diff --git a/firefoxsync/docker-compose.yaml b/firefoxsync/docker-compose.yaml index ba34de7..3f5e082 100644 --- a/firefoxsync/docker-compose.yaml +++ b/firefoxsync/docker-compose.yaml @@ -9,12 +9,6 @@ services: - web - firefoxsync labels: - - "traefik.enable=true" - - "traefik.http.routers.ffs.rule=Host(`${FQDN_FIREFOXSYNC}`)" - - "traefik.http.routers.ffs.entrypoints=websecure" - - "traefik.http.routers.ffs.tls.certresolver=netcup" - - "traefik.http.routers.ffs.tls.options=intermediate@file" - - "traefik.http.services.ffs.loadbalancer.server.port=5000" - "docker.group=firefoxsync" restart: unless-stopped environment: diff --git a/git/docker-compose.yaml b/git/docker-compose.yaml index 223451c..2e525ef 100644 --- a/git/docker-compose.yaml +++ b/git/docker-compose.yaml @@ -28,16 +28,6 @@ services: interval: 5s timeout: 3s labels: - - "traefik.enable=true" - - "traefik.http.routers.forgejo.rule=Host(`${FQDN_GIT}`, `${FQDN_GIT_OLD}`)" - - "traefik.http.routers.forgejo.entrypoints=websecure" - - "traefik.http.routers.forgejo.tls.certresolver=netcup" - - "traefik.http.routers.forgejo.tls.options=intermediate@file" - - "traefik.http.routers.forgejo.middlewares=gitearedir" - - "traefik.http.middlewares.gitearedir.redirectregex.regex=^https://${FQDN_GIT_OLD}/(.*)" - - "traefik.http.middlewares.gitearedir.redirectregex.replacement=https://${FQDN_GIT}/$${1}" - - "traefik.http.middlewares.gitearedir.redirectregex.permanent=true" - - "traefik.http.services.forgejo.loadbalancer.server.port=3000" - "docker.group=git" diff --git a/news/docker-compose.yaml b/news/docker-compose.yaml index f63aa78..12581cd 100644 --- a/news/docker-compose.yaml +++ b/news/docker-compose.yaml @@ -21,12 +21,6 @@ services: healthcheck: test: ["CMD", "/usr/bin/miniflux", "-healthcheck", "auto"] labels: - - "traefik.enable=true" - - "traefik.http.routers.news.rule=Host(`${FQDN_NEWS}`)" - - "traefik.http.routers.news.entrypoints=websecure" - - "traefik.http.routers.news.tls.certresolver=netcup" - - "traefik.http.routers.news.tls.options=intermediate@file" - - "traefik.http.services.news.loadbalancer.server.port=8080" - "docker.group=news" diff --git a/nextcloud/docker-compose.yaml b/nextcloud/docker-compose.yaml index fa852a0..59fe9eb 100644 --- a/nextcloud/docker-compose.yaml +++ b/nextcloud/docker-compose.yaml @@ -1,6 +1,6 @@ services: - web: + webserver-nextcloud: image: nginx:stable depends_on: - app @@ -16,18 +16,6 @@ services: # interval: 5s # timeout: 3s labels: - - "traefik.enable=true" - - "traefik.http.routers.nextcloud.rule=Host(`${FQDN_NEXTCLOUD}`)" - - "traefik.http.routers.nextcloud.entrypoints=websecure" - - "traefik.http.routers.nextcloud.tls.certresolver=netcup" - - "traefik.http.routers.nextcloud.tls.options=intermediate@file" - - "traefik.http.middlewares.nextcloudHeader.headers.customRequestHeaders.X-Forwarded-Proto=https" - - "traefik.http.middlewares.nextcloudHeader.headers.stsSeconds=15552000" - - "traefik.http.middlewares.nextcloudHeader.headers.stsIncludeSubdomains=true" - - "traefik.http.middlewares.nextcloudHeader.headers.stsPreload=true" - - "traefik.http.middlewares.nextcloudHeader.headers.forceSTSHeader=true" - - "traefik.http.middlewares.nextcloudHeader.headers.customResponseHeaders.X-Robots-Tag=noindex,nofollow" - - "traefik.http.routers.nextcloud.middlewares=nextcloudHeader" - "docker.group=netxtcloud" @@ -93,17 +81,9 @@ services: - ${STORAGE_PATH}/data:/var/www/html/data:ro environment: - PORT=7867 - - NEXTCLOUD_URL=http://web + - NEXTCLOUD_URL=http://webserver-nextcloud entrypoint: /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php labels: - - "traefik.enable=true" - - "traefik.http.routers.ncpush.rule=Host(`${FQDN_NEXTCLOUD}`) && PathPrefix(`/push`)" - - "traefik.http.routers.ncpush.entrypoints=websecure" - - "traefik.http.routers.ncpush.tls.certresolver=netcup" - - "traefik.http.routers.ncpush.tls.options=intermediate@file" - - "traefik.http.services.ncpush.loadbalancer.server.port=7867" - - "traefik.http.routers.ncpush.middlewares=ncpushstrip" - - "traefik.http.middlewares.ncpushstrip.stripprefix.prefixes=/push" - "docker.group=proxy" @@ -150,13 +130,6 @@ services: # depends_on: # - db # labels: -# - "traefik.enable=true" -# - "traefik.http.routers.adminer.rule=Host(`${FQDN_ADMINER}`)" -# - "traefik.http.routers.adminer.entrypoints=websecure" -# - "traefik.http.routers.adminer.tls.certresolver=netcup" -# - "traefik.http.routers.adminer.tls.options=intermediate@file" -# - "traefik.http.routers.adminer.middlewares=adminerauth" -# - "traefik.http.middlewares.adminerauth.basicauth.users=${HTPASSWD_ADMINER}" # - "docker.group=netxtcloud" @@ -196,12 +169,6 @@ services: - "extra_params=--o:ssl.enable=false --o:ssl.termination=true" restart: unless-stopped labels: - - "traefik.enable=true" - - "traefik.http.routers.collabora.rule=Host(`${FQDN_OFFICE}`)" - - "traefik.http.routers.collabora.entrypoints=websecure" - - "traefik.http.routers.collabora.tls.certresolver=netcup" - - "traefik.http.routers.collabora.tls.options=intermediate@file" - - "traefik.http.services.collabora.loadbalancer.server.port=9980" - "docker.group=netxtcloud" @@ -238,12 +205,6 @@ services: retries: 5 start_period: 20s labels: - - "traefik.enable=true" - - "traefik.http.routers.drawio.rule=Host(`${FQDN_DRAWIO}`)" - - "traefik.http.routers.drawio.entrypoints=websecure" - - "traefik.http.routers.drawio.tls.certresolver=netcup" - - "traefik.http.routers.drawio.tls.options=intermediate@file" - - "traefik.http.services.drawio.loadbalancer.server.port=8080" - "docker.group=netxtcloud" networks: diff --git a/proxy/caddy/Caddyfile b/proxy/caddy/Caddyfile new file mode 100644 index 0000000..fb33b87 --- /dev/null +++ b/proxy/caddy/Caddyfile @@ -0,0 +1,91 @@ +{ +# acme_ca https://acme-v02.api.letsencrypt.org/directory + email {env.EMAIL} + log { + format console + } +} + +*.{$DOMAIN} { + tls { + dns netcup { + customer_number {env.NETCUP_CUSTOMER_NUMBER} + api_key {env.NETCUP_API_KEY} + api_password {env.NETCUP_API_PASSWORD} + } + propagation_timeout 900s + propagation_delay 600s + resolvers 46.38.225.230 46.38.252.230 + } + # header Strict-Transport-Security "max-age=63072000" + + @git host git.{$DOMAIN} + handle @git { + reverse_proxy forgejo:3000 + } + + @news host news.{$DOMAIN} + handle @news { + reverse_proxy miniflux:8080 + } + + @nc-push expression `(host('cloud.{$DOMAIN}') && path('/push/*'))` + handle @nc-push { + reverse_proxy push:7867 + } + + @nextcloud host cloud.{$DOMAIN} + handle @nextcloud { + reverse_proxy webserver-nextcloud:80 + } + + @office host office.{$DOMAIN} + handle @office { + reverse_proxy collabora:9980 + } + + @drawio host drawio.{$DOMAIN} + handle @drawio { + reverse_proxy drawio:8080 + } + + @whoami host whoami.{$DOMAIN} + handle @whoami { + reverse_proxy whoami:80 + } + + @push host push.{$DOMAIN} + handle @push { + reverse_proxy ntfy:80 + } + + @wallabag host wallabag.{$DOMAIN} + handle @wallabag { + reverse_proxy wallabag:80 + } + + @www host www.{$DOMAIN} + handle @www { + reverse_proxy webserver-www:80 + } + + @mail host mail.{$DOMAIN} + handle @mail { + reverse_proxy nginx-mailcow:8090 + } + + # Fallback for otherwise unhandled domains + handle { + respond 404 + } +} + +{$DOMAIN} { + redir https://www.