Compare commits
52 Commits
67867f24af
...
e76d61be00
Author | SHA1 | Date |
---|---|---|
3wc | e76d61be00 | |
3wc | daec338066 | |
3wc | e92e76ac88 | |
3wc | 70d10587bc | |
3wc | bdf84fcefd | |
3wc | 2db2f71a80 | |
3wc | c558e1dbdb | |
3wc | edc29f9594 | |
3wc | f7f77dc942 | |
p4u1 | ecc12b2b68 | |
decentral1se | a0e70f33be | |
Chris (wolcen) Thompson | e3c1df83fa | |
Chris (wolcen) Thompson | 998190f684 | |
Chris (wolcen) Thompson | cd92c909ba | |
Chris (wolcen) Thompson | 64351c27d1 | |
Chris (wolcen) Thompson | f4b05fd87f | |
Chris (wolcen) Thompson | 3c5333ba71 | |
3wc | 5f2fd0bf37 | |
3wc | ac3a47fe8c | |
Philipp Rothmann | 1e02f358ed | |
Philipp Rothmann | 6cdcc25384 | |
Philipp Rothmann | d2b7b671f5 | |
Philipp Rothmann | c9d80df34d | |
Philipp Rothmann | aaa34c1ea8 | |
Philipp Rothmann | 6dee438492 | |
Philipp Rothmann | ff668b2266 | |
Philipp Rothmann | e2c16be2ff | |
3wc | 892f3c3124 | |
3wc | 4205f4911e | |
3wc | 13eb4a782d | |
decentral1se | b00a65a890 | |
Moritz | a213094d46 | |
Moritz | 8bb3adba81 | |
Moritz | a7bff09db6 | |
3wc | 6167d41588 | |
decentral1se | 31330d967b | |
decentral1se | f23357c9cd | |
3wc | b6bb286282 | |
3wc | 14a34c7b7f | |
3wc | 39bfdb4c82 | |
3wc | 1d43c68274 | |
Cassowary | f1cfb814dd | |
Philipp Rothmann | ece8807959 | |
3wc | a1e75e8c8b | |
3wordchant | b62cb273ef | |
javielico | 5f25a272cb | |
javielico | 4c7a272838 | |
3wc | 2e68186042 | |
3wc | 975d8e01a4 | |
trav | fcff3a2d6a | |
decentral1se | 981d2a3808 | |
Philipp Rothmann | 29eb1058cd |
24
.drone.yml
24
.drone.yml
|
@ -3,10 +3,12 @@ kind: pipeline
|
||||||
name: deploy to swarm-test.autonomic.zone
|
name: deploy to swarm-test.autonomic.zone
|
||||||
steps:
|
steps:
|
||||||
- name: deployment
|
- name: deployment
|
||||||
image: decentral1se/stack-ssh-deploy:latest
|
image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
|
||||||
settings:
|
settings:
|
||||||
host: swarm-test.autonomic.zone
|
host: swarm-test.autonomic.zone
|
||||||
stack: traefik
|
stack: traefik
|
||||||
|
networks:
|
||||||
|
- proxy
|
||||||
deploy_key:
|
deploy_key:
|
||||||
from_secret: drone_ssh_swarm_test
|
from_secret: drone_ssh_swarm_test
|
||||||
environment:
|
environment:
|
||||||
|
@ -14,19 +16,25 @@ steps:
|
||||||
STACK_NAME: traefik
|
STACK_NAME: traefik
|
||||||
LETS_ENCRYPT_ENV: production
|
LETS_ENCRYPT_ENV: production
|
||||||
LETS_ENCRYPT_EMAIL: helo@autonomic.zone
|
LETS_ENCRYPT_EMAIL: helo@autonomic.zone
|
||||||
TRAEFIK_YML_VERSION: v4
|
TRAEFIK_YML_VERSION: v5
|
||||||
FILE_PROVIDER_YML_VERSION: v3
|
FILE_PROVIDER_YML_VERSION: v4
|
||||||
ENTRYPOINT_VERSION: v1
|
ENTRYPOINT_VERSION: v1
|
||||||
trigger:
|
trigger:
|
||||||
branch:
|
branch:
|
||||||
- master
|
- master
|
||||||
---
|
---
|
||||||
kind: pipeline
|
kind: pipeline
|
||||||
name: recipe release
|
name: generate recipe catalogue
|
||||||
steps:
|
steps:
|
||||||
- name: release a new version
|
- name: release a new version
