include anubis middleware address

.drone.yml

@@ -16,7 +16,7 @@ steps:
       STACK_NAME: traefik
       LETS_ENCRYPT_ENV: production
       LETS_ENCRYPT_EMAIL: helo@autonomic.zone
-      TRAEFIK_YML_VERSION: v26
+      TRAEFIK_YML_VERSION: v22
       FILE_PROVIDER_YML_VERSION: v10
       ENTRYPOINT_VERSION: v4
 trigger:

.env.sample

@@ -1,5 +1,5 @@
 TYPE=traefik
-#TIMEOUT=300
+TIMEOUT=300
 ENABLE_AUTO_UPDATE=true
 ENABLE_BACKUPS=true
 
@@ -19,14 +19,8 @@ COMPOSE_FILE="compose.yml"
 # General settings                                                  #
 #####################################################################
 
-## Ingress-mode port publishing for ports 80 and 443
+## Host-mode networking
-##
+#COMPOSE_FILE="$COMPOSE_FILE:compose.host.yml"
-## /!\ Using this prevents the use of any compose override adding
-##     published ports to the traefik_app service (almost all of them)
-##     and it prevents the use of IPv6 for ingress traffic.
-##     Do not uncomment unless you know exactly what you are doing
-##
-#COMPOSE_FILE="$COMPOSE_FILE:compose.no-host.yml"
 
 ## "Headless mode" (no domain configured)
 #COMPOSE_FILE="$COMPOSE_FILE:compose.headless.yml"
@@ -36,10 +30,8 @@ COMPOSE_FILE="compose.yml"
 #####################################################################
 
 ## Enable dns challenge (for wildcard domains)
-##   https://go-acme.github.io/lego/dns/#dns-providers
+##   https://doc.traefik.io/traefik/https/acme/#dnschallenge
 #LETS_ENCRYPT_DNS_CHALLENGE_ENABLED=1
-## *Currently* one of ovh, gandi, gandiv5, digitalocean, azure, porkbun.
-## Uncomment the corresponding provider below to insert your secret token/key.
 #LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER=ovh
 
 ## OVH, https://ovh.com
@@ -78,23 +70,6 @@ COMPOSE_FILE="compose.yml"
 #AZURE_RESOURCE_GROUP=
 #SECRET_AZURE_SECRET_VERSION=v1
 
-## Porkbun, https://porkbun.com
-## To insert your secrets:
-## abra app secret insert 1312.net pb_api_key v1 pk1_413
-## abra app secret insert 1312.net pb_s_api_key v1 sk1_612
-#COMPOSE_FILE="$COMPOSE_FILE:compose.porkbun.yml"
-#SECRET_PORKBUN_API_KEY_VERSION=v1
-#SECRET_PORKBUN_SECRET_API_KEY_VERSION=v1
-
-## Cloudflare, htps://cloudflare.com
-## To insert your secrets:
-## abra app secret insert {myapp.example.coop} cf_email v1 "<CLOUDFLARE_EMAIL>"
-## abra app secret insert {myapp.example.coop} cf_api_key v1 "<CLOUDFLARE_API_KEY>"
-## cf_api_key is an account API key from Cloudflare that has DNS read + edit permission
-#COMPOSE_FILE="$COMPOSE_FILE:compose.cloudflare.yml"
-#SECRET_CLOUDFLARE_EMAIL_VERSION=v1 # generate=false
-#SECRET_CLOUDFLARE_API_KEY_VERSION=v1 # generate=false
-
 #####################################################################
 # Manual wildcard certificate insertion                             #
 #####################################################################
@@ -131,10 +106,8 @@ COMPOSE_FILE="compose.yml"
 
 ## Enable prometheus metrics collection
 ## used used by the coop-cloud monitoring stack
-## BASIC_AUTH should also be enabled
 #COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
 #METRICS_ENABLED=1
-#METRICS_FQDN=metrics.traefik.example.com
 
 #####################################################################
 # File provider directory configuration                             #
@@ -158,10 +131,6 @@ COMPOSE_FILE="compose.yml"
 # COMPOSE_FILE="$COMPOSE_FILE:compose.gitea.yml"
 # GITEA_SSH_ENABLED=1
 
