ajuste file
This commit is contained in:
hcornet committed
1 parent
6a710059d0
commit
e8c32e79f1
12 files changed
+554
-62
No files matched your search
+1
-1
@@ -42,7 +42,7 @@ AUTHENTIK_SECRET_KEY=ThB3GtCJgHxkoFhyorQ4s5jMznqM13nebhHadJvbp5F2E11wA0
|
||||
AUTHENTIK_ERROR_REPORTING__ENABLED=true
|
||||
|
||||
# SMTP Host Emails are sent to
|
||||
AUTHENTIK_EMAIL__HOST=authentik-msmtpd
|
||||
AUTHENTIK_EMAIL__HOST=msmtpd-app
|
||||
AUTHENTIK_EMAIL__PORT=2500
|
||||
# Optionally authenticate (don't add quotation marks to your password)
|
||||
AUTHENTIK_EMAIL__USERNAME=
|
||||
|
||||
@@ -1,12 +1,9 @@
|
||||
#### networks
|
||||
networks:
|
||||
traefik_front_network:
|
||||
external: true
|
||||
back_network_authentik:
|
||||
name: back_network_authentik
|
||||
driver: bridge
|
||||
attachable: true
|
||||
monitoring_network:
|
||||
external: true
|
||||
|
||||
#### services
|
||||
services:
|
||||
@@ -63,7 +60,7 @@ services:
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.12.0}
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- traefik_front_network
|
||||
- front_network
|
||||
- back_network_authentik
|
||||
command: server
|
||||
environment:
|
||||
@@ -170,41 +167,3 @@ services:
|
||||
restart: true
|
||||
labels:
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
|
||||
###
|
||||
msmtpd:
|
||||
container_name: authentik-msmtpd
|
||||
hostname: authentik-msmtpd
|
||||
image: crazymax/msmtpd:latest
|
||||
networks:
|
||||
- back_network_authentik
|
||||
# ports:
|
||||
# - 2500:2500
|
||||
environment:
|
||||
- "TZ=Europe/Paris"
|
||||
- "PUID=1500"
|
||||
- "PGID=1500"
|
||||
- "SMTP_HOST=10.0.4.52"
|
||||
- "SMTP_PORT=587"
|
||||
- "SMTP_TLS=on"
|
||||
- "SMTP_STARTTLS=on"
|
||||
- "SMTP_TLS_CHECKCERT=off"
|
||||
- "SMTP_AUTH=on"
|
||||
- "[email protected]"
|
||||
- "SMTP_PASSWORD=Whf2VtLEd2QR4er"
|
||||
- "SMTP_DOMAIN=localhost"
|
||||
- "[email protected]"
|
||||
restart: always
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "echo EHLO localhost"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
labels:
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
|
||||
#volumes:
|
||||
# database:
|
||||
# driver: local
|
||||
# redis:
|
||||
# driver: local
|
||||
@@ -20,7 +20,7 @@ services:
|
||||
GID: "1000"
|
||||
PROMETHEUS: "true"
|
||||
networks:
|
||||
- back_network
|
||||
- crowdsec_network
|
||||
- monitoring_network
|
||||
- socket_proxy_network
|
||||
healthcheck:
|
||||
@@ -52,9 +52,8 @@ services:
|
||||
CROWDSEC_BOUNCER_API_KEY: "${CROWDSEC_BOUNCER_API_KEY}"
|
||||
CROWDSEC_AGENT_HOST: crowdsec:8080
|
||||
networks:
|
||||
- back_network
|
||||
- crowdsec_network
|
||||
depends_on:
|
||||
- traefik-crowdsec
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
|
||||
@@ -17,10 +17,10 @@ services:
|
||||
- ./images:/app/public/images
|
||||
- ./icons:/app/public/icons
|
||||
networks:
|
||||
- homepage
|
||||
- socket-proxy
|
||||
- traefik
|
||||
- watchtower
|
||||
- homepage_network
|
||||
- socket_proxy_network
|
||||
- front_network
|
||||
- watchtower_network
|
||||
depends_on:
|
||||
- socket-proxy
|
||||
labels:
|
||||
|
||||
@@ -1,13 +1,3 @@
|
||||
#### networks
|
||||
networks:
|
||||
traefik_front_network:
|
||||
external: true
|
||||
back_network_authentik:
|
||||
driver: bridge
|
||||
attachable: true
|
||||
monitoring_network:
|
||||
external: true
|
||||
|
||||
#### services
|
||||
services:
|
||||
###
|
||||
@@ -16,7 +6,7 @@ services:
|
||||
hostname: msmtpd-app
|
||||
image: crazymax/msmtpd:latest
|
||||
networks:
|
||||
- back_network_authentik
|
||||
- back_network
|
||||
# ports:
|
||||
# - 2500:2500
|
||||
environment:
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
services:
|
||||
|
||||
## socket-proxy:
|
||||
socket-proxy:
|
||||
container_name: socket-proxy
|
||||
hostname: socket-proxy
|
||||
image: ghcr.io/tecnativa/docker-socket-proxy:latest
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.).
