fzirker/selfhost
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Compare commits

base: fzirker:230fb50d3a895a084c50c373165e2672a547bcf1
Branches Tags
fzirker:main
fzirker:forgejo-actions
fzirker:traefik
..
compare: fzirker:c6bf4e3fa08a8ff495275a5b268c2b7f0743bae4
Branches Tags
fzirker:main
fzirker:forgejo-actions
fzirker:traefik

No commits in common. "230fb50d3a895a084c50c373165e2672a547bcf1" and "c6bf4e3fa08a8ff495275a5b268c2b7f0743bae4" have entirely different histories.
230fb50d3a ... c6bf4e3fa0

14 changed files with 274 additions and 139 deletions
Download patch file Download diff file Expand all files Collapse all files

9
.editorconfig
View file

@ -16,12 +16,3 @@ tab_width = 2
[*.md] [*.md]
trim_trailing_whitespace = false trim_trailing_whitespace = false
[Caddyfile]
indent_style = tab
indent_size = 4
tab_width = 4
end_of_line = lf
charset = utf-8
trim_trailing_whitespace = true
insert_final_newline = true

6
firefoxsync/docker-compose.yaml
View file

@ -9,6 +9,12 @@ services:
- web - web
- firefoxsync - firefoxsync
labels: labels:
- "traefik.enable=true"
- "traefik.http.routers.ffs.rule=Host(`${FQDN_FIREFOXSYNC}`)"
- "traefik.http.routers.ffs.entrypoints=websecure"
- "traefik.http.routers.ffs.tls.certresolver=netcup"
- "traefik.http.routers.ffs.tls.options=intermediate@file"
- "traefik.http.services.ffs.loadbalancer.server.port=5000"
- "docker.group=firefoxsync" - "docker.group=firefoxsync"
restart: unless-stopped restart: unless-stopped
environment: environment:

10
git/docker-compose.yaml
View file

@ -28,6 +28,16 @@ services:
interval: 5s interval: 5s
timeout: 3s timeout: 3s
labels: labels:
- "traefik.enable=true"
- "traefik.http.routers.forgejo.rule=Host(`${FQDN_GIT}`, `${FQDN_GIT_OLD}`)"
- "traefik.http.routers.forgejo.entrypoints=websecure"
- "traefik.http.routers.forgejo.tls.certresolver=netcup"
- "traefik.http.routers.forgejo.tls.options=intermediate@file"
- "traefik.http.routers.forgejo.middlewares=gitearedir"
- "traefik.http.middlewares.gitearedir.redirectregex.regex=^https://${FQDN_GIT_OLD}/(.*)"
- "traefik.http.middlewares.gitearedir.redirectregex.replacement=https://${FQDN_GIT}/$${1}"
- "traefik.http.middlewares.gitearedir.redirectregex.permanent=true"
- "traefik.http.services.forgejo.loadbalancer.server.port=3000"
- "docker.group=git" - "docker.group=git"

6
news/docker-compose.yaml
View file

@ -21,6 +21,12 @@ services:
healthcheck: healthcheck:
test: ["CMD", "/usr/bin/miniflux", "-healthcheck", "auto"] test: ["CMD", "/usr/bin/miniflux", "-healthcheck", "auto"]
labels: labels:
- "traefik.enable=true"
- "traefik.http.routers.news.rule=Host(`${FQDN_NEWS}`)"
- "traefik.http.routers.news.entrypoints=websecure"
- "traefik.http.routers.news.tls.certresolver=netcup"
- "traefik.http.routers.news.tls.options=intermediate@file"
- "traefik.http.services.news.loadbalancer.server.port=8080"
- "docker.group=news" - "docker.group=news"

