From aa7239ee83104f0d552f38d0a0321bbd0b430929 Mon Sep 17 00:00:00 2001 From: mr-forust Date: Sun, 7 Dec 2025 01:39:58 +0100 Subject: [PATCH] refactor: traefik dynamic configuration --- traefik/dynamic/dynamic.bak | 328 -------------------------- traefik/dynamic/nextcloud-apache.yml | 13 + traefik/dynamic/routers-dev.yml.bak | 153 ------------ traefik/dynamic/routers-local.yml.bak | 152 ------------ traefik/dynamic/routers-prod.yml.bak | 152 ------------ traefik/dynamic/services.yml.bak | 86 ------- 6 files changed, 13 insertions(+), 871 deletions(-) delete mode 100644 traefik/dynamic/dynamic.bak delete mode 100644 traefik/dynamic/routers-dev.yml.bak delete mode 100644 traefik/dynamic/routers-local.yml.bak delete mode 100644 traefik/dynamic/routers-prod.yml.bak delete mode 100644 traefik/dynamic/services.yml.bak diff --git a/traefik/dynamic/dynamic.bak b/traefik/dynamic/dynamic.bak deleted file mode 100644 index dc39b9b..0000000 --- a/traefik/dynamic/dynamic.bak +++ /dev/null @@ -1,328 +0,0 @@ -http: - routers: - # Traefik Dashboard (ADMIN, local only) - traefik-dashboard: - rule: "Host(`traefik.workstation`)" - entryPoints: - - websecure - service: api@internal - middlewares: - # - auth - - security-headers - tls: {} - - # Nextcloud AIO Interface (ADMIN, local is better) - nextcloud-aio: - rule: "Host(`nextcloud-aio.workstation`)" - entryPoints: - - websecure - service: nextcloud-aio - middlewares: - - security-headers - tls: {} - - # Termix (public (account required)) - termix: - rule: "Host(`termix.forust.xyz`)" - entryPoints: - - websecure - service: termix - middlewares: - - security-headers - tls: {} - - # MeTube - metube: - rule: "Host(`metube.forust.xyz`)" - entryPoints: - - websecure - service: metube - middlewares: - - metube-auth - - security-headers - tls: {} - - # Portainer (public (account required)) - portainer: - rule: "Host(`portainer.forust.xyz`)" - entryPoints: - - websecure - service: portainer - middlewares: - - security-headers - tls: {} - - # Uptime Kuma - uptime-kuma: - rule: "Host(`uptime.forust.xyz`)" - entryPoints: - - websecure - service: uptime-kuma - tls: {} - - # AdGuard Home (public (account required)) - adguard: - rule: "Host(`adguard.forust.xyz`)" - entryPoints: - - websecure - service: adguard - middlewares: - - security-headers - tls: {} - - - # Nextcloud Main (public (account required)) - nextcloud: - rule: "Host(`nextcloud.forust.xyz`)" - entrypoints: - - websecure - service: nextcloud - middlewares: - - nextcloud-chain - tls: {} - - # Dockmon (public (account required)) - dockmon: - rule: "Host(`dockmon.forust.xyz`)" - entryPoints: - - websecure - service: dockmon - middlewares: - # - dockmon-auth - - security-headers - tls: {} - - # Gitea (public (account required)) - gitea: - rule: "Host(`gitea.forust.xyz`)" - entryPoints: - - websecure - - ssh - service: gitea - middlewares: - - security-headers - tls: {} - - # # Glance (local only) - # glance: - # rule: "Host(`glance.workstation`)" - # entryPoints: - # - websecure - # service: glance - # middlewares: - # - security-headers - # tls: {} - - # Watercrawl (local only) - watercrawl: - rule: "Host(`watercrawl.workstation`)" - entryPoints: - - websecure - service: watercrawl - middlewares: - - security-headers - tls: {} - - # N8N (local only) - n8n: - rule: "Host(`n8n.workstation`)" - entryPoints: - - websecure - service: n8n - middlewares: - - security-headers - tls: {} - - - services: - # Portainer - portainer: - loadBalancer: - servers: - - url: "https://portainer:9443" - serversTransport: insecureTransport - - # AdGuard Home - adguard: - loadBalancer: - servers: - - url: "http://adguardhome:3000" - - # Nextcloud AIO Interface - nextcloud-aio: - loadBalancer: - servers: - - url: "https://nextcloud-aio-mastercontainer:8080" - serversTransport: insecureTransport - - # Nextcloud Main - nextcloud: - loadBalancer: - servers: - - url: "http://nextcloud-aio-apache:11000" - - # Uptime Kuma - uptime-kuma: - loadBalancer: - servers: - - url: "http://uptime-kuma:3001" - - # Termix - termix: - loadBalancer: - servers: - - url: "http://termix:8080" - - # Dockmon - dockmon: - loadBalancer: - servers: - - url: "https://dockmon:443" - serversTransport: insecureTransport - - # # Glance - # glance: - # loadBalancer: - # servers: - # - url: "http://glance:8080" - - # Watercrawl - watercrawl: - loadBalancer: - servers: - - url: "http://nginx:80" - - # N8N - n8n: - loadBalancer: - servers: - - url: "http://n8n:5678" - - # Gitea - gitea: - loadBalancer: - servers: - - url: "http://gitea:3000" - # MeTube - metube: - loadBalancer: - servers: - - url: "http://metube:8081" - - serversTransports: - insecureTransport: - insecureSkipVerify: true - - middlewares: - # HTTPS Redirect - redirect-https: - redirectScheme: - scheme: https - permanent: true - - # Metube Basic Auth - metube-auth: - basicAuth: - users: - - "admin:$2y$05$3Q6gyLFW3NFNp4C6elnyfupntqB6VNB/tcIAeo8NEzvaqPxOjN0iC" - # - "jeepik:$2y$05$tIKrmhd7SYOe6yImRRAfpen7hpVdF8PnSbgBTCDZ.GI0Djx.Le2bq" - realm: "MeTube Access" - - # Basic Auth Traefik Dashboard - auth: - basicAuth: - users: - - "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9." - # - "jeepik:$2y$05$Q8QqJwSjpycVYONyk4id/.rDFApW9oL8tycRMlGttNySsDv71Rnsu" - # - "vv:" - realm: "Traefik Dashboard" - - # Basic Auth Dockmon - dockmon-auth: - basicAuth: - users: - - "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1" - realm: "Dockmon Access" - - # Cloudflare IP Whitelist - cloudflare-ipwhitelist: - ipWhiteList: - sourceRange: - - "173.245.48.0/20" - - "103.21.244.0/22" - - "103.22.200.0/22" - - "103.31.4.0/22" - - "141.101.64.0/18" - - "108.162.192.0/18" - - "190.93.240.0/20" - - "188.114.96.0/20" - - "197.234.240.0/22" - - "198.41.128.0/17" - - "162.158.0.0/15" - - "104.16.0.0/13" - - "104.24.0.0/14" - - "172.64.0.0/13" - - "131.0.72.0/22" - - # Security Headers - security-headers: - headers: - browserXssFilter: true - contentTypeNosniff: true - forceSTSHeader: true - stsIncludeSubdomains: true - stsPreload: true - stsSeconds: 31536000 - customFrameOptionsValue: "SAMEORIGIN" - customResponseHeaders: - X-Content-Type-Options: "nosniff" - Referrer-Policy: "strict-origin-when-cross-origin" - - # Nextcloud specific headers - nextcloud-secure-headers: - headers: - hostsProxyHeaders: - - "X-Forwarded-Host" - - "X-Forwarded-Proto" - referrerPolicy: "same-origin" - customFrameOptionsValue: "SAMEORIGIN" - - # Rate limiting - rate-limit: - rateLimit: - average: 100 - burst: 50 - period: 1m - - # Nextcloud chain - nextcloud-chain: - chain: - middlewares: - - nextcloud-secure-headers - - security-headers - -# TLS Configuration -tls: - certificates: - # Cloudflare Origin CA *.forust.xyz - - certFile: /certs/cloudflare.pem - keyFile: /certs/cloudflare.key - # Local certificate - - certFile: /certs/workstation+1.pem - keyFile: /certs/workstation+1-key.pem - - stores: - default: - defaultCertificate: - # Fallback local certificate - certFile: /certs/workstation+1.pem - keyFile: /certs/workstation+1-key.pem - - options: - default: - minVersion: VersionTLS12 - sniStrict: true - cipherSuites: - - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 \ No newline at end of file diff --git a/traefik/dynamic/nextcloud-apache.yml b/traefik/dynamic/nextcloud-apache.yml index 55357a6..a0d69de 100644 --- a/traefik/dynamic/nextcloud-apache.yml +++ b/traefik/dynamic/nextcloud-apache.yml @@ -10,6 +10,19 @@ http: - nextcloud-chain tls: {} + + # Nextcloud dev + nextcloud-local: + rule: "Host(`nextcloud.workstation.internal`)" + entrypoints: + - websecure + - web + service: nextcloud + middlewares: + - nextcloud-chain + tls: {} +w + # Nextcloud dev nextcloud-dev: rule: "Host(`nextcloud.gigaforust.internal`)" diff --git a/traefik/dynamic/routers-dev.yml.bak b/traefik/dynamic/routers-dev.yml.bak deleted file mode 100644 index 4a3ebea..0000000 --- a/traefik/dynamic/routers-dev.yml.bak +++ /dev/null @@ -1,153 +0,0 @@ -http: - routers: - # Traefik Dashboard (dev access. local only) - traefik-dashboard-dev: - rule: "Host(`traefik.gigaforust`)" - entryPoints: - - websecure - service: api@internal - middlewares: - # - auth - - security-headers - tls: {} - - # Nextcloud AIO Interface (dev access. local only) - nextcloud-aio-dev: - rule: "Host(`nextcloud-aio.gigaforust`)" - entryPoints: - - websecure - service: nextcloud-aio - middlewares: - - security-headers - tls: {} - - # Termix (dev access, (account required)) - termix-dev: - rule: "Host(`termix.gigaforust`)" - entryPoints: - - websecure - service: termix - middlewares: - - security-headers - tls: {} - - # MeTube (dev access, (auth required)) - metube-dev: - rule: "Host(`metube.gigaforust`)" - entryPoints: - - websecure - service: metube - middlewares: - - metube-auth - - security-headers - tls: {} - - # Portainer (dev acess, (account required)) - portainer-dev: - rule: "Host(`portainer.gigaforust`)" - entryPoints: - - websecure - service: portainer - middlewares: - - security-headers - tls: {} - - # Uptime Kuma (dev access, (account required)) - uptime-kuma-dev: - rule: "Host(`uptime.gigaforust`)" - entryPoints: - - websecure - service: uptime-kuma - tls: {} - - # AdGuard Home (dev access, (account required)) - adguard-dev: - rule: "Host(`adguard.gigaforust`)" - entryPoints: - - websecure - service: adguard - middlewares: - - security-headers - tls: {} - - # Nextcloud Main (public (account required)) - nextcloud-dev: - rule: "Host(`nextcloud.gigaforust`)" - entrypoints: - - websecure - service: nextcloud - middlewares: - - nextcloud-chain - tls: {} - - # Dockmon (dev access (account required)) - dockmon-dev: - rule: "Host(`dockmon.gigaforust`)" - entryPoints: - - websecure - service: dockmon - middlewares: - - security-headers - tls: {} - - # Gitea (dev access (account required)) - gitea-dev: - rule: "Host(`gitea.gigaforust`)" - entryPoints: - - websecure - - ssh - service: gitea - middlewares: - - security-headers - tls: {} - - # Glance (dev access, local only) - glance-dev: - rule: "Host(`glance.gigaforust`)" - entryPoints: - - websecure - service: glance - middlewares: - - security-headers - tls: {} - - # Watercrawl (dev access, local only) - watercrawl-dev: - rule: "Host(`watercrawl.gigaforust`)" - entryPoints: - - websecure - service: watercrawl - middlewares: - - security-headers - tls: {} - - # N8N (local only) - n8n-dev: - rule: "Host(`n8n.gigaforust`)" - entryPoints: - - websecure - service: n8n - middlewares: - - security-headers - tls: {} - - # Landing Page (public) - forust-homepage-dev: - rule: "Host(`landing.gigaforust`)" - entryPoints: - - websecure - service: forust-homepage - middlewares: - - security-headers - tls: {} - - # Penpot - penpot-dev: - rule: "Host(`penpot.gigaforust`)" - entryPoints: - - websecure - - web - service: penpot - middlewares: - - security-headers - tls: {} diff --git a/traefik/dynamic/routers-local.yml.bak b/traefik/dynamic/routers-local.yml.bak deleted file mode 100644 index c01d51c..0000000 --- a/traefik/dynamic/routers-local.yml.bak +++ /dev/null @@ -1,152 +0,0 @@ -http: - routers: - # Traefik Dashboard (local access, ADMIN, local only) - traefik-dashboard-local: - rule: "Host(`traefik.workstation`)" - entryPoints: - - websecure - service: api@internal - middlewares: - # - auth - - security-headers - tls: {} - - # Nextcloud AIO Interface (local access. ADMIN, local only) - nextcloud-aio-local: - rule: "Host(`nextcloud-aio.workstation`)" - entryPoints: - - websecure - service: nextcloud-aio - middlewares: - - security-headers - tls: {} - - # Termix (local access, (account required)) - termix-local: - rule: "Host(`termix.workstation`)" - entryPoints: - - websecure - service: termix - middlewares: - - security-headers - tls: {} - - # MeTube (local access, (auth required)) - metube-local: - rule: "Host(`metube.workstation`)" - entryPoints: - - websecure - service: metube - middlewares: - - metube-auth - - security-headers - tls: {} - - # Portainer (dev acess, (account required)) - portainer-local: - rule: "Host(`portainer.workstation`)" - entryPoints: - - websecure - service: portainer - middlewares: - - security-headers - tls: {} - - # Uptime Kuma (local access, (account required)) - uptime-kuma-local: - rule: "Host(`uptime.workstation`)" - entryPoints: - - websecure - service: uptime-kuma - tls: {} - - # AdGuard Home (local access, (account required)) - adguard-local: - rule: "Host(`adguard.workstation`)" - entryPoints: - - websecure - service: adguard - middlewares: - - security-headers - tls: {} - - # Nextcloud Main (public (account required)) - nextcloud-local: - rule: "Host(`nextcloud.workstation`)" - entrypoints: - - websecure - service: nextcloud - middlewares: - - nextcloud-chain - tls: {} - - # Nextcloud Main (public (account required)) - penpot-local: - rule: "Host(`penpot.workstation`)" - entrypoints: - - websecure - service: penpot - middlewares: - - security-headers - tls: {} - - # Dockmon (local access (account required)) - dockmon-local: - rule: "Host(`dockmon.workstation`)" - entryPoints: - - websecure - service: dockmon - middlewares: - - security-headers - tls: {} - - # Gitea (local access (account required)) - gitea-local: - rule: "Host(`gitea.workstation`)" - entryPoints: - - websecure - - ssh - service: gitea - middlewares: - - security-headers - tls: {} - - # Glance (local access) - glance-local: - rule: "Host(`glance.workstation`)" - entryPoints: - - websecure - service: glance - middlewares: - - security-headers - tls: {} - - # Watercrawl (local access) - watercrawl-local: - rule: "Host(`watercrawl.workstation`)" - entryPoints: - - websecure - service: watercrawl - middlewares: - - security-headers - tls: {} - - # N8N (local only) - n8n-local: - rule: "Host(`n8n.workstation`)" - entryPoints: - - websecure - service: n8n - middlewares: - - security-headers - tls: {} - - # Landing Page (local access) - forust-homepage-local: - rule: "Host(`landing.workstation`)" - entryPoints: - - websecure - service: forust-homepage - middlewares: - - security-headers - tls: {} diff --git a/traefik/dynamic/routers-prod.yml.bak b/traefik/dynamic/routers-prod.yml.bak deleted file mode 100644 index ff9cd44..0000000 --- a/traefik/dynamic/routers-prod.yml.bak +++ /dev/null @@ -1,152 +0,0 @@ -http: - routers: - # Traefik Dashboard (ADMIN, without subdomeain) - traefik-dashboard: - rule: "Host(`traefik.forust.xyz`)" - entryPoints: - - websecure - service: api@internal - middlewares: - - auth - - security-headers - tls: {} - - # Nextcloud AIO Interface (ADMIN, without subdomeain) - nextcloud-aio: - rule: "Host(`nextcloud-aio.forust.xyz`)" - entryPoints: - - websecure - service: nextcloud-aio - middlewares: - - security-headers - tls: {} - - # Nextcloud AIO Interface (ADMIN, without subdomeain) - penpot: - rule: "Host(`penpot.forust.xyz`)" - entryPoints: - - websecure - service: penpot - middlewares: - - security-headers - tls: {} - - # Termix (public (account required)) - termix: - rule: "Host(`termix.forust.xyz`)" - entryPoints: - - websecure - service: termix - middlewares: - - security-headers - tls: {} - - # MeTube (public (auth required)) - metube: - rule: "Host(`metube.forust.xyz`)" - entryPoints: - - websecure - service: metube - middlewares: - - metube-auth - - security-headers - tls: {} - - # Portainer (public (account required)) - portainer: - rule: "Host(`portainer.forust.xyz`)" - entryPoints: - - websecure - service: portainer - middlewares: - - security-headers - tls: {} - - # Uptime Kuma (public (account required)) - uptime-kuma: - rule: "Host(`uptime.forust.xyz`)" - entryPoints: - - websecure - service: uptime-kuma - tls: {} - - # AdGuard Home (public (account required)) - adguard: - rule: "Host(`adguard.forust.xyz`)" - entryPoints: - - websecure - service: adguard - middlewares: - - security-headers - tls: {} - - # Nextcloud Main (public (account required)) - nextcloud: - rule: "Host(`nextcloud.forust.xyz`)" - entrypoints: - - websecure - service: nextcloud - middlewares: - - nextcloud-chain - tls: {} - - # Dockmon (public (account required)) - dockmon: - rule: "Host(`dockmon.forust.xyz`)" - entryPoints: - - websecure - service: dockmon - middlewares: - - security-headers - tls: {} - - # Gitea (public (account required)) - gitea: - rule: "Host(`gitea.forust.xyz`)" - entryPoints: - - websecure - - ssh - service: gitea - middlewares: - - security-headers - tls: {} - - # Glance (public, without subdomain) - glance: - rule: "Host(`glance.forust.xyz`)" - entryPoints: - - websecure - service: glance - middlewares: - - security-headers - tls: {} - - # Watercrawl (public, without subdomain) - watercrawl: - rule: "Host(`watercrawl.fourst.xyz`)" - entryPoints: - - websecure - service: watercrawl - middlewares: - - security-headers - tls: {} - - # N8N (public, without subdomain) - n8n: - rule: "Host(`n8n.forust.xyz`)" - entryPoints: - - websecure - service: n8n - middlewares: - - security-headers - tls: {} - - # Landing Page (public) - forust-homepage: - rule: "Host(`forust.xyz`)" - entryPoints: - - websecure - service: forust-homepage - middlewares: - - security-headers - tls: {} diff --git a/traefik/dynamic/services.yml.bak b/traefik/dynamic/services.yml.bak deleted file mode 100644 index 7200893..0000000 --- a/traefik/dynamic/services.yml.bak +++ /dev/null @@ -1,86 +0,0 @@ -http: - services: - # Portainer - portainer: - loadBalancer: - servers: - - url: "https://portainer:9443" - serversTransport: insecureTransport - - # AdGuard Home - adguard: - loadBalancer: - servers: - - url: "http://adguardhome:3000" - - # Nextcloud AIO Interface - nextcloud-aio: - loadBalancer: - servers: - - url: "https://nextcloud-aio-mastercontainer:8080" - serversTransport: insecureTransport - - # Penpot - penpot: - loadBalancer: - servers: - - url: "http://penpot-frontend:8080" - - # Nextcloud Main - nextcloud: - loadBalancer: - servers: - - url: "http://nextcloud-aio-apache:11000" - - # Uptime Kuma - uptime-kuma: - loadBalancer: - servers: - - url: "http://uptime-kuma:3001" - - # Termix - termix: - loadBalancer: - servers: - - url: "http://termix:8080" - - # Dockmon - dockmon: - loadBalancer: - servers: - - url: "https://dockmon:443" - serversTransport: insecureTransport - - # Glance - glance: - loadBalancer: - servers: - - url: "http://glance:8080" - - # Watercrawl - watercrawl: - loadBalancer: - servers: - - url: "http://nginx:80" - - # N8N - n8n: - loadBalancer: - servers: - - url: "http://n8n:5678" - - # Gitea - gitea: - loadBalancer: - servers: - - url: "http://gitea:3000" - # MeTube - metube: - loadBalancer: - servers: - - url: "http://metube:8081" - # Landing Page - forust-homepage: - loadBalancer: - servers: - - url: "http://forust-homepage:80" \ No newline at end of file