-## P2Panda UDP
-# COMPOSE_FILE="$COMPOSE_FILE:compose.p2panda.yml"
-# P2PANDA_ENABLED=1
-
 ## Foodsoft SMTP
 # COMPOSE_FILE="$COMPOSE_FILE:compose.foodsoft.yml"
 # FOODSOFT_SMTP_ENABLED=1
@@ -194,24 +163,3 @@ COMPOSE_FILE="compose.yml"
 ## Matrix
 #COMPOSE_FILE="$COMPOSE_FILE:compose.irc.yml"
 #IRC_ENABLED=1
-
-## Garage
-#COMPOSE_FILE="$COMPOSE_FILE:compose.garage.yml"
-#GARAGE_RPC_ENABLED=1
-
-## Nextcloud Talk HPB
-#COMPOSE_FILE="$COMPOSE_FILE:compose.nextcloud-talk-hpb.yml"
-#NEXTCLOUD_TALK_HPB_ENABLED=1
-
-## Anubis
-#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis.yml"
-#ANUBIS_COOKIE_DOMAIN=example.com
-#ANUBIS_DOMAIN=anubis.example.com
-#ANUBIS_REDIRECT_DOMAINS=
-#ANUBIS_OG_PASSTHROUGH=true
-#ANUBIS_OG_EXPIRY_TIME=1h
-#ANUBIS_OG_CACHE_CONSIDER_HOST=true
-#ANUBIS_SERVE_ROBOTS_TXT=true
-
-## Enable onion service support
-#ONION_ENABLED=1

.gitea/PULL_REQUEST_TEMPLATE.md

@@ -1,16 +0,0 @@
----
-name: "Traefik pull request template"
-about: "Traefik pull request template"
----
-
-<!-- 
-Thank you for doing recipe maintenance work!
-Please mark all checklist items which are relevant for your changes.
-Please remove the checklist items which are not relevant for your changes.
-Feel free to remove this comment.
--->
-
-* [ ] I have deployed and tested my changes
-* [ ] I have [updated relevant versions in `abra.sh`](https://docs.coopcloud.tech/maintainers/upgrade/#updating-versions-in-the-abrash)
-* [ ] I have made my environment variable changes [backwards compatible](https://docs.coopcloud.tech/maintainers/upgrade/#backwards-compatible-environment-variable-changes)
-* [ ] I have added a [release note entry](https://docs.coopcloud.tech/maintainers/upgrade/#creating-new-release-notes)

MAINTENANCE.md

@@ -1,31 +0,0 @@
-# Traefik Recipe Maintenance
-
-All contributions should be made via a pull request. This is to ensure a
-certain quality and consistency, that others can rely on.
-
-## Maintainer Responsibilities
-
-A recipe maintainer has the following responsibilities:
-
-- Respond to pull requests / issues within two weeks
-- Make image security updates within a week
-- Make image major updates every three months
-
-In order to fullfill these responsibilities a recipe maintainer:
-
-- Has to watch the repository (to get notifications)
-- Needs to make sure renovate is configured properly
-
-## Pull Requests
-
-A pull request can be merged if it is approved by at least one maintainer. For
-pull requests opened by a maintainer they need to be approved by another
-maintainer. Even though it is okay to merge a pull request with one approval, it
-is always better if all maintainers looked at the pull request and approved it.
-
-## Become a maintainer
-
-Everyone can apply to be a recipe maintainer:
-1. Watch the repository to always get updates
-2. Simply add your self to the list in the [README.md](./README.md) and open a new pull request with the change.
-3. Once the pull request gets merged you will be added to the [traefik maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/traefik-maintainers).

README.md

@@ -1,14 +1,12 @@
 # Traefik
 
-[![Build Status](https://build.coopcloud.tech/api/badges/coop-cloud/traefik/status.svg)](https://build.coopcloud.tech/coop-cloud/traefik)
+[![Build Status](https://drone.autonomic.zone/api/badges/coop-cloud/traefik/status.svg)](https://drone.autonomic.zone/coop-cloud/traefik)
 
 > https://docs.traefik.io
 
 <!-- metadata -->
-* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@decentral1se](https://git.coopcloud.tech/decentral1se), [@javielico](https://git.coopcloud.tech/javielico), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
-* **Status**: `stable`
 * **Category**: Utilities
-* **Features**: ?
+* **Status**: ?
 * **Image**: [`traefik`](https://hub.docker.com/_/traefik), 4, upstream
 * **Healthcheck**: Yes
 * **Backups**: No
@@ -25,13 +23,6 @@
    your Docker swarm box
 4. `abra app deploy YOURAPPDOMAIN`
 
-## Configuring basic auth
-
-1. Create the usersfile locally: `htpasswd -c usersfile <username>`
-2. Uncomment the Basic Auth section in your .env file
-3. Insert the secret: `abra app secret insert <domain> usersfile v1 -f usersfile
-4. Redploy your app: `abra app deploy -f <domain>`
-
 ## Configuring wildcard SSL using DNS
 
 Automatic certificate generation will Just Work™ for most recipes  which use a fixed
@@ -42,37 +33,17 @@ subdomains, like
 need to give Traefik access to your DNS provider so that it can carry out
 Letsencrypt DNS challenges.
 
