refactor: adjust local portbinding

.env.sample

@@ -232,6 +232,3 @@ WRITE_TIMEOUT=0s
 
 ## Enable onion service support
 #ONION_ENABLED=1
-
-## Access logs
-#COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"

MAINTENANCE.md

@@ -3,20 +3,6 @@
 All contributions should be made via a pull request. This is to ensure a
 certain quality and consistency, that others can rely on.
 
-## Roles
-
-We differentiate between two roles:
-
-- **Maintainers** take responsibility for the recipe. They are listed in the
-  [README.md](./README.md), are members of the
-  [traefik maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/traefik-maintainers)
-  and fulfil the responsibilities described below.
-- **Contributors with merge access** Trusted people can open pull requests and merge them
-  themselves in the cases described in [Pull Requests](#pull-requests).
-  They are listed in the [README.md](./README.md).
-
-Being allowed to merge a pull request does not make somebody a maintainer.
-
 ## Maintainer Responsibilities
 
 A recipe maintainer has the following responsibilities:
@@ -25,74 +11,21 @@ A recipe maintainer has the following responsibilities:
 - Make image security updates within a week
 - Make image major updates every three months
 
-In order to fulfill these responsibilities a recipe maintainer:
+In order to fullfill these responsibilities a recipe maintainer:
 
 - Has to watch the repository (to get notifications)
 - Needs to make sure renovate is configured properly
 
 ## Pull Requests
 
-As a rule, a pull request can be merged once it has been approved by at least
-one maintainer other than its author. The exceptions below exist so that
-security fixes and routine updates don't get stuck waiting for a review.
-
-| Type of change | Approval needed |
-| --- | --- |
-| Security fix | No, can be merged immediately |
-| Regular update | No, after a review window of about one week |
-| Feature, extension or change of the default configuration | Yes, always |
-| Small change that can't break the recipe | No |
-
-### Security fixes
-
-If a pull request contains a relevant security fix, the person who opened it is
-allowed to merge it directly, without approval and without waiting.
-
-The same applies to a pull request that fixes an update which contains a
-security fix: if a version bump can't be merged as it is, because the new
-version needs changes to the configuration, then the pull request that
-makes that update work can be merged directly as well. Otherwise a broken
-update would block a security fix.
-
-Keep these pull requests as small as possible, so they contain nothing but what
-is needed to get the fix out.
-
-### Regular updates
-
-If a pull request rolls out a regular update, there is a time window of about
-one week for other maintainers to review it and to request changes. If no other
-maintainer is available within this time window, the person who opened it is
-allowed to merge it without approval.
-
-### Features, extensions and default configuration
-
-Any pull request that adds a feature or an extension, or changes the default
-configuration, needs an approval, no matter who opened it. These are the
-changes most likely to break existing deployments.
-
-### Small changes
-
-Small changes that definitely won't break the recipe can be merged without
-approval, for example:
-
-- a new environment variable that is commented out by default
-- a new `abra.sh` function
-- changes to the [README.md](./README.md)
-- writing new tests
-- configuring renovate
-
-If a pull request falls into more than one of these categories, the stricter
-rule applies. If you are unsure which category a pull request belongs to, ask
-for an approval.
-
-Even though it is okay to merge a pull request with a single approval, it is
-always better if all maintainers looked at the pull request and approved it.
+A pull request can be merged if it is approved by at least one maintainer. For
+pull requests opened by a maintainer they need to be approved by another
+maintainer. Even though it is okay to merge a pull request with one approval, it
+is always better if all maintainers looked at the pull request and approved it.
 
 ## Become a maintainer
 
 Everyone can apply to be a recipe maintainer:
-
 1. Watch the repository to always get updates
 2. Simply add your self to the list in the [README.md](./README.md) and open a new pull request with the change.
 3. Once the pull request gets merged you will be added to the [traefik maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/traefik-maintainers).
-4. Join the room [#cc-|-traefik-maintenance:matrix.org](https://matrix.to/#/%23cc-%7C-traefik-maintenance:matrix.org) and chat to other maintainers.

README.md

@@ -80,19 +80,3 @@ If you want to collect Prometheus metrics for Anubis, for instance with
 Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).
 
 [`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
-
-## Access logs
-
-To keep access logs on a volume, uncomment the "Access logs" section.
-
-You'll need to setup rotation yourself and send the USR1 signal to
-Traefik for reloading.  For instance, with `logrotate:
-
-```
-# /etc/logrotate.d/traefik.conf
-/var/lib/docker/volumes/traefik_SERVICE_NAME_access-logs/_data/access_log.jsonl {
-  postrotate
-    pkill -USR1 traefik
-  endscript
-}
-```