{$DOMAIN}{uri} +} + + + + + + diff --git a/proxy/caddy/Dockerfile b/proxy/caddy/Dockerfile new file mode 100644 index 0000000..7223e84 --- /dev/null +++ b/proxy/caddy/Dockerfile @@ -0,0 +1,7 @@ +FROM caddy:2-builder AS builder + +RUN xcaddy build --with github.com/caddy-dns/netcup + +FROM caddy:2 + +COPY --from=builder /usr/bin/caddy /usr/bin/caddy diff --git a/proxy/docker-compose.yaml b/proxy/docker-compose.yaml index 4881fd7..f8d347e 100755 --- a/proxy/docker-compose.yaml +++ b/proxy/docker-compose.yaml @@ -1,98 +1,33 @@ services: - traefik: - image: traefik:${TRAEFIK_VERSION} + caddy: + image: florianzirker.de/caddy-netcup + build: ./caddy + networks: + - web restart: unless-stopped - environment: - - NETCUP_ENDPOINT=${NETCUP_ENDPOINT} - - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER} - - NETCUP_API_KEY=${NETCUP_API_KEY} - - NETCUP_API_PASSWORD=${NETCUP_API_PASSWORD} - command: - - "--api.insecure=false" - - "--api.dashboard=true" - - "--providers.docker=true" - - "--providers.docker.exposedbydefault=false" - - "--providers.docker.network=web" - - "--providers.docker.endpoint=tcp://docker-socket-proxy:2375" - #- "--log.level=DEBUG" - - "--log.level=INFO" - #- "--accesslog=true" - - "--ping=true" - - "--entrypoints.web.address=:80" - - "--entrypoints.web.http.redirections.entrypoint.to=websecure" - - "--entrypoints.web.http.redirections.entrypoint.scheme=https" - - "--entrypoints.websecure.address=:443" - - "--providers.file.filename=/etc/traefik/tls.toml" - - "--certificatesresolvers.netcup.acme.dnschallenge=true" - - "--certificatesresolvers.netcup.acme.dnsChallenge.provider=netcup" - - "--certificatesresolvers.netcup.acme.dnsChallenge.resolvers=46.38.225.230:53,46.38.252.230:53" - - "--certificatesresolvers.netcup.acme.dnschallenge.delayBeforeCheck=900" - - "--certificatesresolvers.netcup.acme.email=${LETSENCRYPT_MAIL}" - - "--certificatesresolvers.netcup.acme.storage=/letsencrypt/acme.json" - - "--metrics.prometheus=true" - - "--metrics.prometheus.addEntryPointsLabels=true" - - "--metrics.prometheus.addRoutersLabels=true" - - "--metrics.prometheus.addServicesLabels=true" ports: - "80:80" - "443:443" + - "443:443/udp" + volumes: + - $PWD/caddy/Caddyfile:/etc/caddy/Caddyfile + - ${STORAGE_PATH}/caddy/data:/data + - ${STORAGE_PATH}/caddy/config:/config + environment: + - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER} + - NETCUP_API_KEY=${NETCUP_API_KEY} + - NETCUP_API_PASSWORD=${NETCUP_API_PASSWORD} + - EMAIL=${LETSENCRYPT_MAIL} + - DOMAIN=${DOMAIN} + + whoami: + image: traefik/whoami networks: - web - - dockersocket - volumes: - - ${STORAGE_PATH}/letsencrypt:/letsencrypt - - $PWD/tls.toml:/etc/traefik/tls.toml - healthcheck: - test: traefik healthcheck --ping - interval: 3s - timeout: 1s labels: - - "traefik.enable=true" - - "traefik.http.routers.dashboard.rule=Host(`${FQDN_TRAEFIK}`)" - - "traefik.http.routers.dashboard.service=api@internal" - - "traefik.http.routers.dashboard.entrypoints=websecure" - - "traefik.http.routers.dashboard.tls.certresolver=netcup" - - "traefik.http.routers.dashboard.tls.domains[0].main=${DOMAIN}" - - "traefik.http.routers.dashboard.tls.domains[0].sans=*.