-1. Use Gandi, OVH, DO, Azure, or PorkBun for DNS 🤡 (support for other providers
+1. Use Gandi or OVH for DNS 🤡 (support for other providers can be easily added,
-   can be easily added, see
+   see [the `lego` docs](https://go-acme.github.io/lego/dns/#dns-providers).
-   [the `lego` docs](https://go-acme.github.io/lego/dns/#dns-providers).
 2. Run `abra app config YOURAPPDOMAIN`
 3. Uncomment e.g. `ENABLE_GANDI` and the related `SECRET_.._VERSION` line, e.g.
    `SECRET_GANDIV5_API_KEY_VERSION`
-4. Set `LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER` to your provider, e.g. `gandi`
+4. Generate an API key for your provider
-4. Generate an API key for your provider, probably using their web interface.
 5. Run `abra app secret insert YOURAPPDOMAIN SECRETNAME v1 SECRETVALUE`, where
    `SECRETNAME` is from the compose file (e.g. `compose.gandi-api-key.yml`) e.g.
    `gandiv5_api_key` and `SECRETVALUE` is the API key.
    - For Gandi, you can use either the deprecated API Key or a GandiV5 Personal
      Access Token, in which case use compose.gandi-personal-access-token.yml.
-   - See comments for each provider in your env file for specific instructions
 6. Redeploy Traefik, using e.g. `abra app deploy YOURAPPDOMAIN -f`
 
-## Blocking scrapers with [Anubis](https://anubis.techaro.lol/)
-
-Uncomment the lines on the Anubis section of the configuration.  Set
-a domain name for the cookies and a domain that will serve Anubis
-redirection service.  Optionally and for [added
-security](https://anubis.techaro.lol/docs/admin/configuration/redirect-domains),
-set a list of the domain names for the apps that are going to be
-protected.
-
-After deploying these changes, go to each recipe that supports Anubis
-and follow the process there.  **Enabling Anubis here is not enough for
-protection your apps.**
-
-## Enabling onion service
-
-Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).
-
 [`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra

abra.sh

@@ -1,3 +1,3 @@
-export TRAEFIK_YML_VERSION=v31
+export TRAEFIK_YML_VERSION=v24
-export FILE_PROVIDER_YML_VERSION=v12
+export FILE_PROVIDER_YML_VERSION=v10
-export ENTRYPOINT_VERSION=v5
+export ENTRYPOINT_VERSION=v4

compose.anubis.yml

@@ -1,29 +1,7 @@
----
 version: "3.8"
+
 services:
   app:
     deploy:
       labels:
-      - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
+      - traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check
-  anubis:
-    image: "ghcr.io/techarohq/anubis:v1.25.0"
-    environment:
-      BIND: ":8080"
-      TARGET: " "
-      REDIRECT_DOMAINS: "${ANUBIS_REDIRECT_DOMAINS}"
-      COOKIE_DOMAIN: "${ANUBIS_COOKIE_DOMAIN}"
-      PUBLIC_URL: "https://${ANUBIS_DOMAIN}"
-      OG_PASSTHROUGH: "${ANUBIS_OG_PASSTHROUGH}"
-      OG_EXPIRY_TIME: "${ANUBIS_OG_EXPIRY_TIME}"
-      OG_CACHE_CONSIDER_HOST: "${ANUBIS_OG_CACHE_CONSIDER_HOST}"
-      SERVE_ROBOTS_TXT: "${ANUBIS_SERVE_ROBOTS_TXT}"
-    networks:
-    - proxy
-    deploy:
-      labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.anubis.rule=Host(`${ANUBIS_DOMAIN}`)"
-      - "traefik.http.routers.anubis.tls.certresolver=${LETS_ENCRYPT_ENV}"
-      - "traefik.http.routers.anubis.entrypoints=web-secure"
-      - "traefik.http.services.anubis.loadbalancer.server.port=8080"
-      - "traefik.http.routers.anubis.service=anubis"

