From a767107277bfdad90756d9c110bebc47f71cf10a Mon Sep 17 00:00:00 2001 From: mr-forust Date: Fri, 5 Dec 2025 14:36:57 +0100 Subject: [PATCH] fix: refering to file-defined middlewares --- adguardhome/compose.yaml | 6 +++--- dockmon/compose.yaml | 6 +++--- gitea/compose.yaml | 6 +++--- glance/compose.yaml | 8 ++++---- homepage/compose.yaml | 6 +++--- metube/compose.yaml | 6 +++--- n8n/compose.yaml | 6 +++--- nextcloud/compose.yaml | 4 ++-- penpot/compose.yaml | 6 +++--- portainer/compose.yaml | 6 +++--- termix/compose.yaml | 6 +++--- traefik/compose.yaml | 11 ++++++----- traefik/dynamic/tls.yml | 15 ++++++--------- 13 files changed, 45 insertions(+), 47 deletions(-) diff --git a/adguardhome/compose.yaml b/adguardhome/compose.yaml index 0ca5cfc..bbcd151 100644 --- a/adguardhome/compose.yaml +++ b/adguardhome/compose.yaml @@ -23,7 +23,7 @@ services: # Prod Router - "traefik.http.routers.adguard.rule=Host(`adguard.forust.xyz`)" - "traefik.http.routers.adguard.entrypoints=websecure" - - "traefik.http.routers.adguard.middlewares=security-headers" + - "traefik.http.routers.adguard.middlewares=security-headers@file" - "traefik.http.routers.adguard.service=adguard" - "traefik.http.routers.adguard.tls=true" - "traefik.http.services.adguard.loadbalancer.server.port=3000" @@ -31,14 +31,14 @@ services: # Local Router - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`adguard.internal`)" - "traefik.http.routers.adguard-local.entrypoints=websecure" - - "traefik.http.routers.adguard-local.middlewares=security-headers" + - "traefik.http.routers.adguard-local.middlewares=security-headers@file" - "traefik.http.routers.adguard-local.service=adguard" - "traefik.http.routers.adguard-local.tls=true" # Dev Router - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`)" - "traefik.http.routers.adguard-dev.entrypoints=websecure" - - "traefik.http.routers.adguard-dev.middlewares=security-headers" + - "traefik.http.routers.adguard-dev.middlewares=security-headers@file" - "traefik.http.routers.adguard-dev.service=adguard" - "traefik.http.routers.adguard-dev.tls=true" diff --git a/dockmon/compose.yaml b/dockmon/compose.yaml index 3f5bf60..ba2b458 100644 --- a/dockmon/compose.yaml +++ b/dockmon/compose.yaml @@ -24,7 +24,7 @@ services: # Prod Router - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)" - "traefik.http.routers.dockmon.entrypoints=websecure" - - "traefik.http.routers.dockmon.middlewares=security-headers,dockmon-auth" + - "traefik.http.routers.dockmon.middlewares=security-headers@file,dockmon-auth@file" - "traefik.http.routers.dockmon.service=dockmon" - "traefik.http.routers.dockmon.tls=true" - "traefik.http.services.dockmon.loadbalancer.server.port=443" @@ -34,14 +34,14 @@ services: # Local Router - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`) || Host(`dockmon.internal`)" - "traefik.http.routers.dockmon-local.entrypoints=websecure" - - "traefik.http.routers.dockmon-local.middlewares=security-headers" + - "traefik.http.routers.dockmon-local.middlewares=security-headers@file" - "traefik.http.routers.dockmon-local.service=dockmon" - "traefik.http.routers.dockmon-local.tls=true" # Dev Router - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)" - "traefik.http.routers.dockmon-dev.entrypoints=websecure" - - "traefik.http.routers.dockmon-dev.middlewares=security-headers" + - "traefik.http.routers.dockmon-dev.middlewares=security-headers@file" - "traefik.http.routers.dockmon-dev.service=dockmon" - "traefik.http.routers.dockmon-dev.tls=true" diff --git a/gitea/compose.yaml b/gitea/compose.yaml index b2314ca..2e0c67b 100644 --- a/gitea/compose.yaml +++ b/gitea/compose.yaml @@ -29,7 +29,7 @@ services: # Prod Router - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)" - "traefik.http.routers.gitea.entrypoints=websecure" - - "traefik.http.routers.gitea.middlewares=security-headers" + - "traefik.http.routers.gitea.middlewares=security-headers@file" - "traefik.http.routers.gitea.service=gitea" - "traefik.http.routers.gitea.tls=true" - "traefik.http.services.gitea.loadbalancer.server.port=3000" @@ -37,14 +37,14 @@ services: # Local Router - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.internal`) || Host(`gitea.internal`)" - "traefik.http.routers.gitea-local.entrypoints=websecure" - - "traefik.http.routers.gitea-local.middlewares=security-headers" + - "traefik.http.routers.gitea-local.middlewares=security-headers@file" - "traefik.http.routers.gitea-local.service=gitea" - "traefik.http.routers.gitea-local.tls=true" # Dev Router - "traefik.http.routers.gitea-dev.rule=Host(`gitea.gigaforust.internal`)" - "traefik.http.routers.gitea-dev.entrypoints=websecure" - - "traefik.http.routers.gitea-dev.middlewares=security-headers" + - "traefik.http.routers.gitea-dev.middlewares=security-headers@file" - "traefik.http.routers.gitea-dev.service=gitea" - "traefik.http.routers.gitea-dev.tls=true" ports: diff --git a/glance/compose.yaml b/glance/compose.yaml index 82f5267..6a06f66 100644 --- a/glance/compose.yaml +++ b/glance/compose.yaml @@ -16,19 +16,19 @@ services: # Prod Router - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)" - "traefik.http.routers.glance.entrypoints=websecure" - - "traefik.http.routers.glance.middlewares=security-headers" + - "traefik.http.routers.glance.middlewares=security-headers@file" - "traefik.http.routers.glance.tls=true" # Local Router - "traefik.http.routers.glance-local.rule=Host(`glance.workstation.internal`) || Host(`glance.internal`)" - "traefik.http.routers.glance-local.entrypoints=websecure" - - "traefik.http.routers.glance-local.middlewares=security-headers" + - "traefik.http.routers.glance-local.middlewares=security-headers@file" - "traefik.http.routers.glance-local.tls=true" # Dev Router - "traefik.http.routers.glance-dev.rule=Host(`glance.gigaforust.internal`)" - "traefik.http.routers.glance-dev.entrypoints=websecure" - - "traefik.http.routers.glance-dev.middlewares=security-headers" + - "traefik.http.routers.glance-dev.middlewares=security-headers@file" - "traefik.http.routers.glance-dev.tls=true" networks: - traefik-proxy @@ -37,4 +37,4 @@ services: - 8.8.8.8 networks: traefik-proxy: - external: true + external: true \ No newline at end of file diff --git a/homepage/compose.yaml b/homepage/compose.yaml index bb36bed..453fe6a 100644 --- a/homepage/compose.yaml +++ b/homepage/compose.yaml @@ -15,7 +15,7 @@ services: # Prod Router - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)" - "traefik.http.routers.forust-homepage.entrypoints=websecure" - - "traefik.http.routers.forust-homepage.middlewares=security-headers" + - "traefik.http.routers.forust-homepage.middlewares=security-headers@file" - "traefik.http.routers.forust-homepage.service=forust-homepage" - "traefik.http.routers.forust-homepage.tls=true" - "traefik.http.services.forust-homepage.loadbalancer.server.port=80" @@ -23,14 +23,14 @@ services: # Local Router - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`) || Host(`landing.internal`)" - "traefik.http.routers.forust-homepage-local.entrypoints=websecure" - - "traefik.http.routers.forust-homepage-local.middlewares=security-headers" + - "traefik.http.routers.forust-homepage-local.middlewares=security-headers@file" - "traefik.http.routers.forust-homepage-local.service=forust-homepage" - "traefik.http.routers.forust-homepage-local.tls=true" # Dev Router - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)" - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure" - - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers" + - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers@file" - "traefik.http.routers.forust-homepage-dev.service=forust-homepage" - "traefik.http.routers.forust-homepage-dev.tls=true" diff --git a/metube/compose.yaml b/metube/compose.yaml index 950baa0..df63607 100644 --- a/metube/compose.yaml +++ b/metube/compose.yaml @@ -19,7 +19,7 @@ services: # Prod Router - "traefik.http.routers.metube.rule=Host(`metube.forust.xyz`)" - "traefik.http.routers.metube.entrypoints=websecure" - - "traefik.http.routers.metube.middlewares=security-headers,metube-auth" + - "traefik.http.routers.metube.middlewares=security-headers@file,metube-auth@file" - "traefik.http.routers.metube.service=metube" - "traefik.http.routers.metube.tls=true" - "traefik.http.services.metube.loadbalancer.server.port=8081" @@ -27,14 +27,14 @@ services: # Local Router - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`) || Host(`metube.internal`)" - "traefik.http.routers.metube-local.entrypoints=websecure" - - "traefik.http.routers.metube-local.middlewares=security-headers,metube-auth" + - "traefik.http.routers.metube-local.middlewares=security-headers@file,metube-auth@file" - "traefik.http.routers.metube-local.service=metube" - "traefik.http.routers.metube-local.tls=true" # Dev Router - "traefik.http.routers.metube-dev.rule=Host(`metube.gigaforust.internal`)" - "traefik.http.routers.metube-dev.entrypoints=websecure" - - "traefik.http.routers.metube-dev.middlewares=security-headers,metube-auth" + - "traefik.http.routers.metube-dev.middlewares=security-headers@file,metube-auth@file" - "traefik.http.routers.metube-dev.service=metube" - "traefik.http.routers.metube-dev.tls=true" diff --git a/n8n/compose.yaml b/n8n/compose.yaml index 32500e3..bcaa985 100644 --- a/n8n/compose.yaml +++ b/n8n/compose.yaml @@ -32,7 +32,7 @@ services: # Prod Router - "traefik.http.routers.n8n.rule=Host(`n8n.forust.xyz`)" - "traefik.http.routers.n8n.entrypoints=websecure" - - "traefik.http.routers.n8n.middlewares=security-headers" + - "traefik.http.routers.n8n.middlewares=security-headers@file" - "traefik.http.routers.n8n.service=n8n" - "traefik.http.routers.n8n.tls=true" - "traefik.http.services.n8n.loadbalancer.server.port=5678" @@ -40,14 +40,14 @@ services: # Local Router - "traefik.http.routers.n8n-local.rule=Host(`n8n.workstation.internal`) || Host(`n8n.internal`)" - "traefik.http.routers.n8n-local.entrypoints=websecure" - - "traefik.http.routers.n8n-local.middlewares=security-headers" + - "traefik.http.routers.n8n-local.middlewares=security-headers@file" - "traefik.http.routers.n8n-local.service=n8n" - "traefik.http.routers.n8n-local.tls=true" # Dev Router - "traefik.http.routers.n8n-dev.rule=Host(`n8n.gigaforust.internal`)" - "traefik.http.routers.n8n-dev.entrypoints=websecure" - - "traefik.http.routers.n8n-dev.middlewares=security-headers" + - "traefik.http.routers.n8n-dev.middlewares=security-headers@file" - "traefik.http.routers.n8n-dev.service=n8n" - "traefik.http.routers.n8n-dev.tls=true" diff --git a/nextcloud/compose.yaml b/nextcloud/compose.yaml index 196410e..641f988 100644 --- a/nextcloud/compose.yaml +++ b/nextcloud/compose.yaml @@ -32,14 +32,14 @@ services: # Local Router - "traefik.http.routers.nextcloud-aio-local.rule=Host(`nextcloud-aio.workstation.internal`) || Host(`nextcloud-aio.internal`)" - "traefik.http.routers.nextcloud-aio-local.entrypoints=websecure" - - "traefik.http.routers.nextcloud-aio-local.middlewares=security-headers" + - "traefik.http.routers.nextcloud-aio-local.middlewares=security-headers@file" - "traefik.http.routers.nextcloud-aio-local.service=nextcloud-aio" - "traefik.http.routers.nextcloud-aio-local.tls=true" # Dev