docs: list contributors in the readme

.env.sample

@@ -110,11 +110,11 @@ WRITE_TIMEOUT=0s
 
 # Set wildcards = 1, and uncomment compose_file to enable.
 # Create your certs elsewhere and add them like:
-# abra app secret insert traefik.example.coop ssl_cert v1 -f /path/to/fullchain.pem
+# abra app secret insert {myapp.example.coop} ssl_cert v1 "$(cat /path/to/fullchain.pem)"
-# abra app secret insert traefik.example.coop ssl_key v1 -f /path/to/privkey.pem
+# abra app secret insert {myapp.example.coop} ssl_key v1 "$(cat /path/to/privkey.pem)"
 #WILDCARDS_ENABLED=1
-#SECRET_WILDCARD_CERT_VERSION=v1 # generate=false
+#SECRET_WILDCARD_CERT_VERSION=v1
-#SECRET_WILDCARD_KEY_VERSION=v1 # generate=false
+#SECRET_WILDCARD_KEY_VERSION=v1
 #COMPOSE_FILE="$COMPOSE_FILE:compose.wildcard.yml"
 
 #####################################################################
@@ -139,14 +139,10 @@ WRITE_TIMEOUT=0s
 #####################################################################
 
 ## Enable prometheus metrics collection
-## Metrics are served unauthenticated on :8082, reachable only from
+## used used by the coop-cloud monitoring stack
-## other services on the proxy network (e.g. monitoring-ng's Alloy,
+## BASIC_AUTH should also be enabled
-## which auto-discovers it via the prometheus.io/scrape label)
 #COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
 #METRICS_ENABLED=1
-
-## Setting METRICS_FQDN also adds a public metrics endpoint (behind
-## basic auth). BASIC_AUTH should be enabled for this.
 #METRICS_FQDN=metrics.traefik.example.com
 
 #####################################################################
@@ -215,8 +211,6 @@ WRITE_TIMEOUT=0s
 ## Garage
 #COMPOSE_FILE="$COMPOSE_FILE:compose.garage.yml"
 #GARAGE_RPC_ENABLED=1
-#COMPOSE_FILE="$COMPOSE_FILE:compose.garage-admin.yml"
-#GARAGE_ADMIN_ENABLED=1
 
 ## Nextcloud Talk HPB
 #COMPOSE_FILE="$COMPOSE_FILE:compose.nextcloud-talk-hpb.yml"
@@ -241,11 +235,3 @@ WRITE_TIMEOUT=0s
 
 ## Access logs
 #COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
-
-## Behind a reverse proxy
-#
-# YAML array of subnets from which Traefik's trusts the x-real-ip
-# header when behind a reverse proxy.
-#
-# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
-#TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example

.gitea/CODEOWNERS

@@ -1 +0,0 @@
-* @coop-cloud/traefik-maintainers

MAINTENANCE.md

@@ -3,6 +3,20 @@
 All contributions should be made via a pull request. This is to ensure a
 certain quality and consistency, that others can rely on.
 
+## Roles
+
+We differentiate between two roles:
+
+- **Maintainers** take responsibility for the recipe. They are listed in the
+  [README.md](./README.md), are members of the
+  [traefik maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/traefik-maintainers)
+  and fulfil the responsibilities described below.
+- **Contributors with merge access** Trusted people can open pull requests and merge them
+  themselves in the cases described in [Pull Requests](#pull-requests).
+  They are listed in the [README.md](./README.md).
+
+Being allowed to merge a pull request does not make somebody a maintainer.
+
 ## Maintainer Responsibilities
 
 A recipe maintainer has the following responsibilities:
@@ -11,22 +25,74 @@ A recipe maintainer has the following responsibilities:
 - Make image security updates within a week
 - Make image major updates every three months
 
-In order to fullfill these responsibilities a recipe maintainer:
+In order to fulfill these responsibilities a recipe maintainer:
 
 - Has to watch the repository (to get notifications)
 - Needs to make sure renovate is configured properly
 
 ## Pull Requests
 
-A pull request can be merged if it is approved by at least one maintainer. For
+As a rule, a pull request can be merged once it has been approved by at least
-pull requests opened by a maintainer they need to be approved by another
+one maintainer other than its author. The exceptions below exist so that
-maintainer. Even though it is okay to merge a pull request with one approval, it
+security fixes and routine updates don't get stuck waiting for a review.
-is always better if all maintainers looked at the pull request and approved it.
+
+| Type of change | Approval needed |
+| --- | --- |
+| Security fix | No, can be merged immediately |
+| Regular update | No, after a review window of about one week |
+| Feature, extension or change of the default configuration | Yes, always |
+| Small change that can't break the recipe | No |
+
+### Security fixes
+
+If a pull request contains a relevant security fix, the person who opened it is
+allowed to merge it directly, without approval and without waiting.
+
+The same applies to a pull request that fixes an update which contains a
+security fix: if a version bump can't be merged as it is, because the new
+version needs changes to the configuration, then the pull request that
+makes that update work can be merged directly as well. Otherwise a broken
+update would block a security fix.
+
+Keep these pull requests as small as possible, so they contain nothing but what
+is needed to get the fix out.
+
+### Regular updates
+
+If a pull request rolls out a regular update, there is a time window of about
+one week for other maintainers to review it and to request changes. If no other
+maintainer is available within this time window, the person who opened it is
+allowed to merge it without approval.
+
+### Features, extensions and default configuration
+
+Any pull request that adds a feature or an extension, or changes the default
+configuration, needs an approval, no matter who opened it. These are the
+changes most likely to break existing deployments.
+
+### Small changes
+
+Small changes that definitely won't break the recipe can be merged without
+approval, for example:
+
+- a new environment variable that is commented out by default
+- a new `abra.sh` function
+- changes to the [README.md](./README.md)
+- writing new tests
+- configuring renovate
+
+If a pull request falls into more than one of these categories, the stricter
+rule applies. If you are unsure which category a pull request belongs to, ask
+for an approval.
+
+Even though it is okay to merge a pull request with a single approval, it is
+always better if all maintainers looked at the pull request and approved it.
 
