From 85436e0855d5fb0bb9f7d692e1e7e5735c482eef Mon Sep 17 00:00:00 2001 From: mr-forust Date: Sat, 15 Nov 2025 01:39:40 +0100 Subject: [PATCH] refactored dynamic traefik conf files Removed let's encrypt acme and other stuff. Using Cloudflare origin CA --- traefik-docker-compose.yaml | 24 +++++--- traefik/dynamic/{services.yml => dynamic.yml} | 59 ++++++++++++------- traefik/dynamic/tls.yml | 19 ------ 3 files changed, 54 insertions(+), 48 deletions(-) rename traefik/dynamic/{services.yml => dynamic.yml} (81%) delete mode 100644 traefik/dynamic/tls.yml diff --git a/traefik-docker-compose.yaml b/traefik-docker-compose.yaml index 30688bf..03e16b8 100644 --- a/traefik-docker-compose.yaml +++ b/traefik-docker-compose.yaml @@ -4,30 +4,36 @@ services: container_name: traefik restart: unless-stopped command: + # API - "--api.insecure=false" - "--api.dashboard=true" + + # Providers - "--providers.docker=true" - "--providers.docker.exposedbydefault=false" - "--providers.docker.network=traefik-proxy" + - "--providers.file.directory=/etc/traefik/dynamic" + - "--providers.file.watch=true" + + # EntryPoints - "--entryPoints.web.address=:80" - "--entryPoints.websecure.address=:443" - "--entryPoints.websecure.http.tls=true" - "--entryPoints.web.http.redirections.entryPoint.to=websecure" - "--entryPoints.web.http.redirections.entryPoint.scheme=https" - - "--providers.file.directory=/etc/traefik/dynamic" - - "--providers.file.watch=true" - # Let's Encrypt STAGING - - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}" - - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json" - - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory" - - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true" - - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web" + # Let's Encrypt STAGING. CURRENTLY USING CF ORIGIN CA INSTEAD + # - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}" + # - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json" + # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory" + # - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true" + # - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web" # Cloudflare - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22" - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22" + # Logging - "--log.level=INFO" - "--log.filePath=/var/log/traefik/traefik.log" - "--accesslog=true" @@ -46,7 +52,7 @@ services: volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - - ./traefik/letsencrypt:/letsencrypt + # - ./traefik/letsencrypt:/letsencrypt - ./traefik/dynamic:/etc/traefik/dynamic:ro - ./traefik/logs:/var/log/traefik - ./traefik/certs:/certs:ro diff --git a/traefik/dynamic/services.yml b/traefik/dynamic/dynamic.yml similarity index 81% rename from traefik/dynamic/services.yml rename to traefik/dynamic/dynamic.yml index d377a78..4cd2dfa 100644 --- a/traefik/dynamic/services.yml +++ b/traefik/dynamic/dynamic.yml @@ -1,6 +1,6 @@ http: routers: - # Traefik Dashboard + # Traefik Dashboard (локальный) traefik-dashboard: rule: "Host(`traefik.workstation`)" entryPoints: @@ -10,9 +10,8 @@ http: # - auth - security-headers tls: {} - # certResolver: letsencrypt - # Portainer + # Portainer (публичный) portainer: rule: "Host(`portainer.forust.xyz`)" entryPoints: @@ -20,10 +19,9 @@ http: service: portainer middlewares: - security-headers - tls: - certResolver: letsencrypt + tls: {} - # AdGuard Home + # AdGuard Home (публичный) adguard: rule: "Host(`adguard.forust.xyz`)" entryPoints: @@ -31,8 +29,7 @@ http: service: adguard middlewares: - security-headers - tls: - certResolver: letsencrypt + tls: {} # Nextcloud AIO Interface (локальный) nextcloud-aio: @@ -44,7 +41,7 @@ http: - security-headers tls: {} - # Nextcloud Main + # Nextcloud Main (публичный) nextcloud: rule: "Host(`nextcloud.forust.xyz`)" entrypoints: @@ -52,10 +49,9 @@ http: service: nextcloud middlewares: - nextcloud-chain - tls: - certResolver: letsencrypt + tls: {} - # Dockmon + # Dockmon (публичный) dockmon: rule: "Host(`dockmon.forust.xyz`)" entryPoints: @@ -64,8 +60,7 @@ http: middlewares: # - dockmon-auth - security-headers - tls: - certResolver: letsencrypt + tls: {} # Glance (локальный) glance: @@ -87,7 +82,7 @@ http: - security-headers tls: {} - # N8N + # N8N (локальный) n8n: rule: "Host(`n8n.workstation`)" entryPoints: @@ -96,9 +91,8 @@ http: middlewares: - security-headers tls: {} - # certResolver: letsencrypt - # Gitea + # Gitea (публичный) gitea: rule: "Host(`gitea.forust.xyz`)" entryPoints: @@ -106,8 +100,7 @@ http: service: gitea middlewares: - security-headers - tls: - certResolver: letsencrypt + tls: {} services: # Portainer @@ -247,4 +240,30 @@ http: chain: middlewares: - nextcloud-secure-headers - - security-headers \ No newline at end of file + - security-headers + +# TLS Configuration +tls: + certificates: + # Cloudflare Origin CA для публичных доменов *.forust.xyz + - certFile: /certs/cloudflare.pem + keyFile: /certs/cloudflare.key + # Локальный сертификат для *.workstation + - certFile: /certs/workstation+1.pem + keyFile: /certs/workstation+1-key.pem + + stores: + default: + defaultCertificate: + # По умолчанию используем локальный сертификат + certFile: /certs/workstation+1.pem + keyFile: /certs/workstation+1-key.pem + + options: + default: + minVersion: VersionTLS12 + sniStrict: true + cipherSuites: + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 \ No newline at end of file diff --git a/traefik/dynamic/tls.yml b/traefik/dynamic/tls.yml deleted file mode 100644 index a075d46..0000000 --- a/traefik/dynamic/tls.yml +++ /dev/null @@ -1,19 +0,0 @@ -tls: - certificates: - - certFile: /certs/workstation+1.pem - keyFile: /certs/workstation+1-key.pem - stores: - default: - defaultCertificate: - certFile: /certs/cloudflare.pem - keyFile: /certs/cloudflare.key - - - options: - default: - minVersion: VersionTLS12 - sniStrict: true - cipherSuites: - - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 \ No newline at end of file