compose.cloudflare.yml

@@ -1,18 +0,0 @@
-version: "3.8"
-
-services:
-  app:
-    environment:
-      - CLOUDFLARE_EMAIL_FILE=/run/secrets/cf_email
-      - CLOUDFLARE_API_KEY_FILE=/run/secrets/cf_api_key
-    secrets:
-      - cf_email
-      - cf_api_key
-  
-secrets:
-  cf_email:
-    name: ${STACK_NAME}_cf_email_${SECRET_CLOUDFLARE_EMAIL_VERSION}
-    external: true
-  cf_api_key:
-    name: ${STACK_NAME}_cf_api_key_${SECRET_CLOUDFLARE_API_KEY_VERSION}
-    external: true

compose.compy.yml

@@ -4,7 +4,4 @@ services:
     environment:
       - COMPY_ENABLED
     ports:
-      - target: 9999
+      - "9999:9999"
-        published: 9999
-        protocol: tcp
-        mode: host

compose.foodsoft.yml

@@ -4,7 +4,4 @@ services:
     environment:
       - FOODSOFT_SMTP_ENABLED
     ports:
-      - target: 2525
+      - "2525:2525"
-        published: 2525
-        protocol: tcp
-        mode: host

compose.garage.yml

@@ -1,10 +0,0 @@
-version: "3.8"
-services:
-  app:
-    environment:
-      - GARAGE_RPC_ENABLED
-    ports:
-      - target: 3901
-        published: 3901
-        protocol: tcp
-        mode: host

compose.gitea.yml

@@ -4,7 +4,4 @@ services:
     environment:
       - GITEA_SSH_ENABLED
     ports:
-      - target: 2222
+      - "2222:2222"
-        published: 2222
-        protocol: tcp
-        mode: host

compose.host.yml

@@ -1,2 +1,15 @@
 ---
 version: "3.8"
+
+services:
+  app:
+    deploy:
+      update_config:
+        order: stop-first
+    ports:
+      - target: 80
+        published: 80
+        mode: host
+      - target: 443
+        published: 443
+        mode: host

compose.irc.yml

@@ -4,7 +4,4 @@ services:
     environment:
       - IRC_ENABLED
     ports:
-      - target: 6697
+      - "6697:6697"
-        published: 6697
-        protocol: tcp
-        mode: host

compose.matrix.yml

@@ -4,7 +4,4 @@ services:
     environment:
       - MATRIX_FEDERATION_ENABLED
     ports:
-      - target: 8448
+      - "8448:8448"
-        published: 8448
-        protocol: tcp
-        mode: host

compose.metrics.yml

@@ -3,3 +3,7 @@ services:
   app:
     environment:
       - METRICS_ENABLED
+    ports:
+      - target: 8082
+        published: 8082
+        mode: host

compose.minio.yml

@@ -6,7 +6,4 @@ services:
     environment:
       - MINIO_CONSOLE_ENABLED
     ports:
-      - target: 9001
+      - "9001:9001"
-        published: 9001
-        protocol: tcp
-        mode: host

compose.mumble.yml

@@ -4,11 +4,6 @@ services:
     environment:
       - MUMBLE_ENABLED
     ports:
-      - target: 64738
+      - "64738:64738/udp"
-        published: 64738
+      # note (3wc): see https://github.com/docker/compose/issues/7627
-        protocol: udp
+      - "64737-64739:64737-64739/tcp"
-        mode: host
-      - target: 64738
-        published: 64738
-        protocol: tcp
-        mode: host

compose.nextcloud-talk-hpb.yml

@@ -1,14 +0,0 @@
-version: "3.8"
-services:
-  app:
-    environment:
-      - NEXTCLOUD_TALK_HPB_ENABLED
-    ports:
-      - target: 3478
-        published: 3478
-        protocol: udp
-        mode: host
-      - target: 3478
-        published: 3478
-        protocol: tcp
-        mode: host

compose.no-host.yml

@@ -1,16 +0,0 @@
----
-version: "3.8"
-
-services:
-  app:
-    ports:
-      - target: 80
-        published: 80
-        protocol: tcp
-        mode: ingress
-      - target: 443
-        published: 443
-        protocol: tcp
-        mode: ingress
-    deploy:
-      endpoint_mode: vip