|
||||
# 0 to revoke access.
|
||||
# 1 to grant access.
|
||||
## Granted by Default
|
||||
- EVENTS=1
|
||||
- PING=1
|
||||
- VERSION=1
|
||||
## Revoked by Default
|
||||
# Security critical
|
||||
- AUTH=0
|
||||
- SECRETS=0
|
||||
- POST=1 # Portainer and Watchtower
|
||||
# Not always needed
|
||||
- BUILD=0
|
||||
- COMMIT=0
|
||||
- CONFIGS=0
|
||||
- CONTAINERS=1 # Traefik, Portainer, etc.
|
||||
- DISTRIBUTION=0
|
||||
- EXEC=0
|
||||
- IMAGES=1 # Portainer
|
||||
- INFO=1 # Portainer
|
||||
- NETWORKS=1 # Portainer
|
||||
- NODES=0
|
||||
- PLUGINS=0
|
||||
- SERVICES=1 # Portainer
|
||||
- SESSION=0
|
||||
- SWARM=0
|
||||
- SYSTEM=0
|
||||
- TASKS=1 # Portainer
|
||||
- VOLUMES=1 # Portainer
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
networks:
|
||||
- socket_proxy_network:
|
||||
ipv4_address: 10.0.120.254 # Static IP
|
||||
read_only: true
|
||||
tmpfs:
|
||||
- /run
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
labels:
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
- "fathom.exempt.socket-docker=proxy de socket filtrant, c'est sa raison d'etre"
|
||||
Whitespace-only changes.
@@ -0,0 +1,22 @@
|
||||
http:
|
||||
routers:
|
||||
traefik:
|
||||
rule: Host(`dashboard.tips-of-mine.com`)
|
||||
entryPoints:
|
||||
- https
|
||||
service: api@internal
|
||||
middlewares:
|
||||
- dashboardauth
|
||||
tls: {}
|
||||
traefik-http-redirect:
|
||||
rule: Host(`dashboard.tips-of-mine.com`)
|
||||
entryPoints:
|
||||
- http
|
||||
service: api@internal
|
||||
middlewares:
|
||||
- "redirect-to-https"
|
||||
middlewares:
|
||||
dashboardauth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "admin:$2y$10$GXOzS6L1s3gwQb8zO90LKOGuvZfurIXCBgJjZ5ib9/p5l3cy1sid6"
|
||||
@@ -0,0 +1,165 @@
|
||||
http:
|
||||
middlewares:
|
||||
cloudflarewarp:
|
||||
plugin:
|
||||
cloudflarewarp:
|
||||
disableDefault: false
|
||||
trustip:
|
||||
- "172.18.0.1/32"
|
||||
my-crowdsec-bouncer-traefik-plugin:
|
||||
plugin:
|
||||
crowdsec-bouncer-traefik-plugin:
|
||||
enabled: "true"
|
||||
crowdsecMode: stream
|
||||
crowdsecLapiScheme: http
|
||||
crowdsecLapiHost: crowdsec-app:8080
|
||||
crowdsecLapiKeyFile: /etc/traefik/lapi-key
|
||||
forwardedHeadersTrustedIPs:
|
||||
- 172.18.0.0/16
|
||||
forwardedHeadersCustomName: CF-Connecting-IP
|
||||
clientTrustedIPs:
|
||||
- 10.0.4.0/24
|
||||
- 82.66.77.254/32
|
||||
# CrowdsecLapiKey: 4yn3ayFS4V6fvlXFEvVHj2qRUE57Wuww5pT48BD2
|
||||
# Enabled: "true"
|
||||
my-fail2ban:
|
||||
plugin:
|
||||
fail2ban:
|
||||
allowlist:
|
||||
ip: ::1,127.0.0.1,10.0.4.0/24
|
||||
denylist:
|
||||
ip: 192.168.0.0/24
|
||||
rules:
|
||||
bantime: 3h
|
||||
enabled: "true"
|
||||
findtime: 10m
|
||||
maxretry: "4"
|
||||
statuscode: 400,401,403-499
|
||||
my-traefik-maintenance:
|
||||
plugin:
|
||||
traefik-maintenance:
|
||||
enabled: "true"
|
||||
filename: ./maintenance_test.html
|
||||
httpContentType: text/html; charset=utf-8
|
||||
httpResponseCode: "503"
|
||||
triggerFilename: ./maintenance_test.trigger
|
||||
redirect-to-https:
|
||||
redirectScheme:
|
||||
scheme: https
|
||||
permanent: true
|
||||
# hsts-minimal:
|
||||
# headers:
|
||||
# stsSeconds: 31536000
|
||||
# stsIncludeSubdomains: false
|
||||
# stsPreload: false
|
||||
# forceSTSHeader: true
|
||||
# hsts-standard:
|
||||
# headers:
|
||||
# stsSeconds: 31536000
|
||||
# stsIncludeSubdomains: true
|
||||
# stsPreload: false
|
||||
# forceSTSHeader: true
|
||||
##########################################
|
||||
hsts-headers:
|
||||
headers:
|
||||
frameDeny: true
|
||||
sslRedirect: true
|
||||
browserXssFilter: true
|
||||
contentTypeNosniff: true
|
||||
stsIncludeSubdomains: true
|
||||
stsPreload: true
|
||||
stsSeconds: 31536000
|
||||
forceStsHeader: true
|
||||
referrerPolicy: same-origin
|
||||
customResponseHeaders:
|
||||
permissions-Policy: vibrate=(self), geolocation=(self), midi=(self), notifications=(self), push=(self), microphone=(), $
|
||||
X-Permitted-Cross-Domain-Policies: none
|
||||
expect-ct: max-age=604800, report-uri="https://oak.ct.letsencrypt.org/2021"
|
||||
##########################################
|
||||
# hsts-full:
|
||||
# headers:
|
||||
# stsSeconds: 31536000
|
||||
# stsIncludeSubdomains: true
|
||||
# stsPreload: true
|
||||
# forceSTSHeader: true
|
||||
|
||||
# Redirect non-www URLs to their www equivalent
|
||||
# Use with traefik.http.routers.myRouter.middlewares: "redirect-non-www-to-www@file"
|
||||
# Source: https://www.benjaminrancourt.ca/how-to-redirect-from-non-www-to-www-with-traefik/
|
||||
redirect-non-www-to-www:
|
||||
# Redirect a request from an url to another with regex matching and replacement
|
||||
redirectregex:
|
||||
# Apply a permanent redirection (HTTP 301)
|
||||
permanent: true
|
||||
# The regular expression to match and capture elements from the request URL
|
||||
regex: "^https?://(?:www\\.)?(.+)"
|
||||
# How to modify the URL to have the new target URL
|
||||
replacement: "https://www.${1}"
|
||||
|
||||
# Redirect www URLs to their non-www equivalent
|
