From 5f3ad34250ba3755613180eb36d44ca381f032bc Mon Sep 17 00:00:00 2001 From: Florian Zirker Date: Fri, 6 Dec 2024 16:02:20 +0100 Subject: [PATCH 01/12] treafik -> caddy --- firefoxsync/docker-compose.yaml | 6 -- git/docker-compose.yaml | 10 ---- news/docker-compose.yaml | 6 -- nextcloud/docker-compose.yaml | 43 +------------ proxy/caddy/Caddyfile | 91 ++++++++++++++++++++++++++++ proxy/caddy/Dockerfile | 7 +++ proxy/docker-compose.yaml | 103 ++++++-------------------------- proxy/tls.toml | 14 ----- push/docker-compose.yaml | 6 -- wallabag/docker-compose.yaml | 7 +-- www/docker-compose.yaml | 15 +---- 11 files changed, 121 insertions(+), 187 deletions(-) create mode 100644 proxy/caddy/Caddyfile create mode 100644 proxy/caddy/Dockerfile delete mode 100644 proxy/tls.toml diff --git a/firefoxsync/docker-compose.yaml b/firefoxsync/docker-compose.yaml index ba34de7..3f5e082 100644 --- a/firefoxsync/docker-compose.yaml +++ b/firefoxsync/docker-compose.yaml @@ -9,12 +9,6 @@ services: - web - firefoxsync labels: - - "traefik.enable=true" - - "traefik.http.routers.ffs.rule=Host(`${FQDN_FIREFOXSYNC}`)" - - "traefik.http.routers.ffs.entrypoints=websecure" - - "traefik.http.routers.ffs.tls.certresolver=netcup" - - "traefik.http.routers.ffs.tls.options=intermediate@file" - - "traefik.http.services.ffs.loadbalancer.server.port=5000" - "docker.group=firefoxsync" restart: unless-stopped environment: diff --git a/git/docker-compose.yaml b/git/docker-compose.yaml index 223451c..2e525ef 100644 --- a/git/docker-compose.yaml +++ b/git/docker-compose.yaml @@ -28,16 +28,6 @@ services: interval: 5s timeout: 3s labels: - - "traefik.enable=true" - - "traefik.http.routers.forgejo.rule=Host(`${FQDN_GIT}`, `${FQDN_GIT_OLD}`)" - - "traefik.http.routers.forgejo.entrypoints=websecure" - - "traefik.http.routers.forgejo.tls.certresolver=netcup" - - "traefik.http.routers.forgejo.tls.options=intermediate@file" - - "traefik.http.routers.forgejo.middlewares=gitearedir" - - "traefik.http.middlewares.gitearedir.redirectregex.regex=^https://${FQDN_GIT_OLD}/(.*)" - - "traefik.http.middlewares.gitearedir.redirectregex.replacement=https://${FQDN_GIT}/$${1}" - - "traefik.http.middlewares.gitearedir.redirectregex.permanent=true" - - "traefik.http.services.forgejo.loadbalancer.server.port=3000" - "docker.group=git" diff --git a/news/docker-compose.yaml b/news/docker-compose.yaml index f63aa78..12581cd 100644 --- a/news/docker-compose.yaml +++ b/news/docker-compose.yaml @@ -21,12 +21,6 @@ services: healthcheck: test: ["CMD", "/usr/bin/miniflux", "-healthcheck", "auto"] labels: - - "traefik.enable=true" - - "traefik.http.routers.news.rule=Host(`${FQDN_NEWS}`)" - - "traefik.http.routers.news.entrypoints=websecure" - - "traefik.http.routers.news.tls.certresolver=netcup" - - "traefik.http.routers.news.tls.options=intermediate@file" - - "traefik.http.services.news.loadbalancer.server.port=8080" - "docker.group=news" diff --git a/nextcloud/docker-compose.yaml b/nextcloud/docker-compose.yaml index fa852a0..59fe9eb 100644 --- a/nextcloud/docker-compose.yaml +++ b/nextcloud/docker-compose.yaml @@ -1,6 +1,6 @@ services: - web: + webserver-nextcloud: image: nginx:stable depends_on: - app @@ -16,18 +16,6 @@ services: # interval: 5s # timeout: 3s labels: - - "traefik.enable=true" - - "traefik.http.routers.nextcloud.rule=Host(`${FQDN_NEXTCLOUD}`)" - - "traefik.http.routers.nextcloud.entrypoints=websecure" - - "traefik.http.routers.nextcloud.tls.certresolver=netcup" - - "traefik.http.routers.nextcloud.tls.options=intermediate@file" - - "traefik.http.middlewares.nextcloudHeader.headers.customRequestHeaders.X-Forwarded-Proto=https" - - "traefik.http.middlewares.nextcloudHeader.headers.stsSeconds=15552000" - - "traefik.http.middlewares.nextcloudHeader.headers.stsIncludeSubdomains=true" - - "traefik.http.middlewares.nextcloudHeader.headers.stsPreload=true" - - "traefik.http.middlewares.nextcloudHeader.headers.forceSTSHeader=true" - - "traefik.http.middlewares.nextcloudHeader.headers.customResponseHeaders.X-Robots-Tag=noindex,nofollow" - - "traefik.http.routers.nextcloud.middlewares=nextcloudHeader" - "docker.group=netxtcloud" @@ -93,17 +81,9 @@ services: - ${STORAGE_PATH}/data:/var/www/html/data:ro environment: - PORT=7867 - - NEXTCLOUD_URL=http://web + - NEXTCLOUD_URL=http://webserver-nextcloud entrypoint: /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php labels: - - "traefik.enable=true" - - "traefik.http.routers.ncpush.rule=Host(`${FQDN_NEXTCLOUD}`) && PathPrefix(`/push`)" - - "traefik.http.routers.ncpush.entrypoints=websecure" - - "traefik.http.routers.ncpush.tls.certresolver=netcup" - - "traefik.http.routers.ncpush.tls.options=intermediate@file" - - "traefik.http.services.ncpush.loadbalancer.server.port=7867" - - "traefik.http.routers.ncpush.middlewares=ncpushstrip" - - "traefik.http.middlewares.ncpushstrip.stripprefix.prefixes=/push" - "docker.group=proxy" @@ -150,13 +130,6 @@ services: # depends_on: # - db # labels: -# - "traefik.enable=true" -# - "traefik.http.routers.adminer.rule=Host(`${FQDN_ADMINER}`)" -# - "traefik.http.routers.adminer.entrypoints=websecure" -# - "traefik.http.routers.adminer.tls.certresolver=netcup" -# - "traefik.http.routers.adminer.tls.options=intermediate@file" -# - "traefik.http.routers.adminer.middlewares=adminerauth" -# - "traefik.http.middlewares.adminerauth.basicauth.users=${HTPASSWD_ADMINER}" # - "docker.group=netxtcloud" @@ -196,12 +169,6 @@ services: - "extra_params=--o:ssl.enable=false --o:ssl.termination=true" restart: unless-stopped labels: - - "traefik.enable=true" - - "traefik.http.routers.collabora.rule=Host(`${FQDN_OFFICE}`)" - - "traefik.http.routers.collabora.entrypoints=websecure" - - "traefik.http.routers.collabora.tls.certresolver=netcup" - - "traefik.http.routers.collabora.tls.options=intermediate@file" - - "traefik.http.services.collabora.loadbalancer.server.port=9980" - "docker.group=netxtcloud" @@ -238,12 +205,6 @@ services: retries: 5 start_period: 20s labels: - - "traefik.enable=true" - - "traefik.http.routers.drawio.rule=Host(`${FQDN_DRAWIO}`)" - - "traefik.http.routers.drawio.entrypoints=websecure" - - "traefik.http.routers.drawio.tls.certresolver=netcup" - - "traefik.http.routers.drawio.tls.options=intermediate@file" - - "traefik.http.services.drawio.loadbalancer.server.port=8080" - "docker.group=netxtcloud" networks: diff --git a/proxy/caddy/Caddyfile b/proxy/caddy/Caddyfile new file mode 100644 index 0000000..fb33b87 --- /dev/null +++ b/proxy/caddy/Caddyfile @@ -0,0 +1,91 @@ +{ +# acme_ca https://acme-v02.api.letsencrypt.org/directory + email {env.EMAIL} + log { + format console + } +} + +*.{$DOMAIN} { + tls { + dns netcup { + customer_number {env.NETCUP_CUSTOMER_NUMBER} + api_key {env.NETCUP_API_KEY} + api_password {env.NETCUP_API_PASSWORD} + } + propagation_timeout 900s + propagation_delay 600s + resolvers 46.38.225.230 46.38.252.230 + } + # header Strict-Transport-Security "max-age=63072000" + + @git host git.{$DOMAIN} + handle @git { + reverse_proxy forgejo:3000 + } + + @news host news.{$DOMAIN} + handle @news { + reverse_proxy miniflux:8080 + } + + @nc-push expression `(host('cloud.{$DOMAIN}') && path('/push/*'))` + handle @nc-push { + reverse_proxy push:7867 + } + + @nextcloud host cloud.{$DOMAIN} + handle @nextcloud { + reverse_proxy webserver-nextcloud:80 + } + + @office host office.{$DOMAIN} + handle @office { + reverse_proxy collabora:9980 + } + + @drawio host drawio.{$DOMAIN} + handle @drawio { + reverse_proxy drawio:8080 + } + + @whoami host whoami.{$DOMAIN} + handle @whoami { + reverse_proxy whoami:80 + } + + @push host push.{$DOMAIN} + handle @push { + reverse_proxy ntfy:80 + } + + @wallabag host wallabag.{$DOMAIN} + handle @wallabag { + reverse_proxy wallabag:80 + } + + @www host www.{$DOMAIN} + handle @www { + reverse_proxy webserver-www:80 + } + + @mail host mail.