refactored dynamic traefik conf files

Removed let's encrypt acme and other stuff. Using Cloudflare origin CA
2025-11-15 01:39:40 +01:00
parent 815405b6a3
commit 85436e0855
3 changed files with 54 additions and 48 deletions
@@ -0,0 +1,269 @@
+http:
+  routers:
+    # Traefik Dashboard (локальный)
+    traefik-dashboard:
+      rule: "Host(`traefik.workstation`)"
+      entryPoints:
+        - websecure
+      service: api@internal
+      middlewares:
+        # - auth
+        - security-headers
+      tls: {}
+
+    # Portainer (публичный)
+    portainer:
+      rule: "Host(`portainer.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: portainer
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # AdGuard Home (публичный)
+    adguard:
+      rule: "Host(`adguard.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: adguard
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Nextcloud AIO Interface (локальный)
+    nextcloud-aio:
+      rule: "Host(`nextcloud-aio.workstation`)"
+      entryPoints:
+        - websecure
+      service: nextcloud-aio
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Nextcloud Main (публичный)
+    nextcloud:
+      rule: "Host(`nextcloud.forust.xyz`)"
+      entrypoints:
+        - websecure
+      service: nextcloud
+      middlewares:
+        - nextcloud-chain
+      tls: {}
+
+    # Dockmon (публичный)
+    dockmon:
+      rule: "Host(`dockmon.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: dockmon
+      middlewares:
+        # - dockmon-auth
+        - security-headers
+      tls: {}
+
+    # Glance (локальный)
+    glance:
+      rule: "Host(`glance.workstation`)"
+      entryPoints:
+        - websecure
+      service: glance
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Watercrawl (локальный)
+    watercrawl:
+      rule: "Host(`watercrawl.workstation`)"
+      entryPoints:
+        - websecure
+      service: watercrawl
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # N8N (локальный)
+    n8n:
+      rule: "Host(`n8n.workstation`)"
+      entryPoints:
+        - websecure
+      service: n8n
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Gitea (публичный)
+    gitea:
+      rule: "Host(`gitea.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: gitea
+      middlewares:
+        - security-headers
+      tls: {}
+
+  services:
+    # Portainer
+    portainer:
+      loadBalancer:
+        servers:
+          - url: "https://portainer:9443"
+        serversTransport: insecureTransport
+
+    # AdGuard Home
+    adguard:
+      loadBalancer:
+        servers:
+          - url: "http://adguardhome:3000"
+
+    # Nextcloud AIO Interface
+    nextcloud-aio:
+      loadBalancer:
+        servers:
+          - url: "https://nextcloud-aio-mastercontainer:8080"
+        serversTransport: insecureTransport
+
+    # Nextcloud Main
+    nextcloud:
+      loadBalancer:
+        servers:
+          - url: "http://nextcloud-aio-apache:11000"
+
+    # Dockmon
+    dockmon:
+      loadBalancer:
+        servers:
+          - url: "https://dockmon:443"
+        serversTransport: insecureTransport
+
+    # Glance
+    glance:
+      loadBalancer:
+        servers:
+          - url: "http://glance:8080"
+
+    # Watercrawl
+    watercrawl:
+      loadBalancer:
+        servers:
+          - url: "http://nginx:80"
+
+    # N8N
+    n8n:
+      loadBalancer:
+        servers:
+          - url: "http://n8n:5678"
+    
+    # Gitea
+    gitea:
+      loadBalancer:
+        servers:
+          - url: "http://gitea:3000"
+
+  serversTransports:
+    insecureTransport:
+      insecureSkipVerify: true
+
+  middlewares:
+    # HTTPS Redirect
+    redirect-https:
+      redirectScheme:
+        scheme: https
+        permanent: true
+
+    # Basic Auth для Traefik Dashboard
+    auth:
+      basicAuth:
+        users:
+          - "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
+        realm: "Traefik Dashboard"
+
+    # Basic Auth для Dockmon
+    dockmon-auth:
+      basicAuth:
+        users:
+          - "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
+        realm: "Dockmon Access"
+    
+    # Cloudflare IP Whitelist (опционально)
+    cloudflare-ipwhitelist:
+      ipWhiteList:
+        sourceRange:
+          - "173.245.48.0/20"
+          - "103.21.244.0/22"
+          - "103.22.200.0/22"
+          - "103.31.4.0/22"
+          - "141.101.64.0/18"
+          - "108.162.192.0/18"
+          - "190.93.240.0/20"
+          - "188.114.96.0/20"
+          - "197.234.240.0/22"
+          - "198.41.128.0/17"
+          - "162.158.0.0/15"
+          - "104.16.0.0/13"
+          - "104.24.0.0/14"
+          - "172.64.0.0/13"
+          - "131.0.72.0/22"
+
+    # Security Headers
+    security-headers:
+      headers:
+        browserXssFilter: true
+        contentTypeNosniff: true
+        forceSTSHeader: true
+        stsIncludeSubdomains: true
+        stsPreload: true
+        stsSeconds: 31536000
+        customFrameOptionsValue: "SAMEORIGIN"
+        customResponseHeaders:
+          X-Content-Type-Options: "nosniff"
+          Referrer-Policy: "strict-origin-when-cross-origin"
+
+    # Nextcloud specific headers
+    nextcloud-secure-headers:
+      headers:
+        hostsProxyHeaders:
+          - "X-Forwarded-Host"
+          - "X-Forwarded-Proto"
+        referrerPolicy: "same-origin"
+        customFrameOptionsValue: "SAMEORIGIN"
+
+    # Rate limiting
+    rate-limit:
+      rateLimit:
+        average: 100
+        burst: 50
+        period: 1m
+
+    # Nextcloud chain
+    nextcloud-chain:
+      chain:
+        middlewares:
+          - nextcloud-secure-headers
+          - security-headers
+
+# TLS Configuration
+tls:
+  certificates:
+    # Cloudflare Origin CA для публичных доменов *.forust.xyz
+    - certFile: /certs/cloudflare.pem
+      keyFile: /certs/cloudflare.key
+    # Локальный сертификат для *.workstation
+    - certFile: /certs/workstation+1.pem
+      keyFile: /certs/workstation+1-key.pem
+  
+  stores:
+    default:
+      defaultCertificate:
+        # По умолчанию используем локальный сертификат
+        certFile: /certs/workstation+1.pem
+        keyFile: /certs/workstation+1-key.pem
+  
+  options:
+    default:
+      minVersion: VersionTLS12
+      sniStrict: true
+      cipherSuites:
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305