43
nextcloud/docker-compose.yaml
View file

@ -1,6 +1,6 @@
services: services:
webserver-nextcloud: web:
image: nginx:stable image: nginx:stable
depends_on: depends_on:
- app - app
@ -16,6 +16,18 @@ services:
# interval: 5s # interval: 5s
# timeout: 3s # timeout: 3s
labels: labels:
- "traefik.enable=true"
- "traefik.http.routers.nextcloud.rule=Host(`${FQDN_NEXTCLOUD}`)"
- "traefik.http.routers.nextcloud.entrypoints=websecure"
- "traefik.http.routers.nextcloud.tls.certresolver=netcup"
- "traefik.http.routers.nextcloud.tls.options=intermediate@file"
- "traefik.http.middlewares.nextcloudHeader.headers.customRequestHeaders.X-Forwarded-Proto=https"
- "traefik.http.middlewares.nextcloudHeader.headers.stsSeconds=15552000"
- "traefik.http.middlewares.nextcloudHeader.headers.stsIncludeSubdomains=true"
- "traefik.http.middlewares.nextcloudHeader.headers.stsPreload=true"
- "traefik.http.middlewares.nextcloudHeader.headers.forceSTSHeader=true"
- "traefik.http.middlewares.nextcloudHeader.headers.customResponseHeaders.X-Robots-Tag=noindex,nofollow"
- "traefik.http.routers.nextcloud.middlewares=nextcloudHeader"
- "docker.group=netxtcloud" - "docker.group=netxtcloud"
@ -81,9 +93,17 @@ services:
- ${STORAGE_PATH}/data:/var/www/html/data:ro - ${STORAGE_PATH}/data:/var/www/html/data:ro
environment: environment:
- PORT=7867 - PORT=7867
- NEXTCLOUD_URL=http://webserver-nextcloud - NEXTCLOUD_URL=http://web
entrypoint: /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php entrypoint: /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php
labels: labels:
- "traefik.enable=true"
- "traefik.http.routers.ncpush.rule=Host(`${FQDN_NEXTCLOUD}`) && PathPrefix(`/push`)"
- "traefik.http.routers.ncpush.entrypoints=websecure"
- "traefik.http.routers.ncpush.tls.certresolver=netcup"
- "traefik.http.routers.ncpush.tls.options=intermediate@file"
- "traefik.http.services.ncpush.loadbalancer.server.port=7867"
- "traefik.http.routers.ncpush.middlewares=ncpushstrip"
- "traefik.http.middlewares.ncpushstrip.stripprefix.prefixes=/push"
- "docker.group=proxy" - "docker.group=proxy"
@ -130,6 +150,13 @@ services:
# depends_on: # depends_on:
# - db # - db
# labels: # labels:
# - "traefik.enable=true"
# - "traefik.http.routers.adminer.rule=Host(`${FQDN_ADMINER}`)"
# - "traefik.http.routers.adminer.entrypoints=websecure"
# - "traefik.http.routers.adminer.tls.certresolver=netcup"
# - "traefik.http.routers.adminer.tls.options=intermediate@file"
# - "traefik.http.routers.adminer.middlewares=adminerauth"
# - "traefik.http.middlewares.adminerauth.basicauth.users=${HTPASSWD_ADMINER}"
# - "docker.group=netxtcloud" # - "docker.group=netxtcloud"
@ -169,6 +196,12 @@ services:
- "extra_params=--o:ssl.enable=false --o:ssl.termination=true" - "extra_params=--o:ssl.enable=false --o:ssl.termination=true"
restart: unless-stopped restart: unless-stopped
labels: labels:
- "traefik.enable=true"
- "traefik.http.routers.collabora.rule=Host(`${FQDN_OFFICE}`)"
- "traefik.http.routers.collabora.entrypoints=websecure"
- "traefik.http.routers.collabora.tls.certresolver=netcup"
- "traefik.http.routers.collabora.tls.options=intermediate@file"
- "traefik.http.services.collabora.loadbalancer.server.port=9980"
- "docker.group=netxtcloud" - "docker.group=netxtcloud"
@ -205,6 +238,12 @@ services:
retries: 5 retries: 5
start_period: 20s start_period: 20s
labels: labels:
- "traefik.enable=true"
- "traefik.http.routers.drawio.rule=Host(`${FQDN_DRAWIO}`)"
- "traefik.http.routers.drawio.entrypoints=websecure"
- "traefik.http.routers.drawio.tls.certresolver=netcup"
- "traefik.http.routers.drawio.tls.options=intermediate@file"
- "traefik.http.services.drawio.loadbalancer.server.port=8080"
- "docker.group=netxtcloud" - "docker.group=netxtcloud"
networks: networks:

97
proxy/caddy/Caddyfile
View file

@ -1,97 +0,0 @@
{
email {env.EMAIL}
log default {
output stdout
format console
}
}
*.{$DOMAIN} {
tls {
dns netcup {
customer_number {env.NETCUP_CUSTOMER_NUMBER}
api_key {env.NETCUP_API_KEY}
api_password {env.NETCUP_API_PASSWORD}
}
propagation_timeout 900s
propagation_delay 600s
resolvers 46.38.225.230 46.38.252.230
}
header Strict-Transport-Security "max-age=63072000"
@git host git.{$DOMAIN}
handle @git {
reverse_proxy forgejo:3000
}
@news host news.{$DOMAIN}
handle @news {
reverse_proxy miniflux:8080
}
@nc-push expression `(host('cloud.{$DOMAIN}') && path('/push/*'))`
handle @nc-push {
reverse_proxy push:7867
}
@nextcloud host cloud.{$DOMAIN}
handle @nextcloud {
reverse_proxy webserver-nextcloud:80
}
@office host office.{$DOMAIN}
handle @office {
reverse_proxy collabora:9980
}
@drawio host drawio.{$DOMAIN}
handle @drawio {
reverse_proxy drawio:8080
}
@whoami host whoami.{$DOMAIN}
handle @whoami {
reverse_proxy whoami:80
}
@push host push.{$DOMAIN}
handle @push {
reverse_proxy ntfy:80
}
@wallabag host wallabag.{$DOMAIN}
handle @wallabag {
reverse_proxy wallabag:80
}
@www host www.{$DOMAIN}
handle @www {
file_server {
root /usr/share/caddy
hide .git Readme.md
}
}
@mail host mail.{$DOMAIN}
handle @mail {
reverse_proxy nginx-mailcow:8090
}
# Fallback unhandled (sub)domains
handle {
error 404
}
handle_errors {
root * /usr/share/caddy
rewrite * /error.html
templates
file_server {
status {err.status_code}
}
}
}
{$DOMAIN} {
redir https://www.{$DOMAIN}{uri}
}

7
proxy/caddy/Dockerfile
View file

@ -1,7 +0,0 @@
FROM caddy:2-builder AS builder
RUN xcaddy build --with github.com/caddy-dns/netcup
FROM caddy:2
COPY --from=builder /usr/bin/caddy /usr/bin/caddy