{$DOMAIN} + handle @mail { + reverse_proxy nginx-mailcow:8090 + } + + # Fallback for otherwise unhandled domains + handle { + respond 404 + } +} + +{$DOMAIN} { + redir https://www.{$DOMAIN}{uri} +} + + + + + + diff --git a/proxy/caddy/Dockerfile b/proxy/caddy/Dockerfile new file mode 100644 index 0000000..7223e84 --- /dev/null +++ b/proxy/caddy/Dockerfile @@ -0,0 +1,7 @@ +FROM caddy:2-builder AS builder + +RUN xcaddy build --with github.com/caddy-dns/netcup + +FROM caddy:2 + +COPY --from=builder /usr/bin/caddy /usr/bin/caddy diff --git a/proxy/docker-compose.yaml b/proxy/docker-compose.yaml index 4881fd7..f8d347e 100755 --- a/proxy/docker-compose.yaml +++ b/proxy/docker-compose.yaml @@ -1,98 +1,33 @@ services: - traefik: - image: traefik:${TRAEFIK_VERSION} + caddy: + image: florianzirker.de/caddy-netcup + build: ./caddy + networks: + - web restart: unless-stopped - environment: - - NETCUP_ENDPOINT=${NETCUP_ENDPOINT} - - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER} - - NETCUP_API_KEY=${NETCUP_API_KEY} - - NETCUP_API_PASSWORD=${NETCUP_API_PASSWORD} - command: - - "--api.insecure=false" - - "--api.dashboard=true" - - "--providers.docker=true" - - "--providers.docker.exposedbydefault=false" - - "--providers.docker.network=web" - - "--providers.docker.endpoint=tcp://docker-socket-proxy:2375" - #- "--log.level=DEBUG" - - "--log.level=INFO" - #- "--accesslog=true" - - "--ping=true" - - "--entrypoints.web.address=:80" - - "--entrypoints.web.http.redirections.entrypoint.to=websecure" - - "--entrypoints.web.http.redirections.entrypoint.scheme=https" - - "--entrypoints.websecure.address=:443" - - "--providers.file.filename=/etc/traefik/tls.toml" - - "--certificatesresolvers.netcup.acme.dnschallenge=true" - - "--certificatesresolvers.netcup.acme.dnsChallenge.provider=netcup" - - "--certificatesresolvers.netcup.acme.dnsChallenge.resolvers=46.38.225.230:53,46.38.252.230:53" - - "--certificatesresolvers.netcup.acme.dnschallenge.delayBeforeCheck=900" - - "--certificatesresolvers.netcup.acme.email=${LETSENCRYPT_MAIL}" - - "--certificatesresolvers.netcup.acme.storage=/letsencrypt/acme.json" - - "--metrics.prometheus=true" - - "--metrics.prometheus.addEntryPointsLabels=true" - - "--metrics.prometheus.addRoutersLabels=true" - - "--metrics.prometheus.addServicesLabels=true" ports: - "80:80" - "443:443" + - "443:443/udp" + volumes: + - $PWD/caddy/Caddyfile:/etc/caddy/Caddyfile + - ${STORAGE_PATH}/caddy/data:/data + - ${STORAGE_PATH}/caddy/config:/config + environment: + - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER} + - NETCUP_API_KEY=${NETCUP_API_KEY} + - NETCUP_API_PASSWORD=${NETCUP_API_PASSWORD} + - EMAIL=${LETSENCRYPT_MAIL} + - DOMAIN=${DOMAIN} + + whoami: + image: traefik/whoami networks: - web - - dockersocket - volumes: - - ${STORAGE_PATH}/letsencrypt:/letsencrypt - - $PWD/tls.toml:/etc/traefik/tls.toml - healthcheck: - test: traefik healthcheck --ping - interval: 3s - timeout: 1s labels: - - "traefik.enable=true" - - "traefik.http.routers.dashboard.rule=Host(`${FQDN_TRAEFIK}`)" - - "traefik.http.routers.dashboard.service=api@internal" - - "traefik.http.routers.dashboard.entrypoints=websecure" - - "traefik.http.routers.dashboard.tls.certresolver=netcup" - - "traefik.http.routers.dashboard.tls.domains[0].main=${DOMAIN}" - - "traefik.http.routers.dashboard.tls.domains[0].sans=*.${DOMAIN}" - - "traefik.http.routers.dashboard.tls.options=intermediate@file" - - "traefik.http.routers.dashboard.middlewares=auth" - - "traefik.http.middlewares.auth.basicauth.users=${HTPASSWD}" - "docker.group=proxy" - - - docker-socket-proxy: - image: tecnativa/docker-socket-proxy restart: unless-stopped - volumes: - - /var/run/docker.sock:/var/run/docker.sock:ro - environment: - # grant privileges as environment variables: https://github.com/Tecnativa/docker-socket-proxy#grant-or-revoke-access-to-certain-api-sections - - LOG_LEVEL=warning - - CONTAINERS=1 - - INFO=1 - networks: - - dockersocket - healthcheck: - test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost:2375/version"] - interval: 