Merge branch 'main' into metube

traefik/dynamic/dynamic.yml

@@ -1,6 +1,6 @@
 http:
   routers:
-    # Traefik Dashboard
+    # Traefik Dashboard (ADMIN, local only)
     traefik-dashboard:
       rule: "Host(`traefik.workstation`)"
       entryPoints:
@@ -10,7 +10,16 @@ http:
         # - auth
         - security-headers
       tls: {}
-        # certResolver: letsencrypt
+
+    # Nextcloud AIO Interface (ADMIN, local is better)
+    nextcloud-aio:
+      rule: "Host(`nextcloud-aio.workstation`)"
+      entryPoints:
+        - websecure
+      service: nextcloud-aio
+      middlewares:
+        - security-headers
+      tls: {}
 
     # MeTube
     metube:
@@ -24,7 +33,7 @@ http:
       tls:
         certResolver: letsencrypt
 
-    # Portainer
+    # Portainer (public (account required))
     portainer:
       rule: "Host(`portainer.forust.xyz`)"
       entryPoints:
@@ -32,31 +41,20 @@ http:
       service: portainer
       middlewares:
         - security-headers
-      tls:
-        certResolver: letsencrypt
+      tls: {}
 
-    # AdGuard Home
+    # AdGuard Home (public (account required))
     adguard:
       rule: "Host(`adguard.forust.xyz`)"
       entryPoints:
         - websecure
       service: adguard
-      middlewares:
-        - security-headers
-      tls:
-        certResolver: letsencrypt
-
-    # Nextcloud AIO Interface (локальный)
-    nextcloud-aio:
-      rule: "Host(`nextcloud-aio.workstation`)"
-      entryPoints:
-        - websecure
-      service: nextcloud-aio
       middlewares:
         - security-headers
       tls: {}
 
-    # Nextcloud Main
+
+    # Nextcloud Main (public (account required))
     nextcloud:
       rule: "Host(`nextcloud.forust.xyz`)"
       entrypoints:
@@ -64,10 +62,9 @@ http:
       service: nextcloud
       middlewares:
         - nextcloud-chain
-      tls:
-        certResolver: letsencrypt
+      tls: {}
 
-    # Dockmon
+    # Dockmon (public (account required))
     dockmon:
       rule: "Host(`dockmon.forust.xyz`)"
       entryPoints:
@@ -76,20 +73,30 @@ http:
       middlewares:
         # - dockmon-auth
         - security-headers
-      tls:
-        certResolver: letsencrypt
+      tls: {}
 
-    # Glance (локальный)
-    glance:
-      rule: "Host(`glance.workstation`)"
+    # Gitea (public (account required))
+    gitea:
+      rule: "Host(`gitea.forust.xyz`)"
       entryPoints:
         - websecure
-      service: glance
+        - ssh
+      service: gitea
       middlewares:
         - security-headers
       tls: {}
 
-    # Watercrawl (локальный)
+    # # Glance (local only)
+    # glance:
+    #   rule: "Host(`glance.workstation`)"
+    #   entryPoints:
+    #     - websecure
+    #   service: glance
+    #   middlewares:
+    #     - security-headers
+    #   tls: {}
+
+    # Watercrawl (local only)
     watercrawl:
       rule: "Host(`watercrawl.workstation`)"
       entryPoints:
@@ -99,7 +106,7 @@ http:
         - security-headers
       tls: {}
 
-    # N8N
+    # N8N (local only)
     n8n:
       rule: "Host(`n8n.workstation`)"
       entryPoints:
@@ -108,18 +115,7 @@ http:
       middlewares:
         - security-headers
       tls: {}
-        # certResolver: letsencrypt
 
-    # Gitea
-    gitea:
-      rule: "Host(`gitea.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: gitea
-      middlewares:
-        - security-headers
-      tls:
-        certResolver: letsencrypt
 
   services:
     # Portainer
@@ -155,11 +151,11 @@ http:
           - url: "https://dockmon:443"
         serversTransport: insecureTransport
 
-    # Glance
-    glance:
-      loadBalancer:
-        servers:
-          - url: "http://glance:8080"
+    # # Glance
+    # glance:
+    #   loadBalancer:
+    #     servers:
+    #       - url: "http://glance:8080"
 
     # Watercrawl
     watercrawl:
@@ -172,7 +168,7 @@ http:
       loadBalancer:
         servers:
           - url: "http://n8n:5678"
-    
+
     # Gitea
     gitea:
       loadBalancer:
@@ -202,21 +198,21 @@ http:
           - "vv:$2y$05$oO.mQXBZSJq7aDRJF1iorudafu9HsrJCEfKb6Cev8UlzWOF8kzlY6"
         realm: "MeTube Access"
 
-    # Basic Auth для Traefik Dashboard
+    # Basic Auth Traefik Dashboard
     auth:
       basicAuth:
         users:
           - "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
         realm: "Traefik Dashboard"
 
-    # Basic Auth для Dockmon
+    # Basic Auth Dockmon
     dockmon-auth:
       basicAuth:
         users:
           - "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
         realm: "Dockmon Access"
     
-    # Cloudflare IP Whitelist (опционально)
+    # Cloudflare IP Whitelist
     cloudflare-ipwhitelist:
       ipWhiteList:
         sourceRange:
@@ -271,4 +267,30 @@ http:
       chain:
         middlewares:
           - nextcloud-secure-headers
-          - security-headers
+          - security-headers
+
+# TLS Configuration
+tls:
+  certificates:
+    # Cloudflare Origin CA *.forust.xyz
+    - certFile: /certs/cloudflare.pem
+      keyFile: /certs/cloudflare.key
+    # Local certificate
+    - certFile: /certs/workstation+1.pem
+      keyFile: /certs/workstation+1-key.pem
+  
+  stores:
+    default:
+      defaultCertificate:
+        # Fallback local certificate
+        certFile: /certs/workstation+1.pem
+        keyFile: /certs/workstation+1-key.pem
+  
+  options:
+    default:
+      minVersion: VersionTLS12
+      sniStrict: true
+      cipherSuites:
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305

traefik/dynamic/tls.yml

@@ -1,19 +0,0 @@
-tls:
-  certificates:
-    - certFile: /certs/workstation+1.pem
-      keyFile: /certs/workstation+1-key.pem
-  stores:
-    default:
-      defaultCertificate:
-        certFile: /certs/cloudflare.pem
-        keyFile: /certs/cloudflare.key
-
-  
-  options:
-    default:
-      minVersion: VersionTLS12
-      sniStrict: true
-      cipherSuites:
-        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
-        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305