doc: trusted ips context

when traefik is behind a reverse proxy, we need to tell it which
networks to trust with x-real-ip headers

.env.sample

@@ -139,14 +139,10 @@ WRITE_TIMEOUT=0s
 #####################################################################
 
 ## Enable prometheus metrics collection
-## Metrics are served unauthenticated on :8082, reachable only from
+## used used by the coop-cloud monitoring stack
-## other services on the proxy network (e.g. monitoring-ng's Alloy,
+## BASIC_AUTH should also be enabled
-## which auto-discovers it via the prometheus.io/scrape label)
 #COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
 #METRICS_ENABLED=1
-
-## Setting METRICS_FQDN also adds a public metrics endpoint (behind
-## basic auth). BASIC_AUTH should be enabled for this.
 #METRICS_FQDN=metrics.traefik.example.com
 
 #####################################################################
@@ -215,8 +211,6 @@ WRITE_TIMEOUT=0s
 ## Garage
 #COMPOSE_FILE="$COMPOSE_FILE:compose.garage.yml"
 #GARAGE_RPC_ENABLED=1
-#COMPOSE_FILE="$COMPOSE_FILE:compose.garage-admin.yml"
-#GARAGE_ADMIN_ENABLED=1
 
 ## Nextcloud Talk HPB
 #COMPOSE_FILE="$COMPOSE_FILE:compose.nextcloud-talk-hpb.yml"

README.md

@@ -84,9 +84,6 @@ Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a n
 ## Access logs
 
 To keep access logs on a volume, uncomment the "Access logs" section.
-Logs will be kept for every app running, unless you opt-out of them.
-Apps supporting this will have an `ACCESS_LOGS` toggle, usually set to
-`false`, so they're already opt-in.
 
 You'll need to setup rotation yourself and send the USR1 signal to
 Traefik for reloading.  For instance, with `logrotate:

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v36
+export TRAEFIK_YML_VERSION=v34
-export FILE_PROVIDER_YML_VERSION=v13
+export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1

compose.garage-admin.yml

@@ -1,10 +0,0 @@
-version: "3.8"
-services:
-  app:
-    environment:
-      - GARAGE_ADMIN_ENABLED
-    ports:
-      - target: 3903
-        published: 3903
-        protocol: tcp
-        mode: host

compose.metrics.yml

@@ -3,9 +3,3 @@ services:
   app:
     environment:
       - METRICS_ENABLED
-    deploy:
-      labels:
-        # lets monitoring-ng's Alloy auto-discover and scrape metrics-internal
-        # via the proxy network.
-        - "prometheus.io/scrape=true"
-        - "prometheus.io/port=8082"

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v3.7.13"
+    image: "traefik:v3.7.10"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
@@ -57,12 +57,12 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.service=api@internal"
         - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=6.3.0+v3.7.13"
+        - "coop-cloud.${STACK_NAME}.version=6.1.0+v3.7.10"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.4.4
+    image: lscr.io/linuxserver/socket-proxy:3.4.3
     deploy:
       endpoint_mode: dnsrr
     environment:

file-provider.yml.tmpl

@@ -32,7 +32,6 @@ http:
         stsSeconds: "31536000"
   {{ if eq (env "METRICS_ENABLED") "1" }}
   routers:
-    {{ if ne (env "METRICS_FQDN") "" }}
     traefik-metrics:
       rule: "Host(`{{ env "METRICS_FQDN" }}`)"
       entrypoints:
@@ -42,14 +41,6 @@ http:
       middlewares:
         - basicauth@file
       service: prometheus@internal
-    {{ end }}
-    # reachable from other services on the proxy network only (this port
-    # isn't published to the host), without auth
-    traefik-metrics-internal:
-      rule: "PathPrefix(`/`)"
-      entrypoints:
-        - metrics-internal
-      service: prometheus@internal
   {{ end }}
 
 tls:

release/6.2.0+v3.7.12

@@ -1 +0,0 @@
-1. compose.metrics.yml now adds prometheus.io/scrape labels so services like monitoring-ng can automatically discover and scrape Traefik's metrics.

release/6.3.0+v3.7.13

@@ -1 +0,0 @@
-open port 3903 for garage and traefik security update

traefik.yml.tmpl

@@ -79,10 +79,6 @@ entrypoints:
   garage-rpc:
     address: ":3901"
   {{- end }}
-  {{- if eq (env "GARAGE_ADMIN_ENABLED") "1" }}
-  garage-admin:
-    address: ":3903"
-  {{- end }}
   {{- if eq (env "FOODSOFT_SMTP_ENABLED") "1" }}
   foodsoft-smtp:
     address: ":2525"
@@ -135,10 +131,6 @@ entrypoints:
   onion:
     address: ":9052"
   {{- end }}
-  {{- if eq (env "METRICS_ENABLED") "1" }}
-  metrics-internal:
-    address: ":8082"
-  {{- end }}
 
 ping:
   entryPoint: web