|
||||||
image: thecoopcloud/drone-abra:latest
|
image: plugins/downstream
|
||||||
settings:
|
settings:
|
||||||
command: recipe traefik release
|
server: https://build.coopcloud.tech
|
||||||
deploy_key:
|
token:
|
||||||
from_secret: abra_bot_deploy_key
|
from_secret: drone_abra-bot_token
|
||||||
|
fork: true
|
||||||
|
repositories:
|
||||||
|
- coop-cloud/auto-recipes-catalogue-json
|
||||||
|
|
||||||
|
trigger:
|
||||||
|
event: tag
|
||||||
|
|
37
.env.sample
37
.env.sample
|
@ -1,6 +1,8 @@
|
||||||
TYPE=traefik
|
TYPE=traefik
|
||||||
|
TIMEOUT=300
|
||||||
|
ENABLE_AUTO_UPDATE=true
|
||||||
|
|
||||||
DOMAIN={{ .Domain }}
|
DOMAIN=traefik.example.com
|
||||||
LETS_ENCRYPT_ENV=production
|
LETS_ENCRYPT_ENV=production
|
||||||
|
|
||||||
LETS_ENCRYPT_EMAIL=certs@example.com
|
LETS_ENCRYPT_EMAIL=certs@example.com
|
||||||
|
@ -50,7 +52,20 @@ COMPOSE_FILE="compose.yml"
|
||||||
#SECRET_DIGITALOCEAN_AUTH_TOKEN_VERSION=v1
|
#SECRET_DIGITALOCEAN_AUTH_TOKEN_VERSION=v1
|
||||||
|
|
||||||
#####################################################################
|
#####################################################################
|
||||||
# Keycloak log-in #
|
# Manual wildcard certificate insertion #
|
||||||
|
#####################################################################
|
||||||
|
|
||||||
|
# Set wildcards = 1, and uncomment compose_file to enable.
|
||||||
|
# Create your certs elsewhere and add them like:
|
||||||
|
# abra app secrets insert {myapp.example.coop} ssl_cert v1 "$(cat /path/to/fullchain.pem)"
|
||||||
|
# abra app secrets insert {myapp.example.coop} ssl_key v1 "$(cat /path/to/privkey.pem)"
|
||||||
|
#WILDCARDS_ENABLED=1
|
||||||
|
#SECRET_WILDCARD_CERT_VERSION=v1
|
||||||
|
#SECRET_WILDCARD_KEY_VERSION=v1
|
||||||
|
#COMPOSE_FILE="$COMPOSE_FILE:compose.wildcard.yml"
|
||||||
|
|
||||||
|
#####################################################################
|
||||||
|
# Authentication #
|
||||||
#####################################################################
|
#####################################################################
|
||||||
|
|
||||||
## Enable Keycloak
|
## Enable Keycloak
|
||||||
|
@ -60,14 +75,27 @@ COMPOSE_FILE="compose.yml"
|
||||||
#KEYCLOAK_MIDDLEWARE_2_ENABLED=1
|
#KEYCLOAK_MIDDLEWARE_2_ENABLED=1
|
||||||
#KEYCLOAK_TFA_SERVICE_2=traefik-forward-auth_app
|
#KEYCLOAK_TFA_SERVICE_2=traefik-forward-auth_app
|
||||||
|
|
||||||
|
## BASIC_AUTH
|
||||||
|
## Use httpasswd to generate the secret
|
||||||
|
#COMPOSE_FILE="$COMPOSE_FILE:compose.basicauth.yml"
|
||||||
|
#BASIC_AUTH=1
|
||||||
|
#SECRET_USERSFILE_VERSION=v1
|
||||||
|
|
||||||
#####################################################################
|
#####################################################################
|
||||||
# Prometheus metrics #
|
# Prometheus metrics #
|
||||||
#####################################################################
|
#####################################################################
|
||||||
|
|
||||||
## Enable prometheus metrics collection
|
## Enable prometheus metrics collection
|
||||||
## used used by the coop-cloud monitoring stack
|
## used used by the coop-cloud monitoring stack
|
||||||
|
#COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
|
||||||
#METRICS_ENABLED=1
|
#METRICS_ENABLED=1
|
||||||
|
|
||||||
|
#####################################################################
|
||||||
|
# File provider directory configuration #
|
||||||
|
# (Route bare metal and non-docker services on the machine!) #
|
||||||
|
#####################################################################
|
||||||
|
#FILE_PROVIDER_DIRECTORY_ENABLED=1
|
||||||
|
|
||||||
#####################################################################
|
#####################################################################
|
||||||
# Additional services #
|
# Additional services #
|
||||||
#####################################################################
|
#####################################################################
|
||||||
|
@ -107,3 +135,8 @@ COMPOSE_FILE="compose.yml"
|
||||||
## Matrix
|
## Matrix
|
||||||
#COMPOSE_FILE="$COMPOSE_FILE:compose.matrix.yml"
|
#COMPOSE_FILE="$COMPOSE_FILE:compose.matrix.yml"
|
||||||
#MATRIX_FEDERATION_ENABLED=1
|
#MATRIX_FEDERATION_ENABLED=1
|
||||||
|
|
||||||
|
## "Web alt", an alternative web port
|
||||||
|
# NOTE(3wc): as of 2024-04-01 only the `icecast` recipe uses this
|
||||||
|
#COMPOSE_FILE="$COMPOSE_FILE:compose.web-alt.yml"
|
||||||
|
#WEB_ALT_ENABLED=1
|
||||||
|
|
25
README.md
25
README.md
|
@ -19,8 +19,29 @@
|
||||||
|
|
||||||
1. Set up Docker Swarm and [`abra`]
|
1. Set up Docker Swarm and [`abra`]
|
||||||
2. `abra app new traefik`
|
2. `abra app new traefik`
|
||||||
3. `abra app YOURAPPDOMAIN config` - be sure to change `DOMAIN` to something that resolves to
|
3. `abra app config YOURAPPDOMAIN` - be sure to change `DOMAIN` to something that resolves to
|
||||||
your Docker swarm box
|
your Docker swarm box
|
||||||
4. `abra app YOURAPPDOMAIN deploy`
|
4. `abra app deploy YOURAPPDOMAIN`
|
||||||
|
|
||||||
|
## Configuring wildcard SSL using DNS
|
||||||
|
|
||||||
|
Automatic certificate generation will Just Work™ for most recipes which use a fixed
|
||||||
|
number of subdomains. For some recipes which need to work across arbitrary
|
||||||
|
subdomains, like
|
||||||
|
[`federatedwiki`](https://git.coopcloud.tech/coop-cloud/federatedwiki/) and
|
||||||
|
[`go-ssb-room`](https://git.coopcloud.tech/coop-cloud/federatedwiki/), you'll
|
||||||
|
need to give Traefik access to your DNS provider so that it can carry out
|
||||||
|
Letsencrypt DNS challenges.
|
||||||
|
|
||||||
|
1. Use Gandi or OVH for DNS 🤡 (support for other providers can be easily added,
|
||||||
|
see [the `lego` docs](https://go-acme.github.io/lego/dns/#dns-providers).
|
||||||
|
2. Run `abra app config YOURAPPDOMAIN`
|
||||||
|
3. Uncomment e.g. `ENABLE_GANDI` and the related `SECRET_.._VERSION` line, e.g.
|
||||||
|
`SECRET_GANDIV5_API_KEY_VERSION`
|
||||||
|
4. Generate an API key for your provider
|
||||||
|
5. Run `abra app secret insert YOURAPPDOMAIN SECRETNAME v1 SECRETVALUE`, where
|
||||||
|
`SECRETNAME` is from the compose file (e.g. `compose.gandi.yml`) e.g.
|
||||||
|
`gandiv5_api_key` and `SECRETVALUE` is the API key.
|
||||||
|
6. Redeploy Traefik, using e.g. `abra app deploy YOURAPPDOMAIN -f`
|
||||||
|
|
||||||
[`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
|
[`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
|
||||||
|
|
4
abra.sh
4
abra.sh
|
@ -1,3 +1,3 @@
|
||||||
export TRAEFIK_YML_VERSION=v15
|
export TRAEFIK_YML_VERSION=v20
|
||||||
export FILE_PROVIDER_YML_VERSION=v7
|
export FILE_PROVIDER_YML_VERSION=v10
|
||||||
export ENTRYPOINT_VERSION=v3
|
export ENTRYPOINT_VERSION=v3
|
||||||
|
|
|
@ -0,0 +1,12 @@
|
||||||
|
version: "3.8"
|
||||||
|
services:
|
||||||
|
app:
|
||||||
|
environment:
|
||||||
|
- BASIC_AUTH
|
||||||
|
secrets:
|
||||||
|
- usersfile
|
||||||
|
|
||||||
|
secrets:
|
||||||
|
usersfile:
|
||||||
|
name: ${STACK_NAME}_usersfile_${SECRET_USERSFILE_VERSION}
|
||||||
|
external: true
|
|
@ -10,5 +10,5 @@ services:
|
||||||
labels:
|
labels:
|
||||||
- "traefik.enable=true"
|
- "traefik.enable=true"
|
||||||
- "traefik.http.services.traefik.loadbalancer.server.port=web"
|
- "traefik.http.services.traefik.loadbalancer.server.port=web"
|
||||||
- "traefik.http.routers.traefik.entrypoints=web-secure"
|
- "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
|
||||||
- "traefik.http.routers.traefik.service=api@internal"
|
- "traefik.http.routers.${STACK_NAME}.service=api@internal"
|
||||||
|
|
|
@ -0,0 +1,9 @@
|
||||||
|
version: "3.8"
|
||||||
|
services:
|
||||||
|
app:
|
||||||
|
environment:
|
||||||
|
- METRICS_ENABLED
|
||||||
|
ports:
|
||||||
|
- target: 8082
|
||||||
|
published: 8082
|
||||||
|
mode: host
|
|
@ -0,0 +1,7 @@
|
||||||
|
version: "3.8"
|
||||||
|
services:
|
||||||
|
app:
|
||||||
|
environment:
|
||||||
|
- WEB_ALT_ENABLED
|
||||||
|
ports:
|
||||||
|
- "8000:8000"
|
|
@ -0,0 +1,16 @@
|
||||||
|
---
|
||||||
|
version: "3.8"
|
||||||
|
|
||||||
|
services:
|
||||||
|
app:
|
||||||
|
secrets:
|
||||||
|
- ssl_cert
|
||||||
|
- ssl_key
|
||||||
|
|
||||||
|
secrets:
|
||||||
|
ssl_cert:
|
||||||
|
name: ${STACK_NAME}_ssl_cert_${SECRET_WILDCARD_CERT_VERSION}
|
||||||
|
external: true
|
||||||
|
ssl_key:
|
||||||
|
name: ${STACK_NAME}_ssl_key_${SECRET_WILDCARD_KEY_VERSION}
|
||||||
|
external: true
|
20
compose.yml
20
compose.yml
|
@ -3,7 +3,7 @@ version: "3.8"
|
||||||
|
|
||||||
services:
|
services:
|
||||||
app:
|
app:
|
||||||
image: "traefik:v2.5.6"
|
image: "traefik:v2.11.0"
|
||||||
# Note(decentral1se): *please do not* add any additional ports here.
|
# Note(decentral1se): *please do not* add any additional ports here.
|
||||||
# Doing so could break new installs with port conflicts. Please use
|
# Doing so could break new installs with port conflicts. Please use
|
||||||
# the usual `compose.$app.yml` approach for any additional ports
|
# the usual `compose.$app.yml` approach for any additional ports
|
||||||
|
@ -13,6 +13,7 @@ services:
|
||||||
volumes:
|
volumes:
|
||||||
- "/var/run/docker.sock:/var/run/docker.sock"
|
- "/var/run/docker.sock:/var/run/docker.sock"
|
||||||
- "letsencrypt:/etc/letsencrypt"
|
- "letsencrypt:/etc/letsencrypt"
|
||||||
|
- "file-providers:/etc/traefik/file-providers"
|
||||||
configs:
|
configs:
|
||||||
- source: traefik_yml
|
- source: traefik_yml
|
||||||
target: /etc/traefik/traefik.yml
|
target: /etc/traefik/traefik.yml
|
||||||
|
@ -40,14 +41,14 @@ services:
|
||||||
order: start-first
|
order: start-first
|
||||||
labels:
|
labels:
|
||||||
- "traefik.enable=true"
|
- "traefik.enable=true"
|
||||||
- "traefik.http.services.traefik.loadbalancer.server.port=web"
|
- "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=web"
|
||||||
- "traefik.http.routers.traefik.rule=Host(`${DOMAIN}`)"
|
- "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
|
||||||
- "traefik.http.routers.traefik.entrypoints=web-secure"
|
- "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
|
||||||
- "traefik.http.routers.traefik.tls.certresolver=${LETS_ENCRYPT_ENV}"
|
- "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
|
||||||
- "traefik.http.routers.traefik.tls.options=default@file"
|
- "traefik.http.routers.${STACK_NAME}.service=api@internal"
|
||||||
- "traefik.http.routers.traefik.service=api@internal"
|
- "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
|
||||||
- "traefik.http.routers.traefik.middlewares=security@file"
|
- "coop-cloud.${STACK_NAME}.version=2.6.1+v2.11.0"
|
||||||
- "coop-cloud.${STACK_NAME}.version=1.0.1+v2.5.6"
|
- "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
|
||||||
|
|
||||||
networks:
|
networks:
|
||||||
proxy:
|
proxy:
|
||||||
|
@ -69,3 +70,4 @@ configs:
|
||||||
|
|
||||||
volumes:
|
volumes:
|
||||||
letsencrypt:
|
letsencrypt:
|
||||||
|
file-providers:
|
||||||
|
|
|
@ -17,10 +17,14 @@ http:
|
||||||
authResponseHeaders:
|
authResponseHeaders:
|
||||||
- X-Forwarded-User
|
- X-Forwarded-User
|
||||||
{{ end }}
|
{{ end }}
|
||||||
|
{{ if eq (env "BASIC_AUTH") "1" }}
|
||||||
|
basicauth:
|
||||||
|
basicAuth:
|
||||||
|
usersFile: "/run/secrets/usersfile"
|
||||||
|
{{ end }}
|
||||||
security:
|
security:
|
||||||
headers:
|
headers:
|
||||||
frameDeny: true
|
frameDeny: true
|
||||||
sslRedirect: true
|
|
||||||