10s - timeout: 3s - privileged: true - labels: - - "docker.group=proxy" - - -# whoami: -# image: traefik/whoami -# networks: -# - web -# labels: -# - "traefik.enable=true" -# - "traefik.http.routers.whoami.rule=Host(`${FQDN_WHOAMI}`)" -# - "traefik.http.routers.whoami.entrypoints=websecure" -# - "traefik.http.routers.whoami.tls.certresolver=netcup" -# - "docker.group=proxy" -# restart: unless-stopped networks: diff --git a/proxy/tls.toml b/proxy/tls.toml deleted file mode 100644 index ccfc0f3..0000000 --- a/proxy/tls.toml +++ /dev/null @@ -1,14 +0,0 @@ -# generated 2020-12-09, Mozilla Guideline v5.6, Traefik 2.3, intermediate configuration -# https://ssl-config.mozilla.org/#server=traefik&version=2.3&config=intermediate&guideline=5.6 - -[tls.options] - [tls.options.intermediate] - minVersion = "VersionTLS12" - cipherSuites = [ - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305" - ] diff --git a/push/docker-compose.yaml b/push/docker-compose.yaml index ef05c1e..135df1a 100644 --- a/push/docker-compose.yaml +++ b/push/docker-compose.yaml @@ -25,12 +25,6 @@ services: - ${STORAGE_PATH}/ntfy/cache/:/var/cache/ntfy - ${STORAGE_PATH}/ntfy/varlib/:/var/lib/ntfy/ labels: - - "traefik.enable=true" - - "traefik.http.routers.push.rule=Host(`${FQDN_PUSH}`)" - - "traefik.http.routers.push.entrypoints=websecure" - - "traefik.http.routers.push.tls.certresolver=netcup" - - "traefik.http.routers.push.tls.options=intermediate@file" - - "traefik.http.services.push.loadbalancer.server.port=80" - "docker.group=push" diff --git a/wallabag/docker-compose.yaml b/wallabag/docker-compose.yaml index d8c9970..2ed38ab 100644 --- a/wallabag/docker-compose.yaml +++ b/wallabag/docker-compose.yaml @@ -1,5 +1,5 @@ services: - app: + wallabag: image: wallabag/wallabag restart: unless-stopped environment: @@ -26,11 +26,6 @@ services: interval: 10s timeout: 3s labels: - - "traefik.enable=true" - - "traefik.http.routers.wallabag.rule=Host(`${FQDN_WALLABAG}`)" - - "traefik.http.routers.wallabag.entrypoints=websecure" - - "traefik.http.routers.wallabag.tls.certresolver=netcup" - - "traefik.http.routers.wallabag.tls.options=intermediate@file" - "docker.group=wallabag" depends_on: - db diff --git a/www/docker-compose.yaml b/www/docker-compose.yaml index 80e2e63..36be945 100644 --- a/www/docker-compose.yaml +++ b/www/docker-compose.yaml @@ -1,6 +1,6 @@ services: - app: + webserver-www: image: nginx:stable volumes: - ${HTML}:/usr/share/nginx/html:ro @@ -13,19 +13,6 @@ services: interval: 5s timeout: 3s labels: - - "traefik.enable=true" - - "traefik.http.routers.webroot.entrypoints=websecure" # All HTTP requests are globally redirected to HTTPS - - "traefik.http.routers.webroot.rule=Host(`${DOMAIN}`)" - - "traefik.http.routers.webroot.tls.certresolver=netcup" - - "traefik.http.routers.webroot.tls.options=intermediate@file" - - "traefik.http.routers.webroot.middlewares=redirect-to-www" - - "traefik.http.middlewares.redirect-to-www.redirectregex.regex=^https?://${DOMAIN}/(.*)" - - "traefik.http.middlewares.redirect-to-www.redirectregex.replacement=https://${FQDN_WWW}/$${1}" - - "traefik.http.middlewares.redirect-to-www.redirectregex.permanent=true" - - "traefik.http.routers.www-secure.entrypoints=websecure" - - "traefik.http.routers.www-secure.rule=Host(`${FQDN_WWW}`)" - - "traefik.http.routers.www-secure.tls.certresolver=netcup" - - "traefik.http.routers.www-secure.tls.options=intermediate@file" - "docker.group=www" networks: From 02e5e0b682ee3e12ca57037d8cbd74f3e5ec9f51 Mon Sep 17 00:00:00 2001 From: Florian Zirker Date: Tue, 10 Dec 2024 08:34:06 +0100 Subject: [PATCH 02/12] Use Strict-Transport-Security --- proxy/caddy/Caddyfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/proxy/caddy/Caddyfile b/proxy/caddy/Caddyfile index fb33b87..a3b4aaa 100644 --- a/proxy/caddy/Caddyfile +++ b/proxy/caddy/Caddyfile @@ -17,7 +17,7 @@ propagation_delay 600s resolvers 46.38.225.230 46.38.252.230 } - # header Strict-Transport-Security "max-age=63072000" + header Strict-Transport-Security "max-age=63072000" @git host git.