
||||
permanent: true
|
||||
|
||||
# Metube Basic Auth
|
||||
metube-auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "admin:$2y$05$3Q6gyLFW3NFNp4C6elnyfupntqB6VNB/tcIAeo8NEzvaqPxOjN0iC"
|
||||
# - "jeepik:$2y$05$tIKrmhd7SYOe6yImRRAfpen7hpVdF8PnSbgBTCDZ.GI0Djx.Le2bq"
|
||||
realm: "MeTube Access"
|
||||
|
||||
# Basic Auth Traefik Dashboard
|
||||
auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
|
||||
# - "jeepik:$2y$05$Q8QqJwSjpycVYONyk4id/.rDFApW9oL8tycRMlGttNySsDv71Rnsu"
|
||||
# - "vv:"
|
||||
realm: "Traefik Dashboard"
|
||||
|
||||
# Basic Auth Dockmon
|
||||
dockmon-auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
|
||||
realm: "Dockmon Access"
|
||||
|
||||
# Cloudflare IP Whitelist
|
||||
cloudflare-ipwhitelist:
|
||||
ipWhiteList:
|
||||
sourceRange:
|
||||
- "173.245.48.0/20"
|
||||
- "103.21.244.0/22"
|
||||
- "103.22.200.0/22"
|
||||
- "103.31.4.0/22"
|
||||
- "141.101.64.0/18"
|
||||
- "108.162.192.0/18"
|
||||
- "190.93.240.0/20"
|
||||
- "188.114.96.0/20"
|
||||
- "197.234.240.0/22"
|
||||
- "198.41.128.0/17"
|
||||
- "162.158.0.0/15"
|
||||
- "104.16.0.0/13"
|
||||
- "104.24.0.0/14"
|
||||
- "172.64.0.0/13"
|
||||
- "131.0.72.0/22"
|
||||
|
||||
# Security Headers
|
||||
security-headers:
|
||||
headers:
|
||||
browserXssFilter: true
|
||||
contentTypeNosniff: true
|
||||
forceSTSHeader: true
|
||||
stsIncludeSubdomains: true
|
||||
stsPreload: true
|
||||
stsSeconds: 31536000
|
||||
customFrameOptionsValue: "SAMEORIGIN"
|
||||
customResponseHeaders:
|
||||
X-Content-Type-Options: "nosniff"
|
||||
Referrer-Policy: "strict-origin-when-cross-origin"
|
||||
|
||||
# Nextcloud specific headers
|
||||
nextcloud-secure-headers:
|
||||
headers:
|
||||
hostsProxyHeaders:
|
||||
- "X-Forwarded-Host"
|
||||
- "X-Forwarded-Proto"
|
||||
referrerPolicy: "same-origin"
|
||||
customFrameOptionsValue: "SAMEORIGIN"
|
||||
|
||||
# Rate limiting
|
||||
rate-limit:
|
||||
rateLimit:
|
||||
average: 100
|
||||
burst: 50
|
||||
period: 1m
|
||||
|
||||
# Nextcloud chain
|
||||
nextcloud-chain:
|
||||
chain:
|
||||
middlewares:
|
||||
- nextcloud-secure-headers
|
||||
- security-headers
|
||||
|
||||
# TLS Configuration
|
||||
tls:
|
||||
certificates:
|
||||
# Cloudflare Origin CA *.forust.xyz
|
||||
- certFile: /certs/cloudflare.pem
|
||||
keyFile: /certs/cloudflare.key
|
||||
# Local certificate
|
||||
- certFile: /certs/workstation+1.pem
|
||||
keyFile: /certs/workstation+1-key.pem
|
||||
|
||||
stores:
|
||||
default:
|
||||
defaultCertificate:
|
||||
# Fallback local certificate
|
||||
certFile: /certs/workstation+1.pem
|
||||
keyFile: /certs/workstation+1-key.pem
|
||||
|
||||
options:
|
||||
default:
|
||||
minVersion: VersionTLS12
|
||||
sniStrict: true
|
||||
cipherSuites:
|
||||
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|
||||
insecureSkipVerify: true
|
||||
@@ -0,0 +1,90 @@
|
||||
http:
|
||||
middlewares:
|
||||
# HTTPS Redirect
|
||||
redirect-https:
|
||||
redirectScheme:
|
||||
scheme: https
|
||||
permanent: true
|
||||
|
||||
# Metube Basic Auth
|
||||
metube-auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "admin:$2y$05$3Q6gyLFW3NFNp4C6elnyfupntqB6VNB/tcIAeo8NEzvaqPxOjN0iC"
|
||||
# - "jeepik:$2y$05$tIKrmhd7SYOe6yImRRAfpen7hpVdF8PnSbgBTCDZ.GI0Djx.Le2bq"
|
||||
- "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"
|
||||
|
||||
realm: "MeTube Access"
|
||||
|
||||
# Basic Auth Traefik Dashboard
|
||||
auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
|
||||
# - "jeepik:$2y$05$Q8QqJwSjpycVYONyk4id/.rDFApW9oL8tycRMlGttNySsDv71Rnsu"
|
||||
# - "vv:"
|
||||
realm: "Traefik Dashboard"
|
||||
|
||||
# Basic Auth Dockmon
|
||||
dockmon-auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
|
||||
realm: "Dockmon Access"
|
||||
|
||||
# Cloudflare IP Whitelist
|
||||
cloudflare-ipwhitelist:
|
||||
ipWhiteList:
|
||||
sourceRange:
|
||||
- "173.245.48.0/20"
|
||||
- "103.21.244.0/22"
|
||||
- "103.22.200.0/22"
|
||||
- "103.31.4.0/22"
|
||||
- "141.101.64.0/18"
|
||||
- "108.162.192.0/18"
|
||||
- "190.93.240.0/20"
|
||||
- "188.114.96.0/20"
|
||||
- "197.234.240.0/22"
|
||||
- "198.41.128.0/17"
|
||||
- "162.158.0.0/15"
|
||||
- "104.16.0.0/13"