 ## Become a maintainer
 
 Everyone can apply to be a recipe maintainer:
+
 1. Watch the repository to always get updates
 2. Simply add your self to the list in the [README.md](./README.md) and open a new pull request with the change.
 3. Once the pull request gets merged you will be added to the [traefik maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/traefik-maintainers).
-4. Join the room [#cc-|-traefik-maintenance:matrix.org](#cc-|-traefik-maintenance:matrix.org) and chat to other maintainers.
+4. Join the room [#cc-|-traefik-maintenance:matrix.org](https://matrix.to/#/%23cc-%7C-traefik-maintenance:matrix.org) and chat to other maintainers.

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v36
+export TRAEFIK_YML_VERSION=v33
-export FILE_PROVIDER_YML_VERSION=v13
+export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1

compose.garage-admin.yml

@@ -1,10 +0,0 @@
-version: "3.8"
-services:
-  app:
-    environment:
-      - GARAGE_ADMIN_ENABLED
-    ports:
-      - target: 3903
-        published: 3903
-        protocol: tcp
-        mode: host

compose.metrics.yml

@@ -3,9 +3,3 @@ services:
   app:
     environment:
       - METRICS_ENABLED
-    deploy:
-      labels:
-        # lets monitoring-ng's Alloy auto-discover and scrape metrics-internal
-        # via the proxy network.
-        - "prometheus.io/scrape=true"
-        - "prometheus.io/port=8082"

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v3.7.14"
+    image: "traefik:v3.7.10"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
@@ -57,12 +57,12 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.service=api@internal"
         - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=6.4.0+v3.7.14"
+        - "coop-cloud.${STACK_NAME}.version=6.1.0+v3.7.10"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.4.6
+    image: lscr.io/linuxserver/socket-proxy:3.4.3
     deploy:
       endpoint_mode: dnsrr
     environment:

file-provider.yml.tmpl

@@ -32,7 +32,6 @@ http:
         stsSeconds: "31536000"
   {{ if eq (env "METRICS_ENABLED") "1" }}
   routers:
-    {{ if ne (env "METRICS_FQDN") "" }}
     traefik-metrics:
       rule: "Host(`{{ env "METRICS_FQDN" }}`)"
       entrypoints:
@@ -43,14 +42,6 @@ http:
         - basicauth@file
       service: prometheus@internal
   {{ end }}
-    # reachable from other services on the proxy network only (this port
-    # isn't published to the host), without auth
-    traefik-metrics-internal:
-      rule: "PathPrefix(`/`)"
-      entrypoints:
-        - metrics-internal
-      service: prometheus@internal
-  {{ end }}
 
 tls:
   options:

release/6.2.0+v3.7.12

@@ -1 +0,0 @@
-1. compose.metrics.yml now adds prometheus.io/scrape labels so services like monitoring-ng can automatically discover and scrape Traefik's metrics.

release/6.3.0+v3.7.13

@@ -1 +0,0 @@
-open port 3903 for garage and traefik security update

release/6.4.0+v3.7.14

@@ -1 +0,0 @@
-Security Update

traefik.yml.tmpl

@@ -48,10 +48,6 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
-{{ if ne (env "TRUSTED_IPS") "" }}
-    forwardedHeaders:
-      trustedIPs: {{ env "TRUSTED_IPS" }}
-{{ end }}
     transport:
       respondingTimeouts:
         readTimeout: {{ env "READ_TIMEOUT" }}
@@ -79,10 +75,6 @@ entrypoints:
   garage-rpc:
     address: ":3901"
   {{- end }}
-  {{- if eq (env "GARAGE_ADMIN_ENABLED") "1" }}
-  garage-admin:
-    address: ":3903"
-  {{- end }}
   {{- if eq (env "FOODSOFT_SMTP_ENABLED") "1" }}
   foodsoft-smtp:
     address: ":2525"
@@ -135,10 +127,6 @@ entrypoints:
   onion:
     address: ":9052"
   {{- end }}
-  {{- if eq (env "METRICS_ENABLED") "1" }}
-  metrics-internal:
-    address: ":8082"
-  {{- end }}
 
 ping:
   entryPoint: web