{$DOMAIN} handle @git { From 8325b9a7593d78a93420d0c923c42a99139faef8 Mon Sep 17 00:00:00 2001 From: Florian Zirker Date: Tue, 10 Dec 2024 13:45:54 +0100 Subject: [PATCH 03/12] Format Caddyfile --- .editorconfig | 9 +++ proxy/caddy/Caddyfile | 136 ++++++++++++++++++-------------------- proxy/docker-compose.yaml | 6 +- proxy/reload.sh | 2 + 4 files changed, 79 insertions(+), 74 deletions(-) create mode 100755 proxy/reload.sh diff --git a/.editorconfig b/.editorconfig index ec07101..f483581 100644 --- a/.editorconfig +++ b/.editorconfig @@ -16,3 +16,12 @@ tab_width = 2 [*.md] trim_trailing_whitespace = false + +[Caddyfile] +indent_style = tab +indent_size = 4 +tab_width = 4 +end_of_line = lf +charset = utf-8 +trim_trailing_whitespace = true +insert_final_newline = true diff --git a/proxy/caddy/Caddyfile b/proxy/caddy/Caddyfile index a3b4aaa..3b06def 100644 --- a/proxy/caddy/Caddyfile +++ b/proxy/caddy/Caddyfile @@ -1,91 +1,85 @@ { -# acme_ca https://acme-v02.api.letsencrypt.org/directory - email {env.EMAIL} - log { - format console - } + email {env.EMAIL} + log default { + output stdout + format console + } } *.{$DOMAIN} { - tls { - dns netcup { - customer_number {env.NETCUP_CUSTOMER_NUMBER} - api_key {env.NETCUP_API_KEY} - api_password {env.NETCUP_API_PASSWORD} - } - propagation_timeout 900s - propagation_delay 600s - resolvers 46.38.225.230 46.38.252.230 - } - header Strict-Transport-Security "max-age=63072000" + tls { + dns netcup { + customer_number {env.NETCUP_CUSTOMER_NUMBER} + api_key {env.NETCUP_API_KEY} + api_password {env.NETCUP_API_PASSWORD} + } + propagation_timeout 900s + propagation_delay 600s + resolvers 46.38.225.230 46.38.252.230 + } + header Strict-Transport-Security "max-age=63072000" - @git host git.{$DOMAIN} - handle @git { - reverse_proxy forgejo:3000 - } + @git host git.{$DOMAIN} + handle @git { + reverse_proxy forgejo:3000 + } - @news host news.{$DOMAIN} - handle @news { - reverse_proxy miniflux:8080 - } + @news host news.{$DOMAIN} + handle @news { + reverse_proxy miniflux:8080 + } - @nc-push expression `(host('cloud.{$DOMAIN}') && path('/push/*'))` - handle @nc-push { - reverse_proxy push:7867 - } + @nc-push expression `(host('cloud.{$DOMAIN}') && path('/push/*'))` + handle @nc-push { + reverse_proxy push:7867 + } - @nextcloud host cloud.{$DOMAIN} - handle @nextcloud { - reverse_proxy webserver-nextcloud:80 - } + @nextcloud host cloud.{$DOMAIN} + handle @nextcloud { + reverse_proxy webserver-nextcloud:80 + } - @office host office.{$DOMAIN} - handle @office { - reverse_proxy collabora:9980 - } + @office host office.{$DOMAIN} + handle @office { + reverse_proxy collabora:9980 + } - @drawio host drawio.{$DOMAIN} - handle @drawio { - reverse_proxy drawio:8080 - } + @drawio host drawio.{$DOMAIN} + handle @drawio { + reverse_proxy drawio:8080 + } - @whoami host whoami.{$DOMAIN} - handle @whoami { - reverse_proxy whoami:80 - } + @whoami host whoami.{$DOMAIN} + handle @whoami { + reverse_proxy whoami:80 + } - @push host push.{$DOMAIN} - handle @push { - reverse_proxy ntfy:80 - } + @push host push.{$DOMAIN} + handle @push { + reverse_proxy ntfy:80 + } - @wallabag host wallabag.{$DOMAIN} - handle @wallabag { - reverse_proxy wallabag:80 - } + @wallabag host wallabag.{$DOMAIN} + handle @wallabag { + reverse_proxy wallabag:80 + } - @www host www.{$DOMAIN} - handle @www { - reverse_proxy webserver-www:80 - } + @www host www.{$DOMAIN} + handle @www { + reverse_proxy webserver-www:80 + } - @mail host mail.{$DOMAIN} - handle @mail { - reverse_proxy nginx-mailcow:8090 - } + @mail host mail.{$DOMAIN} + handle @mail { + reverse_proxy nginx-mailcow:8090 + } - # Fallback for otherwise unhandled domains - handle { - respond 404 - } + # Fallback for otherwise unhandled domains + handle { + respond 404 + } } {$DOMAIN} { - redir https://www.