POUSH

2023-11-11 17:50:01 +01:00
parent 359b6a2219
commit 68ab9f8215
1 changed files with 110 additions and 1 deletions
--- a/host_vars/scaleway_fr.yml
+++ b/host_vars/scaleway_fr.yml
@@ -306,4 +306,113 @@ dockerapp_compose:
  #   <<: *network-and-security
  #   restart: "no"
  #   # profiles:
-  #   # - media
+  #   # - media
+  ########################### SERVICES
+  services:
+    ############################# FRONTENDS
+
+    # Traefik 2 - Reverse Proxy
+    # Touch (create empty files) traefik.log and acme/acme.json. Set acme.json permissions to 600.
+    # touch $DOCKERDIR/traefik2/acme/acme.json
+    # chmod 600 $DOCKERDIR/traefik2/acme/acme.json
+    # touch $DOCKERDIR/logs/homeserver/traefik.log # customize this
+
+    #### LETSENCRYPT CHALLENGE ######
+    # https://doc.traefik.io/traefik/user-guides/docker-compose/acme-http/
+    # Add new https services/fqdn
+    # uncomment acme.caserver line and remove appdata/traefik2/acme/letsencrypt/acme.json file 
+    # Down all containers and up all (docker-compose down/up -d), wait for news cert/key on acme.json
+    # At this moment, cert/key are staging, you need to comment acme.caserver line and remove acme.json file then restart traefik 
+    traefik:
+      #<<: *common-keys-core # See EXTENSION FIELDS at the top -> TODO
+      container_name: traefik
+      image: traefik:latest
+      command: # CLI arguments
+        - --global.checkNewVersion=true
+        - --global.sendAnonymousUsage=true
+        - --entryPoints.http.address=:80/tcp
+        - --entryPoints.https.address=:443/tcp
+        - --entryPoints.wireguard.address=:443/udp
+        - --api=true
+        - --api.dashboard=true
+        - --log=true
+        - --log.level=DEBUG # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
+        - --accessLog=true
+        - --accessLog.filePath=/traefik.log
+        - --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines
+        - --providers.docker=true
+        - --providers.docker.endpoint=tcp://socket-proxy:2375
+        - --providers.docker.exposedByDefault=false
+        - --providers.docker.network=t2_proxy
+        - --providers.docker.swarmMode=false
+        - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory
+        - --providers.file.watch=true # Only works on top level files in the rules folder
+        - --metrics.prometheus=true
+        - --metrics.prometheus.buckets=0.1,0.3,1.2,5.0
+        - --metrics.prometheus.addEntryPointsLabels=true
+        - --metrics.prometheus.addrouterslabels=true
+        - --metrics.prometheus.addServicesLabels=true
+        - --metrics.prometheus.manualrouting=true
+        - --certificatesresolvers.letsencrypt-resolver.acme.tlschallenge=true
+      # - --certificatesresolvers.letsencrypt-resolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
+        - --certificatesresolvers.letsencrypt-resolver.acme.email=stephane.gratiasquiquandon@gmail.com
+        - --certificatesresolvers.letsencrypt-resolver.acme.storage=/letsencrypt/acme.json
+      networks:
+        t2_proxy:
+          ipv4_address: 192.168.90.254 # You can specify a static IP
+        # Should connect to the docker socket
+        socket_proxy:
+          ipv4_address: 192.168.91.3
+      environment:
+        #<<: *default-tz-puid-pgid -> TODO
+      ports:
+        - target: 80
+          published: 80
+          protocol: tcp
+          mode: host
+        - target: 443
+          published: 443
+          protocol: tcp
+          mode: host
+        - target: 443
+          published: 443
+          protocol: udp
+          mode: host
+      volumes:
+        - ./appdata/traefik2/rules/homeserver:/rules # file provider directory
+        - ./appdata/traefik2/acme/letsencrypt:/letsencrypt
+        #- ./appdata/traefik2/acme/acme.json:/acme.json # cert location - you must touch this file and change permissions to 600
+        - ./logs/homeserver/traefik.log:/traefik.log # for fail2ban - make sure to touch file before starting container
+        - /etc/timezone:/etc/timezone:ro
+        - /etc/localtime:/etc/localtime:ro
+      labels:
+        - "traefik.enable=true"
+        # HTTP-to-HTTPS Redirect
+        - "traefik.http.routers.http-catchall.entrypoints=http"
+        - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
+        - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
+        - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+        - "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
+        # HTTP Routers
+        - "traefik.http.routers.traefik-rtr.entrypoints=https"
+        - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.jingoh.fr`)"
+        ## Services - API
+        - "traefik.http.routers.traefik-rtr.service=api@internal"
+        - "traefik.http.routers.traefik-rtr.tls=true"
+        ## MONITORING
+        - traefik.http.routers.prometheus.entrypoints=https
+        - traefik.http.routers.prometheus.rule=Host(`traefik.jingoh.fr`) && PathPrefix(`/metrics`)
+        - traefik.http.routers.prometheus.service=prometheus@internal
+        - traefik.http.routers.prometheus.middlewares=traefik-basic
+        ## Middlewares
+        # echo $(htpasswd -nB user) | sed -e s/\\$/\\$\\$/g
+        ## Middlewares
+        - "traefik.http.routers.traefik-rtr.middlewares=traefik-basic"
+        - "traefik.http.middlewares.traefik-basic.basicauth.users=jingohtraf:$$2y$$05$$JO8mJnOV2PARzEcVj.Grp.H.JbkWYneAIjgMt7c0.5NTyBNDkRIiW"
+        #- "traefik.http.middlewares.traefik-rtr-ratelimit.ratelimit.average=10"
+        # - "traefik.http.middlewares.traefik-rtr-ratelimit.ratelimit.burst=10"
+        # - "traefik.http.middlewares.traefik-rtr-ratelimit.ratelimit.period=1"
+      # - "traefik.http.routers.traefik-rtr-ratelimit.middlewares=traefik-rtr-ratelimit@docker"
+        ## TLS 
+        - "traefik.http.routers.traefik-rtr.tls.certresolver=letsencrypt-resolver"
+        - "traefik.http.routers.prometheus.tls.certresolver=letsencrypt-resolver"