compose.p2panda.yml

@@ -1,14 +0,0 @@
-version: "3.8"
-services:
-  app:
-    environment:
-      - P2PANDA_ENABLED
-    ports:
-      - target: 2022
-        published: 2022
-        protocol: udp
-        mode: host
-      - target: 2023
-        published: 2023
-        protocol: udp
-        mode: host

compose.peertube.yml

@@ -4,7 +4,4 @@ services:
     environment:
       - PEERTUBE_RTMP_ENABLED
     ports:
-      - target: 1935
+      - "1935:1935"
-        published: 1935
-        protocol: tcp
-        mode: host

compose.porkbun.yml

@@ -1,18 +0,0 @@
-version: "3.8"
-
-services:
-  app:
-    environment:
-      - PORKBUN_API_KEY_FILE=/run/secrets/pb_api_key
-      - PORKBUN_SECRET_API_KEY_FILE=/run/secrets/pb_s_api_key
-    secrets:
-      - pb_api_key
-      - pb_s_api_key
-
-secrets:
-  pb_api_key:
-    name: ${STACK_NAME}_pb_api_key_${SECRET_PORKBUN_API_KEY_VERSION}
-    external: true
-  pb_s_api_key:
-    name: ${STACK_NAME}_pb_s_api_key_${SECRET_PORKBUN_SECRET_API_KEY_VERSION}
-    external: true

compose.smtp.yml

@@ -6,7 +6,4 @@ services:
     environment:
       - SMTP_ENABLED
     ports:
-      - target: 587
+      - "587:587"
-        published: 587
-        protocol: tcp
-        mode: host

compose.ssb.yml

@@ -4,7 +4,4 @@ services:
     environment:
       - SSB_MUXRPC_ENABLED
     ports:
-      - target: 8008
+      - "8008:8008"
-        published: 8008
-        protocol: tcp
-        mode: host

compose.web-alt.yml

@@ -4,7 +4,4 @@ services:
     environment:
       - WEB_ALT_ENABLED
     ports:
-      - target: 8000
+      - "8000:8000"
-        published: 8000
-        protocol: tcp
-        mode: host

compose.yml

@@ -3,19 +3,13 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v3.6.15"
+    image: "traefik:v3.4.5"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
     ports:
-      - target: 80
+      - "80:80"
-        published: 80
+      - "443:443"
-        protocol: tcp
-        mode: host
-      - target: 443
-        published: 443
-        protocol: tcp
-        mode: host
     volumes:
       - "letsencrypt:/etc/letsencrypt"
       - "file-providers:/etc/traefik/file-providers"
@@ -43,10 +37,9 @@ services:
     command: traefik
     entrypoint: /custom-entrypoint.sh
     deploy:
-      endpoint_mode: dnsrr
       update_config:
         failure_action: rollback
-        order: stop-first
+        order: start-first
       labels:
         - "traefik.enable=true"
         - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=web"
@@ -55,12 +48,12 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.service=api@internal"
         - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=5.1.1+v3.6.15"
+        - "coop-cloud.${STACK_NAME}.version=3.5.0+v3.4.5"
-        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
+        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.2.19
+    image: lscr.io/linuxserver/socket-proxy:1.26.2-r0-ls30
     deploy:
       endpoint_mode: dnsrr
     environment:
@@ -79,8 +72,8 @@ services:
       - IMAGES=0
       - INFO=0
       - NETWORKS=1 # Needs access
-      - NODES=1
+      - NODES=0
-      - PING=1
+      - PING=0
       - POST=0
       - PLUGINS=0
       - SECRETS=0

file-provider.yml.tmpl

@@ -30,18 +30,6 @@ http:
         stsIncludeSubdomains: true
         stsPreload: true
         stsSeconds: "31536000"
-  {{ if eq (env "METRICS_ENABLED") "1" }}
-  routers:
-    traefik-metrics:
-      rule: "Host(`{{ env "METRICS_FQDN" }}`)"
-      entrypoints:
-        - web-secure
-      tls:
-        certResolver: {{ env "LETS_ENCRYPT_ENV" }}
-      middlewares:
-        - basicauth@file
-      service: prometheus@internal
-  {{ end }}
 
 tls:
   options:
@@ -55,7 +43,6 @@ tls:
       curvePreferences:
         - CurveP521
         - CurveP384
-        - CurveP256
       sniStrict: true
   {{ if eq (env "WILDCARDS_ENABLED") "1" }}
   certificates:

release/3.10.0+v3.6.7

@@ -1,10 +0,0 @@
-Short summary of the latest changes:
-
-* Traefik has been upgraded with a patch release, no issues expected.
-* "CurveP256" has been included to the TLS options.
-* The default TIMEOUT value has been removed from the label directly.
-* Anubis support is here, try out `compose.anubis.yml` and see the README.md for more.
-* Onion services with Tor are not supported! See the README.md for more.
-* There are now officially 3 recipe maintainers for Traefik!
-
-All changes: https://git.coopcloud.tech/coop-cloud/traefik/compare/3.9.0+v3.6.5...master

release/4.0.0+v3.6.10

@@ -1,11 +0,0 @@
-Short summary of the latest changes:
-
- * Exposed ports have been switched to host-mode port publishing by default
-   This adds support for IPv6 ingress, which means that after deploying this
-   change, DNS AAAA records can be made to point to the relevant IPv6
-   address and Traefik will handle public IPv6 ingress traffic (including ACME
-   HTTP-01 challenges)
-
-   /!\ This is a breaking change. It is still possible to revert ports 80 and
-       443 to ingress-mode (the previous default) but keep in mind that there
-       is no longer an easy way to publish additional ports in ingress mode.

release/5.0.0+v3.6.10

@@ -1,10 +0,0 @@
-/!\ BREAKING CHANGE: Change metrics endpoint to use https instead of http 8082
-                     to prevent sending BASIC_AUTH in plaintext
-
-The metrics endpoint changed from http on port 8082 to the web-secure
-endpoint to prevent sending BASIC_AUTH credentials plaintext. If metrics is
-enabled you need to configure a FQDN for it by setting METRICS_FQDN in your
-.env. You should also update the scrape config files in prometheus for
-Traefik metrics from port 8082 to the new FQDN.
-
-All changes: https://git.coopcloud.tech/coop-cloud/traefik/compare/5.0.0+v3.6.10...4.0.0+v3.6.10

release/5.1.0+v3.6.11

@@ -1 +0,0 @@
-Patched CVES: CVE-2026-32595 and CVE-2026-32305

renovate.json

@@ -1,6 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended"
-  ]
-}

traefik.yml.tmpl

@@ -1,7 +1,7 @@
 ---
 core:
   defaultRuleSyntax: v2
-
+ 
 log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
@@ -11,14 +11,14 @@ providers:
     endpoint: "tcp://socket-proxy:2375"
     exposedByDefault: false
     network: proxy
-  {{- if eq (env "FILE_PROVIDER_DIRECTORY_ENABLED") "1" }}
+  {{ if eq (env "FILE_PROVIDER_DIRECTORY_ENABLED") "1" }}
   file:
     directory: /etc/traefik/file-providers
     watch: true
-  {{- else }}
+  {{ else }}
   file:
     filename: /etc/traefik/file-provider.yml
-  {{- end }}
+  {{ end }}
 