browserXssFilter: true
|
browserXssFilter: true
|
||||||
contentTypeNosniff: true
|
contentTypeNosniff: true
|
||||||
stsIncludeSubdomains: true
|
stsIncludeSubdomains: true
|
||||||
|
@ -40,3 +44,8 @@ tls:
|
||||||
- CurveP521
|
- CurveP521
|
||||||
- CurveP384
|
- CurveP384
|
||||||
sniStrict: true
|
sniStrict: true
|
||||||
|
{{ if eq (env "WILDCARDS_ENABLED") "1" }}
|
||||||
|
certificates:
|
||||||
|
- certFile: /run/secrets/ssl_cert
|
||||||
|
keyFile: /run/secrets/ssl_key
|
||||||
|
{{ end }}
|
|
@ -8,8 +8,14 @@ providers:
|
||||||
exposedByDefault: false
|
exposedByDefault: false
|
||||||
network: proxy
|
network: proxy
|
||||||
swarmMode: true
|
swarmMode: true
|
||||||
|
{{ if eq (env "FILE_PROVIDER_DIRECTORY_ENABLED") "1" }}
|
||||||
|
file:
|
||||||
|
directory: /etc/traefik/file-providers
|
||||||
|
watch: true
|
||||||
|
{{ else }}
|
||||||
file:
|
file:
|
||||||
filename: /etc/traefik/file-provider.yml
|
filename: /etc/traefik/file-provider.yml
|
||||||
|
{{ end }}
|
||||||
|
|
||||||
api:
|
api:
|
||||||
dashboard: {{ env "DASHBOARD_ENABLED" }}
|
dashboard: {{ env "DASHBOARD_ENABLED" }}
|
||||||
|
@ -40,6 +46,10 @@ entrypoints:
|
||||||
peertube-rtmp:
|
peertube-rtmp:
|
||||||
address: ":1935"
|
address: ":1935"
|
||||||
{{ end }}
|
{{ end }}
|
||||||
|
{{ if eq (env "WEB_ALT_ENABLED") "1" }}
|
||||||
|
web-alt:
|
||||||
|
address: ":8000"
|
||||||
|
{{ end }}
|
||||||
{{ if eq (env "SSB_MUXRPC_ENABLED") "1" }}
|
{{ if eq (env "SSB_MUXRPC_ENABLED") "1" }}
|
||||||
ssb-muxrpc:
|
ssb-muxrpc:
|
||||||
address: ":8008"
|
address: ":8008"
|
||||||
|
@ -61,6 +71,9 @@ entrypoints:
|
||||||
{{ if eq (env "METRICS_ENABLED") "1" }}
|
{{ if eq (env "METRICS_ENABLED") "1" }}
|
||||||
metrics:
|
metrics:
|
||||||
address: ":8082"
|
address: ":8082"
|
||||||
|
http:
|
||||||
|
middlewares:
|
||||||
|
- basicauth@file
|
||||||
{{ end }}
|
{{ end }}
|
||||||
{{ if eq (env "MATRIX_FEDERATION_ENABLED") "1" }}
|
{{ if eq (env "MATRIX_FEDERATION_ENABLED") "1" }}
|
||||||
matrix-federation:
|
matrix-federation:
|
||||||
|
@ -74,6 +87,8 @@ ping:
|
||||||
metrics:
|
metrics:
|
||||||
prometheus:
|
prometheus:
|
||||||
entryPoint: metrics
|
entryPoint: metrics
|
||||||
|
addRoutersLabels: true
|
||||||
|
addServicesLabels: true
|
||||||
{{ end }}
|
{{ end }}
|
||||||
|
|
||||||
certificatesResolvers:
|
certificatesResolvers:
|
||||||
|
@ -102,5 +117,5 @@ certificatesResolvers:
|
||||||
provider: {{ (env "LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER") }}
|
provider: {{ (env "LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER") }}
|
||||||
resolvers:
|
resolvers:
|
||||||
- "1.1.1.1:53"
|
- "1.1.1.1:53"
|
||||||
- "8.8.8.8:53"
|
- "9.9.9.9:53"
|
||||||
{{ end }}
|
{{ end }}
|
||||||
|
|
Loading…
Reference in New Issue