|
||||
- "104.24.0.0/14"
|
||||
- "172.64.0.0/13"
|
||||
- "131.0.72.0/22"
|
||||
|
||||
# Security Headers
|
||||
security-headers:
|
||||
headers:
|
||||
browserXssFilter: true
|
||||
contentTypeNosniff: true
|
||||
forceSTSHeader: true
|
||||
stsIncludeSubdomains: true
|
||||
stsPreload: true
|
||||
stsSeconds: 31536000
|
||||
customFrameOptionsValue: "SAMEORIGIN"
|
||||
customResponseHeaders:
|
||||
X-Content-Type-Options: "nosniff"
|
||||
Referrer-Policy: "strict-origin-when-cross-origin"
|
||||
|
||||
# Nextcloud specific headers
|
||||
nextcloud-secure-headers:
|
||||
headers:
|
||||
hostsProxyHeaders:
|
||||
- "X-Forwarded-Host"
|
||||
- "X-Forwarded-Proto"
|
||||
referrerPolicy: "same-origin"
|
||||
customFrameOptionsValue: "SAMEORIGIN"
|
||||
|
||||
# Rate limiting
|
||||
rate-limit:
|
||||
rateLimit:
|
||||
average: 100
|
||||
burst: 50
|
||||
period: 1m
|
||||
|
||||
# Nextcloud chain
|
||||
nextcloud-chain:
|
||||
chain:
|
||||
middlewares:
|
||||
- nextcloud-secure-headers
|
||||
- security-headers
|
||||
@@ -0,0 +1,134 @@
|
||||
http:
|
||||
routers:
|
||||
# Traefik Dashboard (dev access. local only)
|
||||
traefik-dashboard-dev:
|
||||
rule: "Host(`traefik.gigaforust`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: api@internal
|
||||
middlewares:
|
||||
# - auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
|
||||
# Nextcloud AIO Interface (dev access. local only)
|
||||
nextcloud-aio-dev:
|
||||
rule: "Host(`nextcloud-aio.gigaforust`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: nextcloud-aio
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Termix (dev access, (account required))
|
||||
termix-dev:
|
||||
rule: "Host(`termix.gigaforust`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: termix
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# MeTube (dev access, (auth required))
|
||||
metube-dev:
|
||||
rule: "Host(`metube.gigaforust`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: metube
|
||||
middlewares:
|
||||
- metube-auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Portainer (dev acess, (account required))
|
||||
portainer-dev:
|
||||
rule: "Host(`portainer.gigaforust`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: portainer
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Uptime Kuma (dev access, (account required))
|
||||
uptime-kuma-dev:
|
||||
rule: "Host(`uptime.gigaforust`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: uptime-kuma
|
||||
tls: {}
|
||||
|
||||
# AdGuard Home (dev access, (account required))
|
||||
adguard-dev:
|
||||
rule: "Host(`adguard.gigaforust`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: adguard
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Nextcloud Main (public (account required))
|
||||
nextcloud-dev:
|
||||
rule: "Host(`nextcloud.gigaforust`)"
|
||||
entrypoints:
|
||||
- websecure
|
||||
service: nextcloud
|
||||
middlewares:
|
||||
- nextcloud-chain
|
||||
tls: {}
|
||||
|
||||
# Dockmon (dev access (account required))
|
||||
dockmon-dev:
|
||||
rule: "Host(`dockmon.gigaforust`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: dockmon
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Gitea (dev access (account required))
|
||||
gitea-dev:
|
||||
rule: "Host(`gitea.gigaforust`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
- ssh
|
||||
service: gitea
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Glance (dev access, local only)
|
||||
glance-dev:
|
||||
rule: "Host(`glance.gigaforust`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: glance
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Watercrawl (dev access, local only)
|
||||
watercrawl-dev:
|
||||
rule: "Host(`watercrawl.gigaforust`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: watercrawl
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# N8N (local only)
|
||||
n8n-dev:
|
||||
rule: "Host(`n8n.gigaforust`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: n8n
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
@@ -0,0 +1,134 @@
|
||||
http:
|
||||
routers:
|
||||
# Traefik Dashboard (local access, ADMIN, local only)
|
||||
traefik-dashboard-local:
|
||||