 api:
   dashboard: {{ env "DASHBOARD_ENABLED" }}
@@ -33,93 +33,70 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
-    http:
+  {{ if eq (env "GITEA_SSH_ENABLED") "1" }}
-      encodedCharacters:
-        allowEncodedSlash: true
-        allowEncodedBackSlash: true
-        allowEncodedNullCharacter: true
-        allowEncodedSemicolon: true
-        allowEncodedPercent: true
-        allowEncodedQuestionMark: true
-        allowEncodedHash: true
-  {{- if eq (env "GITEA_SSH_ENABLED") "1" }}
   gitea-ssh:
     address: ":2222"
-  {{- end }}
+  {{ end }}
-  {{- if eq (env "P2PANDA_ENABLED") "1" }}
+  {{ if eq (env "FOODSOFT_SMTP_ENABLED") "1" }}
-  p2panda-udp-v4:
-    address: ":2022/udp"
-  p2panda-udp-v6:
-    address: ":2023/udp"
-  {{- end }}
-  {{- if eq (env "GARAGE_RPC_ENABLED") "1" }}
-  garage-rpc:
-    address: ":3901"
-  {{- end }}
-  {{- if eq (env "FOODSOFT_SMTP_ENABLED") "1" }}
   foodsoft-smtp:
     address: ":2525"
-  {{- end }}
+  {{ end }}
-  {{- if eq (env "SMTP_ENABLED") "1" }}
+  {{ if eq (env "SMTP_ENABLED") "1" }}
   smtp-submission:
     address: ":587"
-  {{- end }}
+  {{ end }}
-  {{- if eq (env "PEERTUBE_RTMP_ENABLED") "1" }}
+  {{ if eq (env "PEERTUBE_RTMP_ENABLED") "1" }}
   peertube-rtmp:
     address: ":1935"
-  {{- end }}
+  {{ end }}
-  {{- if eq (env "WEB_ALT_ENABLED") "1" }}
+  {{ if eq (env "WEB_ALT_ENABLED") "1" }}
   web-alt:
     address: ":8000"
-  {{- end }}
+  {{ end }}
-  {{- if eq (env "SSB_MUXRPC_ENABLED") "1" }}
+  {{ if eq (env "SSB_MUXRPC_ENABLED") "1" }}
   ssb-muxrpc:
     address: ":8008"
-  {{- end }}
+  {{ end }}
-  {{- if eq (env "MSSQL_ENABLED") "1" }}
+  {{ if eq (env "MSSQL_ENABLED") "1" }}
   mssql:
     address: ":1433"
-  {{- end }}
+  {{ end }}
-  {{- if eq (env "MUMBLE_ENABLED") "1" }}
+  {{ if eq (env "MUMBLE_ENABLED") "1" }}
   mumble:
     address: ":64738"
   mumble-udp:
     address: ":64738/udp"
-  {{- end }}
+  {{ end }}
-  {{- if eq (env "COMPY_ENABLED") "1" }}
+  {{ if eq (env "COMPY_ENABLED") "1" }}
   compy:
     address: ":9999"
-  {{- end }}
+  {{ end }}
-  {{- if eq (env "IRC_ENABLED") "1" }}
+  {{ if eq (env "IRC_ENABLED") "1" }}
   irc:
     address: ":6697"
-  {{- end }}
+  {{ end }}
-  {{- if eq (env "MATRIX_FEDERATION_ENABLED") "1" }}
+  {{ if eq (env "METRICS_ENABLED") "1" }}
+  metrics:
+    address: ":8082"
+    http:
+      middlewares:
+        - basicauth@file
+  {{ end }}
+  {{ if eq (env "MATRIX_FEDERATION_ENABLED") "1" }}
   matrix-federation:
-    address: ":8448"
+    address: ":9001"
-  {{- end }}
+  {{ end }}
-  {{- if eq (env "NEXTCLOUD_TALK_HPB_ENABLED") "1" }}
-  nextcloud-talk-hpb:
-    address: ":3478"
-  nextcloud-talk-hpb-udp:
-    address: ":3478/udp"
-  {{- end }}
-  {{- if eq (env "ONION_ENABLED") "1" }}
-  onion:
-    address: ":9052"
-  {{- end }}
 
 ping:
   entryPoint: web
 
-{{- if eq (env "METRICS_ENABLED") "1" }}
+{{ if eq (env "METRICS_ENABLED") "1" }}
 metrics:
   prometheus:
-    entryPoint: web-secure
+    entryPoint: metrics
-    manualRouting: true
     addRoutersLabels: true
     addServicesLabels: true
-{{- end }}
+{{ end }}
 
 certificatesResolvers:
   staging:
@@ -129,23 +106,23 @@ certificatesResolvers:
       caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
       httpChallenge:
         entryPoint: web
-      {{- if eq (env "LETS_ENCRYPT_DNS_CHALLENGE_ENABLED") "1" }}
+      {{ if eq (env "LETS_ENCRYPT_DNS_CHALLENGE_ENABLED") "1" }}
       dnsChallenge:
         provider: {{ (env "LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER") }}
         resolvers:
           - "1.1.1.1:53"
           - "8.8.8.8:53"
-      {{- end }}
+      {{ end }}
   production:
     acme:
       email: {{ env "LETS_ENCRYPT_EMAIL" }}
       storage: /etc/letsencrypt/production-acme.json
       httpChallenge:
         entryPoint: web
-      {{- if eq (env "LETS_ENCRYPT_DNS_CHALLENGE_ENABLED") "1" }}
+      {{ if eq (env "LETS_ENCRYPT_DNS_CHALLENGE_ENABLED") "1" }}
       dnsChallenge:
         provider: {{ (env "LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER") }}
         resolvers:
           - "1.1.1.1:53"
           - "9.9.9.9:53"
-      {{- end }}
+      {{ end }}