refactored dynamic traefik conf files

Removed let's encrypt acme and other stuff. Using Cloudflare origin CA

traefik-docker-compose.yaml

@@ -4,30 +4,36 @@ services:
     container_name: traefik
     restart: unless-stopped
     command:
+      # API
       - "--api.insecure=false"
       - "--api.dashboard=true"
+      
+      # Providers
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
       - "--providers.docker.network=traefik-proxy"
+      - "--providers.file.directory=/etc/traefik/dynamic"
+      - "--providers.file.watch=true"
+      
+      # EntryPoints
       - "--entryPoints.web.address=:80"
       - "--entryPoints.websecure.address=:443"
       - "--entryPoints.websecure.http.tls=true"
       - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
       - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
-      - "--providers.file.directory=/etc/traefik/dynamic"
-      - "--providers.file.watch=true"
       
-      # Let's Encrypt STAGING
+      # Let's Encrypt STAGING. CURRENTLY USING CF ORIGIN CA INSTEAD
-      - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
+      # - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
-      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      # - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
+      # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
+      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
-      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
+      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
       
       # Cloudflare 
       - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
       - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
       
+      # Logging
       - "--log.level=INFO"
       - "--log.filePath=/var/log/traefik/traefik.log"
       - "--accesslog=true"
@@ -46,7 +52,7 @@ services:
       
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./traefik/letsencrypt:/letsencrypt
+      # - ./traefik/letsencrypt:/letsencrypt
       - ./traefik/dynamic:/etc/traefik/dynamic:ro
       - ./traefik/logs:/var/log/traefik
       - ./traefik/certs:/certs:ro

traefik/dynamic/dynamic.yml

@@ -1,6 +1,6 @@
 http:
   routers:
-    # Traefik Dashboard
+    # Traefik Dashboard (локальный)
     traefik-dashboard:
       rule: "Host(`traefik.workstation`)"
       entryPoints:
@@ -10,9 +10,8 @@ http:
         # - auth
         - security-headers
       tls: {}
-        # certResolver: letsencrypt
 
-    # Portainer
+    # Portainer (публичный)
     portainer:
       rule: "Host(`portainer.forust.xyz`)"
       entryPoints:
@@ -20,10 +19,9 @@ http:
       service: portainer
       middlewares:
         - security-headers
-      tls:
+      tls: {}
-        certResolver: letsencrypt
 
-    # AdGuard Home
+    # AdGuard Home (публичный)
     adguard:
       rule: "Host(`adguard.forust.xyz`)"
       entryPoints:
@@ -31,8 +29,7 @@ http:
       service: adguard
       middlewares:
         - security-headers
-      tls:
+      tls: {}
-        certResolver: letsencrypt
 
     # Nextcloud AIO Interface (локальный)
     nextcloud-aio:
@@ -44,7 +41,7 @@ http:
         - security-headers
       tls: {}
 
-    # Nextcloud Main
+    # Nextcloud Main (публичный)
     nextcloud:
       rule: "Host(`nextcloud.forust.xyz`)"
       entrypoints:
@@ -52,10 +49,9 @@ http:
       service: nextcloud
       middlewares:
         - nextcloud-chain
-      tls:
+      tls: {}
-        certResolver: letsencrypt
 
-    # Dockmon
+    # Dockmon (публичный)
     dockmon:
       rule: "Host(`dockmon.forust.xyz`)"
       entryPoints:
@@ -64,8 +60,7 @@ http:
       middlewares:
         # - dockmon-auth
         - security-headers
-      tls:
+      tls: {}
-        certResolver: letsencrypt
 
     # Glance (локальный)
     glance:
@@ -87,7 +82,7 @@ http:
         - security-headers
       tls: {}
 
-    # N8N
+    # N8N (локальный)
     n8n:
       rule: "Host(`n8n.workstation`)"
       entryPoints:
@@ -96,9 +91,8 @@ http:
       middlewares:
         - security-headers
       tls: {}
-        # certResolver: letsencrypt
 
-    # Gitea
+    # Gitea (публичный)
     gitea:
       rule: "Host(`gitea.forust.xyz`)"
       entryPoints:
@@ -106,8 +100,7 @@ http:
       service: gitea
       middlewares:
         - security-headers
-      tls:
+      tls: {}
-        certResolver: letsencrypt
 
   services:
     # Portainer
@@ -248,3 +241,29 @@ http:
         middlewares:
           - nextcloud-secure-headers
           - security-headers
+
+# TLS Configuration
+tls:
+  certificates:
+    # Cloudflare Origin CA для публичных доменов *.forust.xyz
+    - certFile: /certs/cloudflare.pem
+      keyFile: /certs/cloudflare.key
+    # Локальный сертификат для *.workstation
+    - certFile: /certs/workstation+1.pem
+      keyFile: /certs/workstation+1-key.pem
+  
+  stores:
+    default:
+      defaultCertificate:
+        # По умолчанию используем локальный сертификат
+        certFile: /certs/workstation+1.pem
+        keyFile: /certs/workstation+1-key.pem
+  
+  options:
+    default:
+      minVersion: VersionTLS12
+      sniStrict: true
+      cipherSuites:
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305

traefik/dynamic/tls.yml

@@ -1,19 +0,0 @@
-tls:
-  certificates:
-    - certFile: /certs/workstation+1.pem
-      keyFile: /certs/workstation+1-key.pem
-  stores:
-    default:
-      defaultCertificate:
-        certFile: /certs/cloudflare.pem
-        keyFile: /certs/cloudflare.key
-
-  
-  options:
-    default:
-      minVersion: VersionTLS12
-      sniStrict: true
-      cipherSuites:
-        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
-        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305