105
proxy/docker-compose.yaml
View file

@ -1,35 +1,98 @@
services: services:
caddy: traefik:
image: florianzirker.de/caddy-netcup image: traefik:${TRAEFIK_VERSION}
build: ./caddy
networks:
- web
restart: unless-stopped restart: unless-stopped
ports:
- "80:80"
- "443:443"
- "443:443/udp"
volumes:
- $PWD/caddy/Caddyfile:/etc/caddy/Caddyfile
- ${STORAGE_PATH}/caddy/data:/data
- ${STORAGE_PATH}/caddy/config:/config
- ${WWW_PATH}:/usr/share/caddy:ro
environment: environment:
- NETCUP_ENDPOINT=${NETCUP_ENDPOINT}
- NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER} - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER}
- NETCUP_API_KEY=${NETCUP_API_KEY} - NETCUP_API_KEY=${NETCUP_API_KEY}
- NETCUP_API_PASSWORD=${NETCUP_API_PASSWORD} - NETCUP_API_PASSWORD=${NETCUP_API_PASSWORD}
- EMAIL=${LETSENCRYPT_MAIL} command:
- DOMAIN=${DOMAIN} - "--api.insecure=false"
- "--api.dashboard=true"
whoami: - "--providers.docker=true"
image: traefik/whoami - "--providers.docker.exposedbydefault=false"
- "--providers.docker.network=web"
- "--providers.docker.endpoint=tcp://docker-socket-proxy:2375"
#- "--log.level=DEBUG"
- "--log.level=INFO"
#- "--accesslog=true"
- "--ping=true"
- "--entrypoints.web.address=:80"
- "--entrypoints.web.http.redirections.entrypoint.to=websecure"
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
- "--entrypoints.websecure.address=:443"
- "--providers.file.filename=/etc/traefik/tls.toml"
- "--certificatesresolvers.netcup.acme.dnschallenge=true"
- "--certificatesresolvers.netcup.acme.dnsChallenge.provider=netcup"
- "--certificatesresolvers.netcup.acme.dnsChallenge.resolvers=46.38.225.230:53,46.38.252.230:53"
- "--certificatesresolvers.netcup.acme.dnschallenge.delayBeforeCheck=900"
- "--certificatesresolvers.netcup.acme.email=${LETSENCRYPT_MAIL}"
- "--certificatesresolvers.netcup.acme.storage=/letsencrypt/acme.json"
- "--metrics.prometheus=true"
- "--metrics.prometheus.addEntryPointsLabels=true"
- "--metrics.prometheus.addRoutersLabels=true"
- "--metrics.prometheus.addServicesLabels=true"
ports:
- "80:80"
- "443:443"
networks: networks:
- web - web
- dockersocket
volumes:
- ${STORAGE_PATH}/letsencrypt:/letsencrypt
- $PWD/tls.toml:/etc/traefik/tls.toml
healthcheck:
test: traefik healthcheck --ping
interval: 3s
timeout: 1s
labels:
- "traefik.enable=true"
- "traefik.http.routers.dashboard.rule=Host(`${FQDN_TRAEFIK}`)"
- "traefik.http.routers.dashboard.service=api@internal"
- "traefik.http.routers.dashboard.entrypoints=websecure"
- "traefik.http.routers.dashboard.tls.certresolver=netcup"
- "traefik.http.routers.dashboard.tls.domains[0].main=${DOMAIN}"
- "traefik.http.routers.dashboard.tls.domains[0].sans=*.${DOMAIN}"
- "traefik.http.routers.dashboard.tls.options=intermediate@file"
- "traefik.http.routers.dashboard.middlewares=auth"
- "traefik.http.middlewares.auth.basicauth.users=${HTPASSWD}"
- "docker.group=proxy"
docker-socket-proxy:
image: tecnativa/docker-socket-proxy
restart: unless-stopped
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
environment:
# grant privileges as environment variables: https://github.com/Tecnativa/docker-socket-proxy#grant-or-revoke-access-to-certain-api-sections
- LOG_LEVEL=warning
- CONTAINERS=1
- INFO=1
networks:
- dockersocket
healthcheck:
test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost:2375/version"]
interval: 10s
timeout: 3s
privileged: true
labels: labels:
- "docker.group=proxy" - "docker.group=proxy"
restart: unless-stopped
# whoami:
# image: traefik/whoami
# networks:
# - web
# labels:
# - "traefik.enable=true"
# - "traefik.http.routers.whoami.rule=Host(`${FQDN_WHOAMI}`)"
# - "traefik.http.routers.whoami.entrypoints=websecure"
# - "traefik.http.routers.whoami.tls.certresolver=netcup"
# - "docker.group=proxy"
# restart: unless-stopped
networks: networks:

2
proxy/reload.sh
View file

@ -1,2 +0,0 @@
#!/bin/bash
docker compose exec -w /etc/caddy caddy caddy reload

14
proxy/tls.toml Normal file
View file

@ -0,0 +1,14 @@
# generated 2020-12-09, Mozilla Guideline v5.6, Traefik 2.3, intermediate configuration
# https://ssl-config.mozilla.org/#server=traefik&version=2.3&config=intermediate&guideline=5.6
[tls.options]
[tls.options.intermediate]
minVersion = "VersionTLS12"
cipherSuites = [
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
]