{$DOMAIN}{uri} + redir https://www.{$DOMAIN}{uri} } - - - - - - diff --git a/proxy/docker-compose.yaml b/proxy/docker-compose.yaml index f8d347e..5de558d 100755 --- a/proxy/docker-compose.yaml +++ b/proxy/docker-compose.yaml @@ -11,9 +11,9 @@ services: - "443:443" - "443:443/udp" volumes: - - $PWD/caddy/Caddyfile:/etc/caddy/Caddyfile - - ${STORAGE_PATH}/caddy/data:/data - - ${STORAGE_PATH}/caddy/config:/config + - $PWD/caddy/Caddyfile:/etc/caddy/Caddyfile + - ${STORAGE_PATH}/caddy/data:/data + - ${STORAGE_PATH}/caddy/config:/config environment: - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER} - NETCUP_API_KEY=${NETCUP_API_KEY} diff --git a/proxy/reload.sh b/proxy/reload.sh new file mode 100755 index 0000000..27d9320 --- /dev/null +++ b/proxy/reload.sh @@ -0,0 +1,2 @@ +#!/bin/bash +docker compose exec -w /etc/caddy caddy caddy reload \ No newline at end of file From 1490487e7bbe42ceaad69866c1ae2f25766b88fe Mon Sep 17 00:00:00 2001 From: Florian Zirker Date: Tue, 10 Dec 2024 13:48:23 +0100 Subject: [PATCH 04/12] Serve www directly from caddy --- proxy/caddy/Caddyfile | 5 ++- proxy/docker-compose.yaml | 2 ++ www/docker-compose.yaml | 21 ------------ www/nginx.conf | 67 --------------------------------------- 4 files changed, 6 insertions(+), 89 deletions(-) delete mode 100644 www/docker-compose.yaml delete mode 100644 www/nginx.conf diff --git a/proxy/caddy/Caddyfile b/proxy/caddy/Caddyfile index 3b06def..7b20b5d 100644 --- a/proxy/caddy/Caddyfile +++ b/proxy/caddy/Caddyfile @@ -66,7 +66,10 @@ @www host www.{$DOMAIN} handle @www { - reverse_proxy webserver-www:80 + file_server { + root /usr/share/caddy + hide .git Readme.md + } } @mail host mail.{$DOMAIN} diff --git a/proxy/docker-compose.yaml b/proxy/docker-compose.yaml index 5de558d..1670926 100755 --- a/proxy/docker-compose.yaml +++ b/proxy/docker-compose.yaml @@ -14,6 +14,8 @@ services: - $PWD/caddy/Caddyfile:/etc/caddy/Caddyfile - ${STORAGE_PATH}/caddy/data:/data - ${STORAGE_PATH}/caddy/config:/config + - ${WWW_PATH}:/usr/share/caddy:ro + environment: - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER} - NETCUP_API_KEY=${NETCUP_API_KEY} diff --git a/www/docker-compose.yaml b/www/docker-compose.yaml deleted file mode 100644 index 36be945..0000000 --- a/www/docker-compose.yaml +++ /dev/null @@ -1,21 +0,0 @@ -services: - - webserver-www: - image: nginx:stable - volumes: - - ${HTML}:/usr/share/nginx/html:ro - - $PWD/nginx.conf:/etc/nginx/nginx.conf:ro - networks: - - web - restart: unless-stopped - healthcheck: - test: ["CMD", "curl" ,"--fail", "localhost"] - interval: 5s - timeout: 3s - labels: - - "docker.group=www" - -networks: - web: - external: true - diff --git a/www/nginx.conf b/www/nginx.conf deleted file mode 100644 index 73d1ce1..0000000 --- a/www/nginx.conf +++ /dev/null @@ -1,67 +0,0 @@ -user nginx; -worker_processes auto; - -error_log /var/log/nginx/error.log notice; -pid /var/run/nginx.pid; - - -events { - worker_connections 1024; -} - - -http { - include /etc/nginx/mime.types; - default_type application/octet-stream; - - log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for"'; - - access_log /var/log/nginx/access.log main; - - sendfile on; - #tcp_nopush on; - - keepalive_timeout 65; - - #gzip on; - - # include /etc/nginx/conf.d/*.conf; - ############################################ - server { - listen 80; - listen [::]:80; - server_name localhost; - - #access_log /var/log/nginx/host.access.log main; - - location / { - root /usr/share/nginx/html; - index index.html index.htm; - } - - #error_page 404 /404.html; - - # redirect server error pages to the static page /50x.html - # - error_page 500 502 503 504 /50x.html; - location = /50x.html { - root /usr/share/nginx/html; - } - - # hide .git folder - location ~ /\.git { - deny all; - return 404; - } - - location ~ /Readme.md { - deny all; - return 404; - } - - } - - # include /etc/nginx/conf.d/*.conf; -} From e59dbe314f608da3fca21fdad2643e5626e0f94e Mon Sep 17 00:00:00 2001 From: Florian Zirker Date: Tue, 10 Dec 2024 16:29:08 +0100 Subject: [PATCH 05/12] handle errors --- proxy/caddy/Caddyfile | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/proxy/caddy/Caddyfile b/proxy/caddy/Caddyfile index 7b20b5d..4cc073c 100644 --- a/proxy/caddy/Caddyfile +++ b/proxy/caddy/Caddyfile @@ -6,6 +6,15 @@ } } +(error) { + root * /usr/share/caddy + rewrite * /error.html + templates + file_server { + status {err.status_code} + } +} + *.