||||
# Use with traefik.http.routers.myRouter.middlewares: "redirect-www-to-non-www@file"
|
||||
# Source: https://www.benjaminrancourt.ca/how-to-redirect-from-non-www-to-www-with-traefik/
|
||||
redirect-www-to-non-www:
|
||||
# Redirect a request from an url to another with regex matching and replacement
|
||||
redirectregex:
|
||||
# Apply a permanent redirection (HTTP 301)
|
||||
permanent: true
|
||||
# The regular expression to match and capture elements from the request URL
|
||||
regex: "^https?://www\\.(.+)"
|
||||
# How to modify the URL to have the new target URL
|
||||
replacement: "https://${1}"
|
||||
|
||||
# default-headers:
|
||||
# headers:
|
||||
# frameDeny: true
|
||||
# browserXssFilter: true
|
||||
# contentTypeNosniff: true
|
||||
# forceSTSHeader: true
|
||||
# stsIncludeSubdomains: true
|
||||
# stsPreload: true
|
||||
# stsSeconds: 15552000
|
||||
# customFrameOptionsValue: SAMEORIGIN
|
||||
# customRequestHeaders:
|
||||
# X-Forwarded-Proto: https
|
||||
|
||||
# crowdsec:
|
||||
# plugin:
|
||||
# bouncer:
|
||||
# enabled: true
|
||||
# logLevel: INFO
|
||||
# updateIntervalSeconds: 15
|
||||
# updateMaxFailure: 0
|
||||
# defaultDecisionSeconds: 15
|
||||
# httpTimeoutSeconds: 10
|
||||
# crowdsecMode: stream
|
||||
# crowdsecAppsecEnabled: true
|
||||
# crowdsecAppsecHost: crowdsec:7422
|
||||
# crowdsecAppsecFailureBlock: true
|
||||
# crowdsecAppsecUnreachableBlock: true
|
||||
# crowdsecLapiKey: #####REPLACE_API_KEY##### # Replace CrowdSec API key (docker exec crowdsec cscli bouncers add crowdsecBouncer)
|
||||
# crowdsecLapiKeyFile: /etc/traefik/cs-privateKey-foo
|
||||
# crowdsecLapiHost: crowdsec:8080
|
||||
# crowdsecLapiScheme: http
|
||||
# forwardedHeadersTrustedIPs:
|
||||
# - 10.0.35.4/32 # Cloudflare tunnel IP address
|
||||
# - 172.30.0.0/24 # Reverse Proxy IP address
|
||||
# clientTrustedIPs:
|
||||
# - 10.0.1.0/24 # Internal LAN IP addresses
|
||||
# - 10.0.2.0/24 # Internal LAN IP addresses
|
||||
# - 10.0.3.0/24 # Internal LAN IP addresses
|
||||
# - 10.0.4.0/24 # Internal LAN IP addresses
|
||||
# - 10.0.5.0/24 # Internal LAN IP addresses
|
||||
# forwardedHeadersCustomName: CF-Connecting-IP # Cloudflare IP address header
|
||||
|
||||
# default-whitelist:
|
||||
# ipWhiteList:
|
||||
# sourceRange:
|
||||
# - "10.0.4.0/24"
|
||||
# - "192.168.0.0/16"
|
||||
# - "172.16.0.0/12"
|
||||
|
||||
# secured:
|
||||
# chain:
|
||||
# middlewares:
|
||||
# - default-whitelist
|
||||
# - default-headers
|