${DOMAIN}" - - "traefik.http.routers.dashboard.tls.options=intermediate@file" - - "traefik.http.routers.dashboard.middlewares=auth" - - "traefik.http.middlewares.auth.basicauth.users=${HTPASSWD}" - "docker.group=proxy" - - - docker-socket-proxy: - image: tecnativa/docker-socket-proxy restart: unless-stopped - volumes: - - /var/run/docker.sock:/var/run/docker.sock:ro - environment: - # grant privileges as environment variables: https://github.com/Tecnativa/docker-socket-proxy#grant-or-revoke-access-to-certain-api-sections - - LOG_LEVEL=warning - - CONTAINERS=1 - - INFO=1 - networks: - - dockersocket - healthcheck: - test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost:2375/version"] - interval: 10s - timeout: 3s - privileged: true - labels: - - "docker.group=proxy" - - -# whoami: -# image: traefik/whoami -# networks: -# - web -# labels: -# - "traefik.enable=true" -# - "traefik.http.routers.whoami.rule=Host(`${FQDN_WHOAMI}`)" -# - "traefik.http.routers.whoami.entrypoints=websecure" -# - "traefik.http.routers.whoami.tls.certresolver=netcup" -# - "docker.group=proxy" -# restart: unless-stopped networks: diff --git a/proxy/tls.toml b/proxy/tls.toml deleted file mode 100644 index ccfc0f3..0000000 --- a/proxy/tls.toml +++ /dev/null @@ -1,14 +0,0 @@ -# generated 2020-12-09, Mozilla Guideline v5.6, Traefik 2.3, intermediate configuration -# https://ssl-config.mozilla.org/#server=traefik&version=2.3&config=intermediate&guideline=5.6 - -[tls.options] - [tls.options.intermediate] - minVersion = "VersionTLS12" - cipherSuites = [ - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305" - ] diff --git a/push/docker-compose.yaml b/push/docker-compose.yaml index ef05c1e..135df1a 100644 --- a/push/docker-compose.yaml +++ b/push/docker-compose.yaml @@ -25,12 +25,6 @@ services: - ${STORAGE_PATH}/ntfy/cache/:/var/cache/ntfy - ${STORAGE_PATH}/ntfy/varlib/:/var/lib/ntfy/ labels: - - "traefik.enable=true" - - "traefik.http.routers.push.rule=Host(`${FQDN_PUSH}`)" - - "traefik.http.routers.push.entrypoints=websecure" - - "traefik.http.routers.push.tls.certresolver=netcup" - - "traefik.http.routers.push.tls.options=intermediate@file" - - "traefik.http.services.push.loadbalancer.server.port=80" - "docker.group=push" diff --git a/wallabag/docker-compose.yaml b/wallabag/docker-compose.yaml index d8c9970..2ed38ab 100644 --- a/wallabag/docker-compose.yaml +++ b/wallabag/docker-compose.yaml @@ -1,5 +1,5 @@ services: - app: + wallabag: image: wallabag/wallabag restart: unless-stopped environment: @@ -26,11 +26,6 @@ services: interval: 10s timeout: 3s labels: - - "traefik.enable=true" - - "traefik.http.routers.wallabag.rule=Host(`${FQDN_WALLABAG}`)" - - "traefik.http.routers.wallabag.entrypoints=websecure" - - "traefik.http.routers.wallabag.tls.certresolver=netcup" - - "traefik.http.routers.wallabag.tls.options=intermediate@file" - "docker.group=wallabag" depends_on: - db diff --git a/www/docker-compose.yaml b/www/docker-compose.yaml index 80e2e63..36be945 100644 --- a/www/docker-compose.yaml +++ b/www/docker-compose.yaml @@ -1,6 +1,6 @@ services: - app: + webserver-www: image: nginx:stable volumes: - ${HTML}:/usr/share/nginx/html:ro @@ -13,19 +13,6 @@ services: interval: 5s timeout: 3s labels: - - "traefik.enable=true" - - "traefik.http.routers.webroot.entrypoints=websecure" # All HTTP requests are globally redirected to HTTPS - - "traefik.http.routers.webroot.rule=Host(`${DOMAIN}`)" - - "traefik.http.routers.webroot.tls.certresolver=netcup" - - "traefik.http.routers.webroot.tls.options=intermediate@file" - - "traefik.http.routers.webroot.middlewares=redirect-to-www" - - "traefik.http.middlewares.redirect-to-www.redirectregex.regex=^https?://${DOMAIN}/(.*)" - - "traefik.http.middlewares.redirect-to-www.redirectregex.replacement=https://${FQDN_WWW}/$${1}" - - "traefik.http.middlewares.redirect-to-www.redirectregex.permanent=true" - - "traefik.http.routers.www-secure.entrypoints=websecure" - - "traefik.http.routers.www-secure.rule=Host(`${FQDN_WWW}`)" - - "traefik.http.routers.www-secure.tls.certresolver=netcup" - - "traefik.http.routers.www-secure.tls.options=intermediate@file" - "docker.group=www" networks: