211 lines
6.9 KiB
YAML
211 lines
6.9 KiB
YAML
|
|
name: traefik
|
|
|
|
###############################################################
|
|
# Networks
|
|
###############################################################
|
|
networks:
|
|
socket_proxy:
|
|
driver: bridge
|
|
driver_opts:
|
|
com.docker.network.bridge.name: "br-traefik_sx"
|
|
traefik-net:
|
|
external: true
|
|
mariadb-net:
|
|
external: true
|
|
|
|
###############################################################
|
|
# Docker Secrets
|
|
# Owner (default): root:root
|
|
# Recommend Set Owner to match container user Example: UID=1100, GID=1100
|
|
# Permissions of files & directory on host to: 0400 (-r--)
|
|
###############################################################
|
|
secrets:
|
|
## Cloudflare / Traefik
|
|
cf_dns_api_token:
|
|
file: ${SECRETSDIR}/cf_dns_api_token
|
|
|
|
###############################################################
|
|
|
|
services:
|
|
traefik:
|
|
image: traefik:v3.3.3 # v3.2.1 # v3.1.7 # 3.1.2 # v3.1.7-nanoserver-ltsc2022
|
|
hostname: traefik
|
|
restart: unless-stopped
|
|
env_file: .traefik.env
|
|
security_opt:
|
|
- no-new-privileges=true
|
|
depends_on:
|
|
- socket-proxy # Comment out if not using socket-proxy
|
|
networks:
|
|
- traefik-net
|
|
- socket_proxy
|
|
- mariadb-net
|
|
command:
|
|
- "--configFile=/config/traefik.yml"
|
|
ports:
|
|
- target: 80 # Container Port
|
|
host_ip: 0.0.0.0 # All interfaces, not a specific one
|
|
published: "80" # STRING
|
|
protocol: tcp # tcp or udp
|
|
mode: host # or Ingress for load balancing
|
|
- target: 443
|
|
host_ip: 0.0.0.0
|
|
published: "443"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 51820 # wg-easy udp port
|
|
published: "51820"
|
|
protocol: udp
|
|
mode: host
|
|
- target: 32400 # plex remote access tcp port
|
|
published: "32400"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 1883 # mosquitto port
|
|
published: "1883"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 8883 # mosquitto secure port
|
|
published: "8883"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 9001 # mosquitto websocket port
|
|
published: "9001"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 19132 # minecraft-bedrock port
|
|
published: "19132"
|
|
protocol: udp
|
|
mode: host
|
|
- target: 25565 # minecraft-java port
|
|
published: "25565"
|
|
protocol: udp
|
|
mode: host
|
|
- target: 25575 # minecraft-java rcon port
|
|
published: "25575"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 8083 # ping port
|
|
published: "8083"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 8306 # mariadb port
|
|
published: "8306"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 9306 # mysql port
|
|
published: "9306"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 2022 # sftp port1
|
|
published: "2022"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 2023 # sftp port2
|
|
published: "2023"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 2024 # sftp port3
|
|
published: "2024"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 2025 # sftp port4
|
|
published: "2025"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 2026 # sftp port5
|
|
published: "2026"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 2027 # sftp port6
|
|
published: "2027"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 2028 # sftp port7
|
|
published: "2028"
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 2029 # sftp port8
|
|
published: "2029"
|
|
protocol: tcp
|
|
mode: host
|
|
secrets:
|
|
- cf_dns_api_token
|
|
volumes:
|
|
- "$STACKSDIR/config:/config" # traefik.yml
|
|
- "$STACKSDIR/rules:/rules" # Dynamic File Provider directory
|
|
- "$STACKSDIR/users:/mnt/users" # basic-auth username and password hashes
|
|
- "$DATADIR/appdata:/data" # acme.json defined in traefik.yaml
|
|
- "$DATADIR/logs:/logs"
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.docker.network=traefik-net
|
|
#
|
|
# http basic-auth middlewares
|
|
# ---------------------------
|
|
- "traefik.http.middlewares.${APPLICATION_NAME}-auth.basicauth.usersfile=/mnt/users/${APPLICATION_NAME}.txt"
|
|
#
|
|
# http routers
|
|
# ------------
|
|
# http
|
|
- "traefik.http.routers.${APPLICATION_NAME}-rtr.entrypoints=web"
|
|
- "traefik.http.routers.${APPLICATION_NAME}-rtr.rule=Host(`traefik.${DOMAINNAME}`)&& PathPrefix(`/`)"
|
|
# attach middlewares to router
|
|
- "traefik.http.routers.${APPLICATION_NAME}-rtr.middlewares=${APPLICATION_NAME}-auth, http-mw-rateLimit-secureHeaders-compress-redirect@file"
|
|
# assign svc target to router
|
|
- "traefik.http.routers.${APPLICATION_NAME}-rtr.service=api@internal"
|
|
|
|
# https
|
|
- "traefik.http.routers.${APPLICATION_NAME}-secure-rtr.entrypoints=websecure"
|
|
- "traefik.http.routers.${APPLICATION_NAME}-secure-rtr.rule=Host(`traefik.${DOMAINNAME}`)&& PathPrefix(`/`)"
|
|
# attach middlewares to routers
|
|
- "traefik.http.routers.${APPLICATION_NAME}-secure-rtr.middlewares=${APPLICATION_NAME}-auth, http-mw-rateLimit-secureHeaders-compress@file"
|
|
# tls
|
|
- "traefik.http.routers.${APPLICATION_NAME}-secure-rtr.tls=true"
|
|
- "traefik.http.routers.${APPLICATION_NAME}-secure-rtr.tls.options=tls-options@file"
|
|
- "traefik.http.routers.${APPLICATION_NAME}-secure-rtr.tls.certresolver=solver-dns"
|
|
# assign svc target to router
|
|
- "traefik.http.routers.${APPLICATION_NAME}-secure-rtr.service=api@internal"
|
|
|
|
###############################################################
|
|
socket-proxy:
|
|
image: tecnativa/docker-socket-proxy:0.2.0 #0.1.2
|
|
hostname: traefik_socket-proxy
|
|
restart: unless-stopped
|
|
env_file: .socket-proxy.env
|
|
security_opt:
|
|
- no-new-privileges=true
|
|
networks:
|
|
- socket_proxy
|
|
privileged: true # true for VM. false for unprivileged LXC container.
|
|
#depends_on:
|
|
# - traefik
|
|
ports:
|
|
- "127.0.0.1:2375:2375"
|
|
volumes:
|
|
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
|
# the following bind is to persist the non-zero setting of backend docker-events.timeout server
|
|
- type: bind
|
|
source: "${DATADIR}/haproxy/haproxy.cfg.template"
|
|
target: /usr/local/etc/haproxy/haproxy.cfg.template
|
|
###############################################################
|
|
whoami:
|
|
image: traefik/whoami:latest
|
|
container_name: whoami
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges=true
|
|
depends_on:
|
|
- traefik
|
|
networks:
|
|
- traefik-net
|
|
environment:
|
|
- TZ
|
|
labels:
|
|
- "traefik.enable=true"
|
|
## HTTP Routers
|
|
- "traefik.http.routers.whoami-rtr.entrypoints=web"
|
|
- "traefik.http.routers.whoami-rtr.rule=Host(`whoami.${DOMAINNAME}`)"
|
|
###############################################################
|