cloudflare + letsencrypt

traefik/dynamic/services.yml

@@ -2,102 +2,112 @@ http:
   routers:
     # Traefik Dashboard
     traefik-dashboard:
-      rule: "Host(`traefik.workstation`)"
+      rule: "Host(`traefik.forust.xyz`)"
       entryPoints:
         - websecure
       service: api@internal
-      tls: {}
+      middlewares:
+        - auth
+        - security-headers
+      tls:
+        certResolver: letsencrypt
 
     # Portainer
     portainer:
-      rule: "Host(`portainer.workstation`)"
+      rule: "Host(`portainer.forust.xyz`)"
       entryPoints:
         - websecure
       service: portainer
-      tls: {}
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
 
     # AdGuard Home
-    adguard-redirect:
-      rule: "Host(`adguard.workstation`)"
-      entryPoints:
-        - web
-      middlewares:
-        - redirect-https
-      service: adguard
-
-    adguard-secure:
-      rule: "Host(`adguard.workstation`)"
+    adguard:
+      rule: "Host(`adguard.forust.xyz`)"
       entryPoints:
         - websecure
       service: adguard
-      tls: {}
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
 
-    # Nextcloud AIO Interface
+    # Nextcloud AIO Interface (локальный)
     nextcloud-aio:
       rule: "Host(`nextcloud-aio.workstation`)"
       entryPoints:
         - websecure
       service: nextcloud-aio
+      middlewares:
+        - security-headers
       tls: {}
 
     # Nextcloud Main
     nextcloud:
-      rule: "Host(`nextcloud.workstation`)"
+      rule: "Host(`nextcloud.forust.xyz`)"
       entrypoints:
         - websecure
       service: nextcloud
       middlewares:
         - nextcloud-chain
-      tls: {}
+      tls:
+        certResolver: letsencrypt
 
     # Dockmon
     dockmon:
-      rule: "Host(`dockmon.workstation`)"
+      rule: "Host(`dockmon.forust.xyz`)"
       entryPoints:
         - websecure
       service: dockmon
-      tls: {}
+      middlewares:
+        - dockmon-auth
+        - security-headers
+      tls:
+        certResolver: letsencrypt
 
-    # Glance
+    # Glance (локальный)
     glance:
       rule: "Host(`glance.workstation`)"
       entryPoints:
         - websecure
       service: glance
+      middlewares:
+        - security-headers
       tls: {}
 
-    # Watercrawl (edu_master)
+    # Watercrawl (локальный)
     watercrawl:
       rule: "Host(`watercrawl.workstation`)"
       entryPoints:
         - websecure
       service: watercrawl
+      middlewares:
+        - security-headers
       tls: {}
 
     # N8N
     n8n:
-      rule: "Host(`n8n.workstation`)"
+      rule: "Host(`n8n.forust.xyz`)"
       entryPoints:
         - websecure
       service: n8n
-      tls: {}
-    
-    # Gitea Redirect
-    gitea-redirect:
-      rule: "Host(`gitea.workstation`)"
-      entryPoints:
-        - web
       middlewares:
-        - redirect-https
-      service: gitea
+        - security-headers
+      tls:
+        certResolver: letsencrypt
 
     # Gitea
     gitea:
-      rule: "Host(`gitea.workstation`)"
+      rule: "Host(`gitea.forust.xyz`)"
       entryPoints:
         - websecure
       service: gitea
-      tls: {}
+      middlewares:
+        - security-headers
+      tls:
+        certResolver: letsencrypt
 
   services:
     # Portainer
@@ -105,6 +115,7 @@ http:
       loadBalancer:
         servers:
           - url: "https://portainer:9443"
+        serversTransport: insecureTransport
 
     # AdGuard Home
     adguard:
@@ -117,6 +128,7 @@ http:
       loadBalancer:
         servers:
           - url: "https://nextcloud-aio-mastercontainer:8080"
+        serversTransport: insecureTransport
 
     # Nextcloud Main
     nextcloud:
@@ -129,6 +141,7 @@ http:
       loadBalancer:
         servers:
           - url: "https://dockmon:443"
+        serversTransport: insecureTransport
 
     # Glance
     glance:
@@ -154,6 +167,10 @@ http:
         servers:
           - url: "http://gitea:3000"
 
+  serversTransports:
+    insecureTransport:
+      insecureSkipVerify: true
+
   middlewares:
     # HTTPS Redirect
     redirect-https:
@@ -161,6 +178,40 @@ http:
         scheme: https
         permanent: true
 
+    # Basic Auth для Traefik Dashboard
+    auth:
+      basicAuth:
+        users:
+          - "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
+        realm: "Traefik Dashboard"
+
+    # Basic Auth для Dockmon
+    dockmon-auth:
+      basicAuth:
+        users:
+          - "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
+        realm: "Dockmon Access"
+    
+    # Cloudflare IP Whitelist (опционально)
+    cloudflare-ipwhitelist:
+      ipWhiteList:
+        sourceRange:
+          - "173.245.48.0/20"
+          - "103.21.244.0/22"
+          - "103.22.200.0/22"
+          - "103.31.4.0/22"
+          - "141.101.64.0/18"
+          - "108.162.192.0/18"
+          - "190.93.240.0/20"
+          - "188.114.96.0/20"
+          - "197.234.240.0/22"
+          - "198.41.128.0/17"
+          - "162.158.0.0/15"
+          - "104.16.0.0/13"
+          - "104.24.0.0/14"
+          - "172.64.0.0/13"
+          - "131.0.72.0/22"
+
     # Security Headers
     security-headers:
       headers:
@@ -171,15 +222,29 @@ http:
         stsPreload: true
         stsSeconds: 31536000
         customFrameOptionsValue: "SAMEORIGIN"
+        customResponseHeaders:
+          X-Content-Type-Options: "nosniff"
+          Referrer-Policy: "strict-origin-when-cross-origin"
 
+    # Nextcloud specific headers
     nextcloud-secure-headers:
       headers:
         hostsProxyHeaders:
           - "X-Forwarded-Host"
+          - "X-Forwarded-Proto"
         referrerPolicy: "same-origin"
+        customFrameOptionsValue: "SAMEORIGIN"
 
+    # Rate limiting
+    rate-limit:
+      rateLimit:
+        average: 100
+        burst: 50
+        period: 1m
+
+    # Nextcloud chain
     nextcloud-chain:
       chain:
         middlewares:
-          - redirect-https
           - nextcloud-secure-headers
+          - security-headers