|
|
|
@ -1,74 +1,74 @@
|
|
|
|
|
---
|
|
|
|
|
version: "3"
|
|
|
|
|
|
|
|
|
|
services:
|
|
|
|
|
traefik:
|
|
|
|
|
image: traefik:${TRAEFIK_VERSION}
|
|
|
|
|
restart: unless-stopped
|
|
|
|
|
command:
|
|
|
|
|
# when debugging is needed
|
|
|
|
|
- --accesslog=${TRAEFIK_ACCESSLOG}
|
|
|
|
|
# enable Træfik dashboard
|
|
|
|
|
- --api.dashboard=true
|
|
|
|
|
# configure Let's Encrypt automatic certificates
|
|
|
|
|
- --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.dnschallenge=true
|
|
|
|
|
- --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.dnschallenge.provider=${TRAEFIK_DNSPROVIDER}
|
|
|
|
|
- --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.dnschallenge.resolvers=${TRAEFIK_DNSRESOLVERS}
|
|
|
|
|
- --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.email=${LETSENCRYPT_EMAIL}
|
|
|
|
|
- --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.keytype=RSA4096
|
|
|
|
|
- --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.storage=/certs.json
|
|
|
|
|
- --certificatesresolvers.letsencrypt.acme.dnschallenge=true
|
|
|
|
|
- --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=hetzner
|
|
|
|
|
- --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}
|
|
|
|
|
- --certificatesresolvers.letsencrypt.acme.keytype=RSA4096
|
|
|
|
|
- --certificatesresolvers.letsencrypt.acme.storage=/le-certs.json
|
|
|
|
|
# we listen on both HTTP and HTTPS
|
|
|
|
|
- --entrypoints.http.address=:80
|
|
|
|
|
- --entrypoints.https.address=:443
|
|
|
|
|
# logging level
|
|
|
|
|
- --log.level=${TRAEFIK_LOGLEVEL}
|
|
|
|
|
# Træfik Pilot token (of course retrieved from dotenv)
|
|
|
|
|
- --pilot.token=${TRAEFIK_PILOT_TOKEN}
|
|
|
|
|
# we only use Docker (for now)
|
|
|
|
|
- --providers.docker=true
|
|
|
|
|
# and we want to manually specify exposed containers
|
|
|
|
|
- --providers.docker.exposedbydefault=false
|
|
|
|
|
- --providers.docker.watch=true
|
|
|
|
|
# should not need, but just in case, a folder for dynamic config files is also configured
|
|
|
|
|
- --providers.file.directory=/config
|
|
|
|
|
# should not need, but just in case, a dynamic config file is also configured
|
|
|
|
|
- --providers.file.directory=/dynamic-config
|
|
|
|
|
- --providers.file.watch=true
|
|
|
|
|
env_file:
|
|
|
|
|
- ${TRAEFIK_DNSPROVIDER_ENVFILE}
|
|
|
|
|
container_name: ${TRAEFIK_CONTAINER_NAME}
|
|
|
|
|
environment:
|
|
|
|
|
- HETZNER_API_KEY=${HETZNER_API_KEY}
|
|
|
|
|
image: traefik:${TRAEFIK_VERSION}
|
|
|
|
|
labels:
|
|
|
|
|
# expose Træfik using Træfik (dashboard)
|
|
|
|
|
- traefik.enable=${TRAEFIK_ENABLED}
|
|
|
|
|
- traefik.docker.network=${TRAEFIK_NETWORK}
|
|
|
|
|
# configure a global whitelist for accessing the Træfik dashboard
|
|
|
|
|
- traefik.http.middlewares.dashboard-whitelist.ipallowlist.sourcerange=${TRAEFIK_DASHBOARD_WHITELIST}
|
|
|
|
|
# configure a global middleware for redirecting HTTP to HTTPS
|
|
|
|
|
- traefik.enable=true
|
|
|
|
|
# configure a global whitelist for my home
|
|
|
|
|
- traefik.http.middlewares.dashboard-whitelist.ipwhitelist.sourcerange=${TRAEFIK_DASHBOARD_WHITELIST}
|
|
|
|
|
# configure the global redirect middleware
|
|
|
|
|
- traefik.http.middlewares.http-to-https.redirectscheme.scheme=https