Router - "traefik.http.routers.nextcloud-aio-dev.rule=Host(`nextcloud-aio.gigaforust.internal`)" - "traefik.http.routers.nextcloud-aio-dev.entrypoints=websecure" - - "traefik.http.routers.nextcloud-aio-dev.middlewares=security-headers" + - "traefik.http.routers.nextcloud-aio-dev.middlewares=security-headers@file" - "traefik.http.routers.nextcloud-aio-dev.service=nextcloud-aio" - "traefik.http.routers.nextcloud-aio-dev.tls=true" diff --git a/penpot/compose.yaml b/penpot/compose.yaml index 5d8eba4..d9eb665 100644 --- a/penpot/compose.yaml +++ b/penpot/compose.yaml @@ -107,7 +107,7 @@ services: # Prod Router - "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)" - "traefik.http.routers.penpot.entrypoints=websecure" - - "traefik.http.routers.penpot.middlewares=security-headers" + - "traefik.http.routers.penpot.middlewares=security-headers@file" - "traefik.http.routers.penpot.service=penpot" - "traefik.http.routers.penpot.tls=true" - "traefik.http.services.penpot.loadbalancer.server.port=8080" @@ -115,14 +115,14 @@ services: # Local Router - "traefik.http.routers.penpot-local.rule=Host(`penpot.workstation.internal`) || Host(`penpot.internal`)" - "traefik.http.routers.penpot-local.entrypoints=websecure" - - "traefik.http.routers.penpot-local.middlewares=security-headers" + - "traefik.http.routers.penpot-local.middlewares=security-headers@file" - "traefik.http.routers.penpot-local.service=penpot" - "traefik.http.routers.penpot-local.tls=true" # Dev Router - "traefik.http.routers.penpot-dev.rule=Host(`penpot.gigaforust.internal`)" - "traefik.http.routers.penpot-dev.entrypoints=websecure" - - "traefik.http.routers.penpot-dev.middlewares=security-headers" + - "traefik.http.routers.penpot-dev.middlewares=security-headers@file" - "traefik.http.routers.penpot-dev.service=penpot" - "traefik.http.routers.penpot-dev.tls=true" diff --git a/portainer/compose.yaml b/portainer/compose.yaml index 26e6f19..84651df 100644 --- a/portainer/compose.yaml +++ b/portainer/compose.yaml @@ -18,7 +18,7 @@ services: # Prod Router - "traefik.http.routers.portainer.rule=Host(`portainer.forust.xyz`)" - "traefik.http.routers.portainer.entrypoints=websecure" - - "traefik.http.routers.portainer.middlewares=security-headers" + - "traefik.http.routers.portainer.middlewares=security-headers@file" - "traefik.http.routers.portainer.service=portainer" - "traefik.http.routers.portainer.tls=true" - "traefik.http.services.portainer.loadbalancer.server.port=9443" @@ -28,14 +28,14 @@ services: # Local Router - "traefik.http.routers.portainer-local.rule=Host(`portainer.workstation.internal`) || Host(`portainer.internal`)" - "traefik.http.routers.portainer-local.entrypoints=websecure" - - "traefik.http.routers.portainer-local.middlewares=security-headers" + - "traefik.http.routers.portainer-local.middlewares=security-headers@file" - "traefik.http.routers.portainer-local.service=portainer" - "traefik.http.routers.portainer-local.tls=true" # Dev Router - "traefik.http.routers.portainer-dev.rule=Host(`portainer.gigaforust.internal`)" - "traefik.http.routers.portainer-dev.entrypoints=websecure" - - "traefik.http.routers.portainer-dev.middlewares=security-headers" + - "traefik.http.routers.portainer-dev.middlewares=security-headers@file" - "traefik.http.routers.portainer-dev.service=portainer" - "traefik.http.routers.portainer-dev.tls=true" diff --git a/termix/compose.yaml b/termix/compose.yaml index 955ada5..44a87c1 100644 --- a/termix/compose.yaml +++ b/termix/compose.yaml @@ -16,7 +16,7 @@ services: # Prod Router - "traefik.http.routers.termix.rule=Host(`termix.forust.xyz`)" - "traefik.http.routers.termix.entrypoints=websecure" - - "traefik.http.routers.termix.middlewares=security-headers" + - "traefik.http.routers.termix.middlewares=security-headers@file" - "traefik.http.routers.termix.service=termix" - "traefik.http.routers.termix.tls=true" - "traefik.http.services.termix.loadbalancer.server.port=8080" @@ -24,14 +24,14 @@ services: # Local Router - "traefik.http.routers.termix-local.rule=Host(`termix.workstation.internal`) || Host(`termix.internal`)" - "traefik.http.routers.termix-local.entrypoints=websecure" - - "traefik.http.routers.termix-local.middlewares=security-headers" + - "traefik.http.routers.termix-local.middlewares=security-headers@file" - "traefik.http.routers.termix-local.service=termix" - "traefik.http.routers.termix-local.tls=true" # Dev Router - "traefik.http.routers.termix-dev.rule=Host(`termix.gigaforust.internal`)" - "traefik.http.routers.termix-dev.entrypoints=websecure" - - "traefik.http.routers.termix-dev.middlewares=security-headers" + - "traefik.http.routers.termix-dev.middlewares=security-headers@file" - "traefik.http.routers.termix-dev.service=termix" - "traefik.http.routers.termix-dev.tls=true" networks: diff --git a/traefik/compose.yaml b/traefik/compose.yaml index 53b0741..f2c851b 100644 --- a/traefik/compose.yaml +++ b/traefik/compose.yaml @@ -1,11 +1,11 @@ services: traefik: - image: traefik:v3.5 + image: traefik:latest container_name: traefik restart: unless-stopped command: # API - - "--api.insecure=false" + - "--api.insecure=true" - "--api.dashboard=true" # Providers @@ -35,11 +35,12 @@ services: - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22" # Logging - - "--log.level=INFO" + - "--log.level=DEBUG" - "--log.filePath=/var/log/traefik/traefik.log" - "--accesslog=true" - "--accesslog.filepath=/var/log/traefik/access.log" + labels: - "traefik.enable=true" - "traefik.docker.network=traefik-proxy" @@ -53,14 +54,14 @@ services: # Local Router - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.internal`) || Host(`traefik.internal`)" - "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure" - - "traefik.http.routers.traefik-dashboard-local.middlewares=auth,security-headers" + - "traefik.http.routers.traefik-dashboard-local.middlewares=auth@file,security-headers@file" - "traefik.http.routers.traefik-dashboard-local.service=api@internal" - "traefik.http.routers.traefik-dashboard-local.tls=true" # Dev Router - "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.internal`)" - "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure" - - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-headers" + - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-headers@file" - "traefik.http.routers.traefik-dashboard-dev.service=api@internal" - "traefik.http.routers.traefik-dashboard-dev.tls=true" diff --git a/traefik/dynamic/tls.yml b/traefik/dynamic/tls.yml index 83ab0ce..9416a04 100644 --- a/traefik/dynamic/tls.yml +++ b/traefik/dynamic/tls.yml @@ -4,22 +4,19 @@ tls: # Cloudflare Origin CA *.forust.xyz - certFile: /certs/cloudflare.pem keyFile: /certs/cloudflare.key - # Local certificate - - certFile: /certs/workstation+1.pem - keyFile: /certs/workstation+1-key.pem - + stores: default: defaultCertificate: # Fallback local certificate - certFile: /certs/workstation+1.pem - keyFile: /certs/workstation+1-key.pem - + certFile: /certs/gigaforust.internal+1.pem + keyFile: /certs/gigaforust.internal+1-key.pem + options: default: minVersion: VersionTLS12 - sniStrict: true + sniStrict: false cipherSuites: - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 \ No newline at end of file + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305