{$DOMAIN} { tls { dns netcup { @@ -79,7 +88,23 @@ # Fallback for otherwise unhandled domains handle { - respond 404 + respond "404 Not Found" 404 + } + + # handle wrong url pathes + handle_errors 404 { + #respond "{err.status_code} {err.status_text}" {err.status_code} + import error + } + + # handle errors of proxy backends are down + # handle_errors 502 { + # respond "503 Service Unavailable" 503 + # } + + # every other error + handle_errors { + import error } } From 230fb50d3a895a084c50c373165e2672a547bcf1 Mon Sep 17 00:00:00 2001 From: Florian Zirker Date: Wed, 11 Dec 2024 09:09:31 +0100 Subject: [PATCH 06/12] improve errors --- proxy/caddy/Caddyfile | 32 ++++++++------------------------ 1 file changed, 8 insertions(+), 24 deletions(-) diff --git a/proxy/caddy/Caddyfile b/proxy/caddy/Caddyfile index 4cc073c..0e25496 100644 --- a/proxy/caddy/Caddyfile +++ b/proxy/caddy/Caddyfile @@ -6,15 +6,6 @@ } } -(error) { - root * /usr/share/caddy - rewrite * /error.html - templates - file_server { - status {err.status_code} - } -} - *.{$DOMAIN} { tls { dns netcup { @@ -86,25 +77,18 @@ reverse_proxy nginx-mailcow:8090 } - # Fallback for otherwise unhandled domains + # Fallback unhandled (sub)domains handle { - respond "404 Not Found" 404 + error 404 } - # handle wrong url pathes - handle_errors 404 { - #respond "{err.status_code} {err.status_text}" {err.status_code} - import error - } - - # handle errors of proxy backends are down - # handle_errors 502 { - # respond "503 Service Unavailable" 503 - # } - - # every other error handle_errors { - import error + root * /usr/share/caddy + rewrite * /error.html + templates + file_server { + status {err.status_code} + } } } From 6aff683f504ff27f927f737c3a234fc6cb2d9094 Mon Sep 17 00:00:00 2001 From: Florian Zirker Date: Wed, 18 Dec 2024 09:22:06 +0100 Subject: [PATCH 07/12] Changes for nextcloud 30 --- nextcloud/nginx.conf | 18 ++++++++++++------ proxy/docker-compose.yaml | 1 - 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/nextcloud/nginx.conf b/nextcloud/nginx.conf index dd2e803..a3727d7 100644 --- a/nextcloud/nginx.conf +++ b/nextcloud/nginx.conf @@ -127,7 +127,7 @@ http { # Let Nextcloud's API for `/.well-known` URIs handle all other # requests by passing them to the front-end controller. - return 301 https://$host:443/index.php$request_uri; + return 301 https://$host:443/index.php$request_uri; } # Rules borrowed from `.htaccess` to hide certain paths from clients @@ -164,12 +164,12 @@ http { # Javascript mimetype fixes for nginx # Note: The block below should be removed, and the js|mjs section should be - # added to the block below this one. This is a temporary fix until Nginx + # added to the block below this one. This is a temporary fix until Nginx # upstream fixes the js mime-type location ~* \.(?:js|mjs)$ { - types { + types { text/javascript js mjs; - } + } default_type "text/javascript"; try_files $uri /index.php$request_uri; add_header Cache-Control "public, max-age=15778463, $asset_immutable"; @@ -177,9 +177,15 @@ http { } # Serve static files - location ~ \.