||||
@@ -0,0 +1,38 @@
|
||||
tls:
|
||||
stores:
|
||||
default:
|
||||
defaultCertificate:
|
||||
certFile: /etc/traefik/ssl/wildcard.tips-of-mine.com.crt
|
||||
keyFile: /etc/traefik/ssl/wildcard.tips-of-mine.com.key
|
||||
# certFile: /etc/traefik/ssl/cert.pem
|
||||
# keyFile: /etc/traefik/ssl/privkey.pem
|
||||
certificates:
|
||||
- certFile: /etc/traefik/ssl/cert.pem
|
||||
keyFile: /etc/traefik/ssl/privkey.pem
|
||||
- certFile: /etc/traefik/ssl/wildcard.tips-of-mine.com.crt
|
||||
keyFile: /etc/traefik/ssl/wildcard.tips-of-mine.com.key
|
||||
##############
|
||||
stores:
|
||||
- default
|
||||
##############
|
||||
options:
|
||||
default:
|
||||
minVersion: VersionTLS12
|
||||
###############
|
||||
# sniStrict: true
|
||||
cipherSuites:
|
||||
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 # TLS 1.2
|
||||
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 # TLS 1.2
|
||||
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 # TLS 1.2
|
||||
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 # TLS 1.2
|
||||
- TLS_AES_256_GCM_SHA384 # TLS 1.3
|
||||
- TLS_CHACHA20_POLY1305_SHA256 # TLS 1.3
|
||||
- TLS_FALLBACK_SCSV # TLS FALLBACK
|
||||
curvePreferences:
|
||||
- secp521r1
|
||||
- secp384r1
|
||||
modern:
|
||||
minVersion: VersionTLS13
|
||||
#######
|
||||
mintls13:
|
||||
minVersion: VersionTLS13
|
||||
@@ -0,0 +1,191 @@
|
||||
## static configuration
|
||||
|
||||
global:
|
||||
# Send anonymous usage data
|
||||
sendAnonymousUsage: false
|
||||
checkNewVersion: false
|
||||
|
||||
entryPoints:
|
||||
# ftp:
|
||||
# address: ":21"
|
||||
# ssh:
|
||||
# address: ":22"
|
||||
# smtp:
|
||||
# address: ":25"
|
||||
# dns:
|
||||
# address: ":53"
|
||||
http:
|
||||
address: ":80"
|
||||
# transport:
|
||||
# respondingTimeouts:
|
||||
# idleTimeout: 600
|
||||
# writeTimeout: 600
|
||||
# readTimeout: 600
|
||||
## forwardedHeaders:
|
||||
## insecure: true
|
||||
## trustedIPs: &trustedIps
|
||||
## - 10.0.4.0/24
|
||||
http:
|
||||
redirections:
|
||||
entryPoint:
|
||||
to: https
|
||||
scheme: https
|
||||
permanent: true
|
||||
# ssh:
|
||||
# address: ":22"
|
||||
# pop3:
|
||||
# address: ":110"
|
||||
# imap:
|
||||
# address: ":143"
|
||||
https:
|
||||
address: ":443"
|
||||
# transport:
|
||||
# respondingTimeouts:
|
||||
# idleTimeout: 600
|
||||
# writeTimeout: 600
|
||||
# readTimeout: 600
|
||||
## forwardedHeaders:
|
||||
## insecure: true
|
||||
## trustedIPs: &trustedIps
|
||||
http:
|
||||
middlewares:
|
||||
- cloudflarewarp@file
|
||||
- my-crowdsec-bouncer-traefik-plugin@file
|
||||
# - error-pages@file
|
||||
# - sablier@file
|
||||
# - crowdsec-bouncer@file
|
||||
# - cloudflarewarp@file" # CHANGE MADE HERE (BOUNCER ENABLED) !!!
|
||||
# - secureHeaders@file
|
||||
tls: {}
|
||||
# certResolver: letsencrypt
|
||||
# domains:
|
||||
# - main: "tips-of-mine.com"
|
||||
# sans:
|
||||
# - "*.tips-of-mine.com"
|
||||
# smtp-ssl:
|
||||
# address: ":465"
|
||||
# starttls:
|
||||
# address: ":587"
|
||||
# imap-ssl:
|
||||
# address: ":993"
|
||||
# pop3-ssl:
|
||||
# address: ":995"
|
||||
# openvpn:
|
||||
# address: ":1194/udp"
|
||||
# mysql:
|
||||
# address: ":3306"
|
||||
# lcdlln:
|
||||
# address: "3841"
|
||||
vault:
|
||||
address: ":8200"
|
||||
forwardedHeaders:
|
||||
trustedIPs:
|
||||
- 0.0.0.0/0
|
||||
# elasticsearch:
|
||||
# address: ":9200"
|
||||
metrics:
|
||||
address: ":8181"
|
||||
tcptest:
|
||||
address: ":9090"
|
||||
udptest:
|
||||
address: ":9091/udp"
|
||||
|
||||
serversTransport:
|
||||
insecureSkipVerify: true
|
||||
|
||||
providers:
|
||||
docker:
|
||||
endpoint: "unix:///var/run/docker.sock"
|
||||
exposedByDefault: false
|
||||
watch: true
|
||||
file:
|
||||
directory: /etc/traefik/dynamic
|
||||
watch: true
|
||||
providersThrottleDuration: 10
|
||||
|
||||
#certificatesResolvers:
|
||||
# letsencrypt:
|
||||
# acme:
|
||||
# email: [email protected]
|
||||
# storage: /etc/traefik/acme/letsencrypt.json
|
||||
# caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
|
||||
# keyType: EC256
|
||||
# dnsChallenge:
|
||||
# provider: cloudflare
|
||||
# resolvers:
|
||||
# - "1.1.1.1:53"
|
||||
# - "8.8.8.8:53"
|
||||
# delayBeforeCheck: 0
|
||||
## caServer: "https://acme-v02.api.letsencrypt.org/directory"
|
||||
## keyType: EC256
|
||||
## dnsChallenge:
|
||||
## provider: cloudflare
|
||||
## resolvers:
|
||||
## - "8.8.8.8:53"
|
||||
## delaybeforecheck: 300
|
||||
# tlschallenge: true
|
||||
## httpchallenge:
|
||||
## entrypoint: http
|
||||
|
||||
api:
|
||||
# 13/05/2025 : true
|
||||
insecure: false
|
||||
dashboard: true
|
||||
|
||||
log:
|
||||
level: INFO
|
||||
filepath: "/var/log/traefik/traefik.log"
|
||||
format: json
|
||||
# default: "common"
|
||||
|
||||
accesslog:
|
||||
# level: INFO
|
||||
filepath: "/var/log/traefik/access.log"
|
||||
format: json
|
||||
bufferingSize: 100
|
||||
filters:
|
||||
statusCodes: ["200-299", "400-499", "500-599"]
|
||||
fields:
|
||||
defaultMode: keep
|
||||
names:
|
||||
RequestHost: keep
|
||||
headers:
|
||||
defaultMode: keep
|
||||
names:
|
||||
Host: keep
|
||||
|
||||
# Tracing
|
||||
tracing:
|
||||
serviceName: traefik
|
||||
sampleRate: 1.0
|
||||
otlp:
|
||||
http:
|
||||
endpoint: http://tempo-app:4318/v1/traces
|
||||
|
||||
# Ajout de la partie métrique qui concerne Prometheus
|
||||
metrics:
|
||||
prometheus:
|
||||
# Nom du point d'entrée défini au dessus
|
||||
entryPoint: metrics
|
||||
# On configure la latence des métriques
|
||||
buckets:
|
||||
- 0.1
|
||||
- 0.3
|
||||
- 1.2
|
||||
- 5.0
|
||||
# Ajout des métriques sur les points d'entrée
|
||||