|
|
|
|
|
- traefik.http.middlewares.http-to-https.redirectscheme.permanent=true
|
|
|
|
|
# configure a global middleware to harden security through HSTS
|
|
|
|
|
- traefik.http.middlewares.hsts.headers.stsSeconds=${TRAEFIK_STS_SECONDS}
|
|
|
|
|
- traefik.http.middlewares.hsts.headers.stsIncludeSubdomains=${TRAEFIK_STS_SUBDOMAINS}
|
|
|
|
|
- traefik.http.middlewares.hsts.headers.stsPreload=${TRAEFIK_STS_PRELOAD}
|
|
|
|
|
### Section HTTP
|
|
|
|
|
- traefik.http.routers.http-${TRAEFIK_ROUTER}.entrypoints=http
|
|
|
|
|
- traefik.http.routers.http-${TRAEFIK_ROUTER_NAME}.entrypoints=http
|
|
|
|
|
# only some people can access the dashboard, hence protect it with it's whitelist
|
|
|
|
|
- traefik.http.routers.http-${TRAEFIK_ROUTER_NAME}.middlewares=dashboard-whitelist
|
|
|
|
|
# redirect Træfik dashboard to HTTPS only
|
|
|
|
|
- traefik.http.routers.http-${TRAEFIK_ROUTER}.middlewares=${TRAEFIK_HTTP_MIDDLEWARES}
|
|
|
|
|
- traefik.http.routers.http-${TRAEFIK_ROUTER}.rule=${TRAEFIK_MATCHRULE}
|
|
|
|
|
- traefik.http.routers.http-${TRAEFIK_ROUTER}.service=api@internal
|
|
|
|
|
- traefik.http.routers.http-${TRAEFIK_ROUTER_NAME}.middlewares=http-to-https
|
|
|
|
|
- traefik.http.routers.http-${TRAEFIK_ROUTER_NAME}.rule=Host(`${TRAEFIK_MATCHRULE}`)
|
|
|
|
|
- traefik.http.routers.http-${TRAEFIK_ROUTER_NAME}.service=api@internal
|
|
|
|
|
### Section HTTPS
|
|
|
|
|
- traefik.http.routers.https-${TRAEFIK_ROUTER}.entrypoints=https
|
|
|
|
|
- traefik.http.routers.https-${TRAEFIK_ROUTER_NAME}.entrypoints=https
|
|
|
|
|
# only some people can access the dashboard, hence protect it with it's whitelist
|
|
|
|
|
- traefik.http.routers.https-${TRAEFIK_ROUTER_NAME}.middlewares=dashboard-whitelist
|
|
|
|
|
# configure Træfik dashboard to be the exposed service
|
|
|
|
|
- traefik.http.routers.https-${TRAEFIK_ROUTER}.middlewares=${TRAEFIK_HTTPS_MIDDLEWARES}
|
|
|
|
|
- traefik.http.routers.https-${TRAEFIK_ROUTER}.rule=${TRAEFIK_MATCHRULE}
|
|
|
|
|
- traefik.http.routers.https-${TRAEFIK_ROUTER}.service=api@internal
|
|
|
|
|
- traefik.http.routers.https-${TRAEFIK_ROUTER_NAME}.rule=Host(`${TRAEFIK_MATCHRULE}`)
|
|
|
|
|
- traefik.http.routers.https-${TRAEFIK_ROUTER_NAME}.service=api@internal
|
|
|
|
|
# of course, enable TLS and it's certificate provider
|
|
|
|
|
- traefik.http.routers.https-${TRAEFIK_ROUTER}.tls=${TRAEFIK_TLSENABLED}
|
|
|
|
|
- traefik.http.routers.https-${TRAEFIK_ROUTER}.tls.certresolver=${TRAEFIK_CERTRESOLVER}
|
|
|
|
|
- traefik.http.routers.https-${TRAEFIK_ROUTER_NAME}.tls=true
|
|
|
|
|
- traefik.http.routers.https-${TRAEFIK_ROUTER_NAME}.tls.certresolver=letsencrypt
|
|
|
|
|
networks:
|
|
|
|
|
- traefik
|
|
|
|
|
- traefik-proxy
|
|
|
|
|
ports:
|
|
|
|
|
- 80:80
|
|
|
|
|
- 443:443
|
|
|
|
|
restart: unless-stopped
|
|
|
|
|
volumes:
|
|
|
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
|
|
|
- ${TRAEFIK_DYNAMIC}:/config:ro
|
|
|
|
|
- ${TRAEFIK_CERTFILE}:/certs.json
|
|
|
|
|
- ./config:/dynamic-config:ro
|
|
|
|
|
- ./le-certs.json:/le-certs.json
|
|
|
|
|
|
|
|
|
|
networks:
|
|
|
|
|
traefik:
|
|
|
|
|
traefik-proxy:
|
|
|
|
|
external: true
|
|
|
|
|
name: ${TRAEFIK_NETWORK}
|
|
|
|
|