rule: "Host(`traefik.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: api@internal
|
||||
middlewares:
|
||||
# - auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
|
||||
# Nextcloud AIO Interface (local access. ADMIN, local only)
|
||||
nextcloud-aio-local:
|
||||
rule: "Host(`nextcloud-aio.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: nextcloud-aio
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Termix (local access, (account required))
|
||||
termix-local:
|
||||
rule: "Host(`termix.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: termix
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# MeTube (local access, (auth required))
|
||||
metube-local:
|
||||
rule: "Host(`metube.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: metube
|
||||
middlewares:
|
||||
- metube-auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Portainer (dev acess, (account required))
|
||||
portainer-local:
|
||||
rule: "Host(`portainer.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: portainer
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Uptime Kuma (local access, (account required))
|
||||
uptime-kuma-local:
|
||||
rule: "Host(`uptime.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: uptime-kuma
|
||||
tls: {}
|
||||
|
||||
# AdGuard Home (local access, (account required))
|
||||
adguard-local:
|
||||
rule: "Host(`adguard.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: adguard
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Nextcloud Main (public (account required))
|
||||
nextcloud-local:
|
||||
rule: "Host(`nextcloud.workstation`)"
|
||||
entrypoints:
|
||||
- websecure
|
||||
service: nextcloud
|
||||
middlewares:
|
||||
- nextcloud-chain
|
||||
tls: {}
|
||||
|
||||
# Dockmon (local access (account required))
|
||||
dockmon-local:
|
||||
rule: "Host(`dockmon.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: dockmon
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Gitea (local access (account required))
|
||||
gitea-local:
|
||||
rule: "Host(`gitea.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
- ssh
|
||||
service: gitea
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Glance (local access)
|
||||
glance-local:
|
||||
rule: "Host(`glance.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: glance
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Watercrawl (local access)
|
||||
watercrawl-local:
|
||||
rule: "Host(`watercrawl.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: watercrawl
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# N8N (local only)
|
||||
n8n-local:
|
||||
rule: "Host(`n8n.workstation`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: n8n
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
@@ -0,0 +1,132 @@
|
||||
http:
|
||||
routers:
|
||||
# Traefik Dashboard (ADMIN, without subdomeain)
|
||||
traefik-dashboard:
|
||||
rule: "Host(`traefik.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: api@internal
|
||||
middlewares:
|
||||
- auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Nextcloud AIO Interface (ADMIN, without subdomeain)
|
||||
nextcloud-aio:
|
||||
rule: "Host(`nextcloud-aio.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: nextcloud-aio
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Termix (public (account required))
|
||||
termix:
|
||||
rule: "Host(`termix.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: termix
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# MeTube (public (auth required))
|
||||
metube:
|
||||
rule: "Host(`metube.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: metube
|
||||
middlewares:
|
||||
- metube-auth
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Portainer (public (account required))
|
||||
portainer:
|
||||
rule: "Host(`portainer.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: portainer
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Uptime Kuma (public (account required))
|
||||
uptime-kuma:
|
||||
rule: "Host(`uptime.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: uptime-kuma
|
||||
tls: {}
|
||||
|
||||
# AdGuard Home (public (account required))
|
||||
adguard:
|
||||
rule: "Host(`adguard.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: adguard
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Nextcloud Main (public (account required))
|
||||
nextcloud:
|
||||
rule: "Host(`nextcloud.forust.xyz`)"
|
||||
entrypoints:
|
||||
- websecure
|
||||
service: nextcloud
|
||||
middlewares:
|
||||
- nextcloud-chain
|
||||
tls: {}
|
||||
|
||||
# Dockmon (public (account required))
|
||||
dockmon:
|
||||
rule: "Host(`dockmon.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: dockmon
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Gitea (public (account required))
|
||||
gitea:
|
||||
rule: "Host(`gitea.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
- ssh
|
||||
service: gitea
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Glance (public, without subdomain)
|
||||
glance:
|
||||
rule: "Host(`glance.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: glance
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# Watercrawl (public, without subdomain)
|
||||
watercrawl:
|
||||
rule: "Host(`watercrawl.fourst.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: watercrawl
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
|
||||
# N8N (public, without subdomain)
|
||||
n8n:
|
||||
rule: "Host(`n8n.forust.xyz`)"
|
||||
entryPoints:
|
||||
- websecure
|
||||
service: n8n
|
||||
middlewares:
|
||||
- security-headers
|
||||
tls: {}
|
||||
@@ -0,0 +1,75 @@
|
||||
http:
|
||||
services:
|
||||
# Portainer
|
||||
portainer:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://portainer:9443"
|
||||
serversTransport: insecureTransport
|
||||
|
||||
# AdGuard Home
|
||||
adguard:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://adguardhome:3000"
|
||||
|
||||
# Nextcloud AIO Interface
|
||||
nextcloud-aio:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://nextcloud-aio-mastercontainer:8080"
|
||||
serversTransport: insecureTransport
|
||||
|
||||
# Nextcloud Main
|
||||
nextcloud:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://nextcloud-aio-apache:11000"
|
||||
|
||||
# Uptime Kuma
|
||||
uptime-kuma:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://uptime-kuma:3001"
|
||||
|
||||
# Termix
|
||||
termix:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://termix:8080"
|
||||
|
||||
# Dockmon
|
||||
dockmon:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://dockmon:443"
|
||||
serversTransport: insecureTransport
|
||||
|
||||
# Glance
|
||||
glance:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://glance:8080"
|
||||
|
||||
# Watercrawl
|
||||
watercrawl:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://nginx:80"
|
||||
|
||||
# N8N
|
||||
n8n:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://n8n:5678"
|
||||
|
||||
# Gitea
|
||||
gitea:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://gitea:3000"
|
||||
# MeTube
|
||||
metube:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://metube:8081"
|
||||
@@ -0,0 +1,25 @@
|
||||
# TLS Configuration
|
||||
tls:
|
||||
certificates:
|
||||
# Cloudflare Origin CA *.forust.xyz
|
||||
- certFile: /certs/cloudflare.pem
|
||||
keyFile: /certs/cloudflare.key
|
||||
# Local certificate
|
||||
- certFile: /certs/workstation+1.pem
|
||||
keyFile: /certs/workstation+1-key.pem
|
||||
|
||||
stores:
|
||||
default:
|
||||
defaultCertificate:
|
||||
# Fallback local certificate
|
||||
certFile: /certs/workstation+1.pem
|
||||
keyFile: /certs/workstation+1-key.pem
|
||||
|
||||
options:
|
||||
default:
|
||||
minVersion: VersionTLS12
|
||||
sniStrict: true
|
||||
cipherSuites:
|
||||
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|
||||
@@ -10,11 +10,6 @@ services:
|
||||
- "3001:3001"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.uptime-kuma.rule=Host(`uptime-kuma.forust.xyz`)"
|
||||
- "traefik.http.routers.uptime-kuma.entrypoints=websecure"
|
||||
- "traefik.http.routers.uptime-kuma.tls=true"
|
||||
# - "traefik.http.routers.uptime-kuma.tls.certresolver=myresolver"
|
||||
- "traefik.http.services.uptime-kuma.loadBalancer.server.port=3001"
|
||||
networks:
|
||||
- traefik-proxy
|
||||
networks:
|
||||
|
||||
Reference in New Issue
Block a user