fix: labels

This implements the high performance backend for Nextcloud Talk, which is nessecary if it needs to handle more people (video) calling.
More Details about it: https://nextcloud-talk.readthedocs.io/en/latest/quick-install/

The current implementation is sadly limited to be used once per host, so this might need some additional love in the future, if someone needs it more flexible.

The related Nextcloud PR: coop-cloud/nextcloud#56

Co-authored-by: Apfelwurm <Alexander@volzit.de>
Reviewed-on: #66
Co-authored-by: p4u1 <p4u1_f4u1@riseup.net>
Co-committed-by: p4u1 <p4u1_f4u1@riseup.net>

.drone.yml

@@ -16,7 +16,7 @@ steps:
       STACK_NAME: traefik
       LETS_ENCRYPT_ENV: production
       LETS_ENCRYPT_EMAIL: helo@autonomic.zone
-      TRAEFIK_YML_VERSION: v22
+      TRAEFIK_YML_VERSION: v26
       FILE_PROVIDER_YML_VERSION: v10
       ENTRYPOINT_VERSION: v4
 trigger:

.env.sample

@@ -131,6 +131,10 @@ COMPOSE_FILE="compose.yml"
 # COMPOSE_FILE="$COMPOSE_FILE:compose.gitea.yml"
 # GITEA_SSH_ENABLED=1
 
+## P2Panda UDP
+# COMPOSE_FILE="$COMPOSE_FILE:compose.p2panda.yml"
+# P2PANDA_ENABLED=1
+
 ## Foodsoft SMTP
 # COMPOSE_FILE="$COMPOSE_FILE:compose.foodsoft.yml"
 # FOODSOFT_SMTP_ENABLED=1
@@ -166,4 +170,14 @@ COMPOSE_FILE="compose.yml"
 
 ## Garage
 #COMPOSE_FILE="$COMPOSE_FILE:compose.garage.yml"
-#GARAGE_RPC_ENABLED=1
+#GARAGE_RPC_ENABLED=1
+
+## Nextcloud Talk HPB
+#COMPOSE_FILE="$COMPOSE_FILE:compose.nextcloud-talk-hpb.yml"
+#NEXTCLOUD_TALK_HPB_ENABLED=1
+
+## Anubis
+#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis.yml"
+#ANUBIS_COOKIE_DOMAIN=example.com
+#ANUBIS_DOMAIN=anubis.example.com
+#ANUBIS_REDIRECT_DOMAINS=

MAINTENANCE.md

@@ -0,0 +1,24 @@
+# Traefik Recipe Maintenance
+
+All contributions should be made via a pull request. This is to ensure a certain quality / consistency, that others can rely on.
+
+
+## Maintainer Responsibilities
+
+A recipe maintainer has the following responsibilities:
+- respond to pull requests / issues within a week
+- make image security updates within a day
+- make image patch / minor updates within a week
+- make image major updates within a month
+
+In order to fullfill these responsibilities a recipe maintainer:
+- has to watch the repository (to get notifications)
+- needs to make sure renovate is configured properly
+
+## Merge rules
+
+A pull request can be merged if it is approved by at least one maintainer. For pull requests opened by a maintainer they need to be approved by another maintainer.
+
+## Becoming a maintainer
+
+Everyone can apply to be a recipe maintainer. Simply add your self to the list in the [README.md](./README.md) and open a new pull request with the change.

README.md

@@ -5,8 +5,10 @@
 > https://docs.traefik.io
 
 <!-- metadata -->
+* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1)
+* **Status**: `stable`
 * **Category**: Utilities
-* **Status**: ?
+* **Features**: ?
 * **Image**: [`traefik`](https://hub.docker.com/_/traefik), 4, upstream
 * **Healthcheck**: Yes
 * **Backups**: No

abra.sh

@@ -1,3 +1,3 @@
-export TRAEFIK_YML_VERSION=v25
+export TRAEFIK_YML_VERSION=v28
 export FILE_PROVIDER_YML_VERSION=v10
 export ENTRYPOINT_VERSION=v5

compose.anubis.yml

@@ -0,0 +1,25 @@
+---
+version: "3.8"
+services:
+  app:
+    deploy:
+      labels:
+      - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
+  anubis:
+    image: "ghcr.io/techarohq/anubis:v1.24.0"
+    environment:
+      BIND: ":8080"
+      TARGET: " "
+      REDIRECT_DOMAINS: "${ANUBIS_REDIRECT_DOMAINS}"
+      COOKIE_DOMAIN: "${ANUBIS_COOKIE_DOMAIN}"
+      PUBLIC_URL: "https://${ANUBIS_DOMAIN}"
+    networks:
+    - internal
+    deploy:
+      labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.anubis.rule=Host(`${ANUBIS_DOMAIN}`)"
+      - "traefik.http.routers.anubis.tls.certresolver=${LETS_ENCRYPT_ENV}"
+      - "traefik.http.routers.anubis.entrypoints=web-secure"
+      - "traefik.http.services.anubis.loadbalancer.server.port=8080"
+      - "traefik.http.routers.anubis.service=anubis"

compose.nextcloud-talk-hpb.yml

@@ -0,0 +1,8 @@
+version: "3.8"
+services:
+  app:
+    environment:
+      - NEXTCLOUD_TALK_HPB_ENABLED
+    ports:
+      - "3478:3478/udp"
+      - "3478:3478/tcp"

compose.p2panda.yml

@@ -0,0 +1,14 @@
+version: "3.8"
+services:
+  app:
+    environment:
+      - P2PANDA_ENABLED
+    ports:
+      - target: 2022
+        published: 2022
+        protocol: udp
+        mode: host
+      - target: 2023
+        published: 2023
+        protocol: udp
+        mode: host

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v3.6.2"
+    image: "traefik:v3.6.5"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
@@ -48,12 +48,12 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.service=api@internal"
         - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=3.7.0+v3.6.2"
+        - "coop-cloud.${STACK_NAME}.version=3.9.0+v3.6.5"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.2.8-r0-ls61
+    image: lscr.io/linuxserver/socket-proxy:3.2.10-r0-ls65
     deploy:
       endpoint_mode: dnsrr
     environment:

renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}

traefik.yml.tmpl

@@ -1,7 +1,7 @@
 ---
 core:
   defaultRuleSyntax: v2
- 
+
 log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
@@ -33,10 +33,25 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
+    http:
+      encodedCharacters:
+        allowEncodedSlash: true
+        allowEncodedBackSlash: true
+        allowEncodedNullCharacter: true
+        allowEncodedSemicolon: true
+        allowEncodedPercent: true
+        allowEncodedQuestionMark: true
+        allowEncodedHash: true
   {{ if eq (env "GITEA_SSH_ENABLED") "1" }}
   gitea-ssh:
     address: ":2222"
   {{ end }}
+  {{ if eq (env "P2PANDA_ENABLED") "1" }}
+  p2panda-udp-v4:
+    address: ":2022/udp"
+  p2panda-udp-v6:
+    address: ":2023/udp"
+  {{ end }}
   {{ if eq (env "GARAGE_RPC_ENABLED") "1" }}
   garage-rpc:
     address: ":3901"
@@ -90,6 +105,12 @@ entrypoints:
   matrix-federation:
     address: ":9001"
   {{ end }}
+  {{ if eq (env "NEXTCLOUD_TALK_HPB_ENABLED") "1" }}
+  nextcloud-talk-hpb:
+    address: ":3478"
+  nextcloud-talk-hpb-udp:
+    address: ":3478/udp"
+  {{ end }}
 
 ping:
   entryPoint: web