(?:css|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ { + location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ { try_files $uri /index.php$request_uri; - add_header Cache-Control "public, max-age=15778463, $asset_immutable"; + add_header Cache-Control "public, max-age=15778463$asset_immutable"; + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "noindex, nofollow" always; + add_header X-XSS-Protection "1; mode=block" always; access_log off; # Optional: Don't log access to assets location ~ \.wasm$ { diff --git a/proxy/docker-compose.yaml b/proxy/docker-compose.yaml index 1670926..262e603 100755 --- a/proxy/docker-compose.yaml +++ b/proxy/docker-compose.yaml @@ -15,7 +15,6 @@ services: - ${STORAGE_PATH}/caddy/data:/data - ${STORAGE_PATH}/caddy/config:/config - ${WWW_PATH}:/usr/share/caddy:ro - environment: - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER} - NETCUP_API_KEY=${NETCUP_API_KEY} From b343d7660de4afe73019f8448e23eb60b49e3c5e Mon Sep 17 00:00:00 2001 From: Florian Zirker Date: Mon, 23 Dec 2024 15:11:55 +0100 Subject: [PATCH 08/12] remove www from start script --- start-all.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/start-all.sh b/start-all.sh index 7d0ea6e..2846ba4 100755 --- a/start-all.sh +++ b/start-all.sh @@ -9,7 +9,6 @@ up proxy; up nextcloud; up git; up wallabag; -up www; up firefoxsync; up push; up rustdesk; From 0587f0e56ae125d6ef574aeafe7b2c952ad46335 Mon Sep 17 00:00:00 2001 From: Florian Zirker Date: Mon, 23 Dec 2024 15:12:10 +0100 Subject: [PATCH 09/12] fix healthcheck of nextcloud db --- nextcloud/docker-compose.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/nextcloud/docker-compose.yaml b/nextcloud/docker-compose.yaml index 59fe9eb..644f0fd 100644 --- a/nextcloud/docker-compose.yaml +++ b/nextcloud/docker-compose.yaml @@ -111,9 +111,12 @@ services: - nextcloud - mariadb healthcheck: - test: ["CMD", "mysqladmin" ,"--user" ,"$MYSQL_USER" ,"--password=$MYSQL_PASSWORD" ,"ping" ,"-h" ,"localhost"] - interval: 20s - timeout: 3s + test: [ "CMD", "healthcheck.sh", "--connect", "--innodb_initialized" ] + start_period: 1m + start_interval: 10s + interval: 1m + timeout: 5s + retries: 3 labels: - "docker.group=netxtcloud" From f1993add86fecbcf94032dfdb111c999174a085d Mon Sep 17 00:00:00 2001 From: Florian Zirker Date: Tue, 21 Jan 2025 09:59:35 +0100 Subject: [PATCH 10/12] More redirects --- proxy/caddy/Caddyfile | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/proxy/caddy/Caddyfile b/proxy/caddy/Caddyfile index 0e25496..a1e9b11 100644 --- a/proxy/caddy/Caddyfile +++ b/proxy/caddy/Caddyfile @@ -24,6 +24,11 @@ reverse_proxy forgejo:3000 } + @git-alt host gitea.{$DOMAIN} forgejo.{$DOMAIN} + handle @git-alt { + redir https://git.{$DOMAIN}{uri} permanent + } + @news host news.{$DOMAIN} handle @news { reverse_proxy miniflux:8080 @@ -39,6 +44,11 @@ reverse_proxy webserver-nextcloud:80 } + @oldcloud host nextcloud.{$DOMAIN} owncloud.{$DOMAIN} + handle @oldcloud { + redir https://cloud.{$DOMAIN}{uri} permanent + } + @office host office.{$DOMAIN} handle @office { reverse_proxy collabora:9980 @@ -93,5 +103,5 @@ } {$DOMAIN} { - redir https://www.{$DOMAIN}{uri} + redir https://www.{$DOMAIN}{uri} permanent } From b6bda21a1fb07bf6b7033bcec9b5ccdc7fe707bc Mon Sep 17 00:00:00 2001 From: Florian Zirker Date: Wed, 12 Feb 2025 13:09:27 +0100 Subject: [PATCH 11/12] Add missing proxy conf for Firefoxsync --- proxy/caddy/Caddyfile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/proxy/caddy/Caddyfile b/proxy/caddy/Caddyfile index a1e9b11..42c0d2c 100644 --- a/proxy/caddy/Caddyfile +++ b/proxy/caddy/Caddyfile @@ -82,6 +82,11 @@ } } + @ffsync host firefoxsync.{$DOMAIN} + handle @ffsync { + reverse_proxy syncserver:5000 + } + @mail host mail.{$DOMAIN} handle @mail { reverse_proxy nginx-mailcow:8090 From fcecb7aaf85e4cc889102790f861850483ecd983 Mon Sep 17 00:00:00 2001 From: Florian Zirker Date: Fri, 28 Mar 2025 08:54:15 +0100 Subject: [PATCH 12/12] Jitsi Meet --- proxy/caddy/Caddyfile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/proxy/caddy/Caddyfile b/proxy/caddy/Caddyfile index 42c0d2c..8b286cf 100644 --- a/proxy/caddy/Caddyfile +++ b/proxy/caddy/Caddyfile @@ -92,6 +92,11 @@ reverse_proxy nginx-mailcow:8090 } + @meet host meet.{$DOMAIN} + handle @meet { + reverse_proxy jitsi-meet-web:80 + } + # Fallback unhandled (sub)domains handle { error 404