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v33
-export FILE_PROVIDER_YML_VERSION=v12
-export ENTRYPOINT_VERSION=v5
-export ANUBIS_YML_VERSION=v1
+export TRAEFIK_YML_VERSION=v34
+export FILE_PROVIDER_YML_VERSION=v14
+export ENTRYPOINT_VERSION=v8
+export IOCAINE_ENTRYPOINT_VERSION=v1

compose.access-log.yml

@@ -1,10 +0,0 @@
----
-version: "3.8"
-services:
-  app:
-    environment:
-      ACCESS_LOG_ENABLED: "true"
-    volumes:
-      - "access-logs:/var/log/"
-volumes:
-  access-logs:

compose.iocaine.yml

@@ -0,0 +1,22 @@
+---
+version: "3.8"
+
+services:
+  app:
+    environment:
+      IOCAINE_ENABLE: "1"
+      IOCAINE_PLUGIN_VERSION: "v1.2.0"
+    volumes:
+      - "plugins-local:/plugins-local"
+
+  iocaine:
+    image: "git.madhouse-project.org/iocaine/iocaine:3.5.0"
+    environment:
+      RUST_LOG: "iocaine=info"
+    ports:
+      - "127.0.0.1:42069:42069"
+    networks:
+      - proxy
+
+volumes:
+  plugins-local:

compose.yml

@@ -27,6 +27,9 @@ services:
       - source: entrypoint
         target: /custom-entrypoint.sh
         mode: 0555
+      - source: iocaine_entrypoint
+        target: /entrypoint.iocaine.sh
+        mode: 0555
     networks:
       - proxy
       - internal
@@ -117,6 +120,10 @@ configs:
     name: ${STACK_NAME}_entrypoint_${ENTRYPOINT_VERSION}
     file: entrypoint.sh.tmpl
     template_driver: golang
+  iocaine_entrypoint:
+    name: ${STACK_NAME}_entrypoint_${IOCAINE_ENTRYPOINT_VERSION}
+    file: entrypoint.iocaine.sh.tmpl
+    template_driver: golang
 
 volumes:
   letsencrypt:

entrypoint.iocaine.sh.tmpl

@@ -0,0 +1,15 @@
+#!/bin/sh
+
+set -e
+
+apk --no-cache add git go
+iocaine_path="/plugins-local/src/git.mstar.dev/mstar/traefik-iocaine-middleware"
+if [ ! -d "$iocaine_path" ]; then
+  git clone --depth 1 --branch $IOCAINE_PLUGIN_VERSION https://git.mstar.dev/mstar/traefik-iocaine-middleware.git $iocaine_path
+else
+	git -C $iocaine_path fetch origin 'refs/tags/*:refs/tags/*'
+	git -C $iocaine_path checkout tags/$IOCAINE_PLUGIN_VERSION
+fi
+(cd $iocaine_path && go mod vendor)
+
+exit 0

entrypoint.sh.tmpl

@@ -15,4 +15,8 @@ export DO_AUTH_TOKEN=$(cat "$DO_AUTH_TOKEN_FILE")
 export AZURE_CLIENT_SECRET=$(cat "$AZURE_CLIENT_SECRET_FILE")
 {{ end }}
 
+{{ if eq (env "IOCAINE_ENABLE") "1" }}
+/entrypoint.iocaine.sh
+{{ end }}
+
 /entrypoint.sh "$@"

file-provider.yml.tmpl

@@ -17,6 +17,15 @@ http:
         authResponseHeaders:
           - X-Forwarded-User
     {{ end }}
+    {{ if eq (env "IOCAINE_ENABLE") "1" }}
+    iocaine:
+      plugin:
+        iocaine:
+          iocaineHttpUrl: "http://iocaine:42069"
+          methods:
+            - GET
+            - HEAD
+    {{ end }}
     {{ if eq (env "BASIC_AUTH") "1" }}
     basicauth:
       basicAuth:
@@ -61,4 +70,4 @@ tls:
   certificates:
     - certFile: /run/secrets/ssl_cert
       keyFile: /run/secrets/ssl_key
-  {{ end }}
+  {{ end }}

traefik.yml.tmpl

@@ -6,21 +6,6 @@ log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
 
-{{ if eq (env "ACCESS_LOG_ENABLED") "true" }}
-accessLog:
-  format: "json"
-  filePath: "/var/log/access_log.jsonl"
-  fields:
-    defaultMode: "keep"
-    headers:
-      defaultMode: "keep"
-      names:
-        Authorization: "drop"
-        Cookie: "drop"
-    queryParameters:
-      defaultMode: "keep"
-{{ end }}
-
 providers:
   swarm:
     endpoint: "tcp://socket-proxy:2375"
@@ -61,6 +46,10 @@ entrypoints:
         allowEncodedPercent: true
         allowEncodedQuestionMark: true
         allowEncodedHash: true
+			{{- if eq (env "IOCAINE_ENABLE") "1" }}
+      middlewares:
+        - iocaine@file
+			{{- end }}
   {{- if eq (env "GITEA_SSH_ENABLED") "1" }}
   gitea-ssh:
     address: ":2222"
@@ -172,3 +161,10 @@ certificatesResolvers:
           - "1.1.1.1:53"
           - "9.9.9.9:53"
       {{- end }}
+
+{{ if eq (env "IOCAINE_ENABLE") "1" }}
+experimental:
+  localPlugins:
+    iocaine:
+      moduleName: git.mstar.dev/mstar/traefik-iocaine-middleware
+{{ end }}