6
push/docker-compose.yaml
View file

@ -25,6 +25,12 @@ services:
- ${STORAGE_PATH}/ntfy/cache/:/var/cache/ntfy - ${STORAGE_PATH}/ntfy/cache/:/var/cache/ntfy
- ${STORAGE_PATH}/ntfy/varlib/:/var/lib/ntfy/ - ${STORAGE_PATH}/ntfy/varlib/:/var/lib/ntfy/
labels: labels:
- "traefik.enable=true"
- "traefik.http.routers.push.rule=Host(`${FQDN_PUSH}`)"
- "traefik.http.routers.push.entrypoints=websecure"
- "traefik.http.routers.push.tls.certresolver=netcup"
- "traefik.http.routers.push.tls.options=intermediate@file"
- "traefik.http.services.push.loadbalancer.server.port=80"
- "docker.group=push" - "docker.group=push"

7
wallabag/docker-compose.yaml
View file

@ -1,5 +1,5 @@
services: services:
wallabag: app:
image: wallabag/wallabag image: wallabag/wallabag
restart: unless-stopped restart: unless-stopped
environment: environment:
@ -26,6 +26,11 @@ services:
interval: 10s interval: 10s
timeout: 3s timeout: 3s
labels: labels:
- "traefik.enable=true"
- "traefik.http.routers.wallabag.rule=Host(`${FQDN_WALLABAG}`)"
- "traefik.http.routers.wallabag.entrypoints=websecure"
- "traefik.http.routers.wallabag.tls.certresolver=netcup"
- "traefik.http.routers.wallabag.tls.options=intermediate@file"
- "docker.group=wallabag" - "docker.group=wallabag"
depends_on: depends_on:
- db - db

34
www/docker-compose.yaml Normal file
View file

@ -0,0 +1,34 @@
services:
app:
image: nginx:stable
volumes:
- ${HTML}:/usr/share/nginx/html:ro
- $PWD/nginx.conf:/etc/nginx/nginx.conf:ro
networks:
- web
restart: unless-stopped
healthcheck:
test: ["CMD", "curl" ,"--fail", "localhost"]
interval: 5s
timeout: 3s
labels:
- "traefik.enable=true"
- "traefik.http.routers.webroot.entrypoints=websecure" # All HTTP requests are globally redirected to HTTPS
- "traefik.http.routers.webroot.rule=Host(`${DOMAIN}`)"
- "traefik.http.routers.webroot.tls.certresolver=netcup"
- "traefik.http.routers.webroot.tls.options=intermediate@file"
- "traefik.http.routers.webroot.middlewares=redirect-to-www"
- "traefik.http.middlewares.redirect-to-www.redirectregex.regex=^https?://${DOMAIN}/(.*)"
- "traefik.http.middlewares.redirect-to-www.redirectregex.replacement=https://${FQDN_WWW}/$${1}"
- "traefik.http.middlewares.redirect-to-www.redirectregex.permanent=true"
- "traefik.http.routers.www-secure.entrypoints=websecure"
- "traefik.http.routers.www-secure.rule=Host(`${FQDN_WWW}`)"
- "traefik.http.routers.www-secure.tls.certresolver=netcup"
- "traefik.http.routers.www-secure.tls.options=intermediate@file"
- "docker.group=www"
networks:
web:
external: true

67
www/nginx.conf Normal file
View file

@ -0,0 +1,67 @@
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
# include /etc/nginx/conf.d/*.conf;
############################################
server {
listen 80;
listen [::]:80;
server_name localhost;
#access_log /var/log/nginx/host.access.log main;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
# hide .git folder
location ~ /\.git {
deny all;
return 404;
}
location ~ /Readme.md {
deny all;
return 404;
}
}
# include /etc/nginx/conf.d/*.conf;
}