addEntryPointsLabels: true
|
||||
# Ajout des services
|
||||
addServicesLabels: true
|
||||
addRoutersLabels: true
|
||||
|
||||
experimental:
|
||||
plugins:
|
||||
crowdsec-bouncer-traefik-plugin:
|
||||
moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
version: "v1.4.5"
|
||||
|
||||
cloudflarewarp:
|
||||
moduleName: "github.com/BetterCorp/cloudflarewarp"
|
||||
version: "v1.3.3"
|
||||
root@SLDOKP03:/opt/traefik#
|
||||
@@ -0,0 +1,76 @@
|
||||
|
||||
services:
|
||||
## traefik
|
||||
traefik:
|
||||
container_name: traefik-app
|
||||
hostname: traefik-app
|
||||
image: traefik:latest
|
||||
restart: always
|
||||
ports:
|
||||
# - "22:22" # SSH
|
||||
- "80:80" # HTTP
|
||||
- "443:443" # HTTPS
|
||||
- "8181:8181" #
|
||||
- "9090:9090" #
|
||||
- "9091:9091/udp" #
|
||||
# - "3841:3841" #
|
||||
# - "25:25" # SMTP (explicit TLS => STARTTLS, Authentication is DISABLED => use port 465/587 instead)
|
||||
# - "143:143" # IMAP4 (explicit TLS => STARTTLS)
|
||||
# - "465:465" # ESMTP (implicit TLS)
|
||||
# - "587:587" # ESMTP (explicit TLS => STARTTLS)
|
||||
# - "993:993" # IMAP4 (implicit TLS)
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "/etc/localtime:/etc/localtime:ro"
|
||||
- "./configs/traefik.yml:/etc/traefik/traefik.yml"
|
||||
- "./configs/dynamic:/etc/traefik/dynamic:rw"
|
||||
- "./certificates:/var/traefik/certs:rw"
|
||||
- "./certificates:/etc/traefik/ssl:rw"
|
||||
- "./certificates:/certs:ro"
|
||||
- "./logs:/var/log/traefik:rw"
|
||||
- "./acme:/etc/traefik/acme:rw"
|
||||
- "./crowdsec/lapi-key:/etc/traefik/lapi-key:ro"
|
||||
environment:
|
||||
- CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
|
||||
- CLOUDFLARE_HTTP_TIMEOUT=${HTTP_TIMEOUT}
|
||||
- CLOUDFLARE_POLLING_INTERVAL=${POLLING_INTERVAL}
|
||||
- CLOUDFLARE_PROPAGATION_TIMEOUT=${PROPAGATION_TIMEOUT}
|
||||
- CLOUDFLARE_TTL=${TTL}
|
||||
networks:
|
||||
- back_network:
|
||||
ipv4_address: 10.0.111.254 # Static IP
|
||||
- front_network:
|
||||
ipv4_address: 10.0.110.254 # Static IP
|
||||
- cloudflare_network
|
||||
- monitoring_network
|
||||
healthcheck:
|
||||
test: ["CMD", "traefik", "healthcheck", "--ping"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 20s
|
||||
labels:
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
- "fathom.vault.CF_DNS_API_TOKEN=secret/cloudflare"
|
||||
- "homepage.group=Security"
|
||||
- "homepage.name=Traefik"
|
||||
- "homepage.icon=traefik.png"
|
||||
- "homepage.href=https://dashboard.${ROOT_DOMAIN}"
|
||||
- "homepage.description=Reverse proxy"
|
||||
- "homepage.widget.type=traefik"
|
||||
- "homepage.widget.url=http://traefik:8080"
|
||||
|
||||
## Certificats
|
||||
certificat:
|
||||
container_name: traefik-certificat
|
||||
hostname: traefik-certificat
|
||||
image: alpine:latest
|
||||
command: sh -c "cd /etc/traefik/ssl
|
||||
&& wget traefik.me/cert.pem -O cert2.pem
|
||||
&& wget traefik.me/privkey.pem -O privkey2.pem"
|
||||
volumes:
|
||||
- "./certificates:/etc/traefik/ssl"
|
||||
networks:
|
||||
- front_network
|
||||
labels:
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
Reference in new issue
Block a user