docker-compose/stacks/traefik/docker-compose.yml at main · BornToBeRoot/docker-compose · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# Stack:       traefik
# Description: Traefik reverse proxy, load balancer and certificate manager.
# Author:      BornToBeRoot
# Version:     1.0.0
# Updated:     2024-05-11
# Source:      https://github.com/BornToBeRoot/docker-compose

services:
  traefik:
    image: "${TRAEFIK_IMAGE}"
    container_name: "traefik"
    restart: always
    security_opt:
      - no-new-privileges:true
    command:
      - "--log.level=${TRAEFIK_LOG_LEVEL}"
      - "--api=true"
      - "--api.dashboard=true"
      # File provider for static routes
      - "--providers.file.directory=/etc/traefik/rules"
      - "--providers.file.watch=true"
      # Docker provider for dynamic routes
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      # Verify connection to backend servers (if https is used in the backend)
      - "--serversTransport.insecureSkipVerify=false"
      # Web entrypoint
      - "--entrypoints.web.address=:80/tcp"
      # Websecure entrypoint
      - "--entrypoints.websecure.address=:443/tcp"
      # Redirect http to https
      ##- "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      ##- "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      ##- "--entrypoints.web.http.redirections.entrypoint.permanent=true"
      # Websecure middleware for HSTS, etc.
      - "--entrypoints.websecure.http.middlewares=secHeaders@file"
      # Forward IP headers (if Traefik is behind another reverse proxy) to get the real client IP
      ##- "--entryPoints.web.forwardedHeaders.trustedIPs=${TREAFIK_REVERSE_PROXY_TRUSTED_IPS}"
      ##- "--entryPoints.websecure.forwardedHeaders.trustedIPs=${TREAFIK_REVERSE_PROXY_TRUSTED_IPS}"
      # Letsecnrypt http challenge
      ##- "--certificatesresolvers.http.acme.httpchallenge=true"
      ##- "--certificatesresolvers.http.acme.httpchallenge.entrypoint=web"
      ##- "--certificatesresolvers.http.acme.email=${LETSENCRYPT_EMAIL}"
      ##- "--certificatesresolvers.http.acme.storage=/letsencrypt/acme_http.json"
      # Letsencrypt dns challenge
      ##- "--certificatesresolvers.dns.acme.dnschallenge=true"
      ##- "--certificatesresolvers.dns.acme.dnschallenge.provider=${LETSENCRYPT_DNS_PROVIDER}"
      ##- "--certificatesResolvers.dns.acme.dnschallenge.propagation.delayBeforeChecks=${LETSENCRYPT_DNS_DELAY}"
      ##- "--certificatesresolvers.dns.acme.dnschallenge.resolvers=${LETSENCRYPT_DNS_RESOLVER}"
      ##- "--certificatesresolvers.dns.acme.email=${LETSENCRYPT_EMAIL}"
      ##- "--certificatesresolvers.dns.acme.storage=/letsencrypt/acme_dns.json"
      # Letsencrypt wildcard certificate (requires dns challenge)
      ##- "--entrypoints.websecure.http.tls=true"
      ##- "--entrypoints.websecure.http.tls.certResolver=dns"
      ##- "--entrypoints.websecure.http.tls.domains[0].main=${LETSENCRYPT_WILDCARD_DOMAIN}"
      ##- "--entrypoints.websecure.http.tls.domains[0].sans=*.${LETSENCRYPT_WILDCARD_DOMAIN}"
    networks:
      - "traefik_proxy"
    ports:
      - "80:80/tcp"
      - "443:443/tcp"
    # Set DNS provider credentials for Letsencrypt dns challenge if needed (depends on provider)
    # See https://docs.traefik.io/https/acme/#providers for more information
    ##environment:
    ##  - YOUR_PROVIDER_USERNAME=${LETSENCRYPT_DNS_USERNAME}
    ##  - YOUR_PROVIDER_PASSWORD=${LETSENCRYPT_DNS_PASSWORD}
    volumes:
      - "/etc/localtime:/etc/localtime:ro"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./data/letsencrypt:/letsencrypt"
      - "./data/traefik/rules:/etc/traefik/rules"
    # Override default dns settings if needed (e.g. if you host Pi-hole on the same machine)
    ##dns:
    # Local is required in docker
    ##- 127.0.0.1
    # Gateway or public dns
    ##- 192.168.178.1
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_FQDN}`)"
      # HTTP configuration
      - "traefik.http.routers.traefik.entrypoints=web"
      # HTTPS configuration (conflicts with HTTP configuration)
      ##- "traefik.http.routers.traefik.entrypoints=websecure"
      ##- "traefik.http.routers.traefik.tls.certresolver=${TRAEFIK_TLS_CERT_RESOLVER}"
      ##- "traefik.http.routers.traefik.tls=true"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.middlewares=traefik-auth"
      - "traefik.http.services.traefik.loadbalancer.server.port=8080"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_USERNAME}:${TRAEFIK_PASSWORD}"
      # Use traefik proxy network
      - "traefik.docker.network=traefik_proxy"

networks:
  traefik_proxy:
    external: true