compose: Switch to host-mode port publishing by default

By default, swarm services use ingress mode port publishing, which is
not ideal for traefik (it breaks IPv6 ingress and there is no need to
load-balance traffic between multiple traefik instances or to route it
from multiple swarm nodes)

This commit switches traefik's port publishing mode to `host` for all of
its exposed ports as well as:

 * change traefik's update order to stop-first (there cannot be multiple
   containers exposing the same port when using host-mode publishing)
 * use `endpoint_mode: dnsrr` instead of the default `vip`
 * remove all overrides from `compose.host.yml`, leaving the file empty
   for backwards compatibility
 * allow overriding traefik's endpoint_mode back to vip through
   compose.no-host.yml

/!\ This is a breaking change

Closes: #52

.env.sample

@@ -36,10 +36,8 @@ COMPOSE_FILE="compose.yml"
 #####################################################################
 
 ## Enable dns challenge (for wildcard domains)
-##   https://go-acme.github.io/lego/dns/#dns-providers
+##   https://doc.traefik.io/traefik/https/acme/#dnschallenge
 #LETS_ENCRYPT_DNS_CHALLENGE_ENABLED=1
-## *Currently* one of ovh, gandi, gandiv5, digitalocean, azure, porkbun.
-## Uncomment the corresponding provider below to insert your secret token/key.
 #LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER=ovh
 
 ## OVH, https://ovh.com
@@ -78,14 +76,6 @@ COMPOSE_FILE="compose.yml"
 #AZURE_RESOURCE_GROUP=
 #SECRET_AZURE_SECRET_VERSION=v1
 
-## Porkbun, https://porkbun.com
-## To insert your secrets:
-## abra app secret insert 1312.net pb_api_key v1 pk1_413
-## abra app secret insert 1312.net pb_s_api_key v1 sk1_612
-#COMPOSE_FILE="$COMPOSE_FILE:compose.porkbun.yml"
-#SECRET_PORKBUN_API_KEY_VERSION=v1
-#SECRET_PORKBUN_SECRET_API_KEY_VERSION=v1
-
 #####################################################################
 # Manual wildcard certificate insertion                             #
 #####################################################################
@@ -122,10 +112,8 @@ COMPOSE_FILE="compose.yml"
 
 ## Enable prometheus metrics collection
 ## used used by the coop-cloud monitoring stack
-## BASIC_AUTH should also be enabled
 #COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
 #METRICS_ENABLED=1
-#METRICS_FQDN=metrics.traefik.example.com
 
 #####################################################################
 # File provider directory configuration                             #

README.md

@@ -42,20 +42,17 @@ subdomains, like
 need to give Traefik access to your DNS provider so that it can carry out
 Letsencrypt DNS challenges.
 
-1. Use Gandi, OVH, DO, Azure, or PorkBun for DNS 🤡 (support for other providers
-   can be easily added, see
-   [the `lego` docs](https://go-acme.github.io/lego/dns/#dns-providers).
+1. Use Gandi or OVH for DNS 🤡 (support for other providers can be easily added,
+   see [the `lego` docs](https://go-acme.github.io/lego/dns/#dns-providers).
 2. Run `abra app config YOURAPPDOMAIN`
 3. Uncomment e.g. `ENABLE_GANDI` and the related `SECRET_.._VERSION` line, e.g.
    `SECRET_GANDIV5_API_KEY_VERSION`
-4. Set `LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER` to your provider, e.g. `gandi`
-4. Generate an API key for your provider, probably using their web interface.
+4. Generate an API key for your provider
 5. Run `abra app secret insert YOURAPPDOMAIN SECRETNAME v1 SECRETVALUE`, where
    `SECRETNAME` is from the compose file (e.g. `compose.gandi-api-key.yml`) e.g.
    `gandiv5_api_key` and `SECRETVALUE` is the API key.
    - For Gandi, you can use either the deprecated API Key or a GandiV5 Personal
      Access Token, in which case use compose.gandi-personal-access-token.yml.
-   - See comments for each provider in your env file for specific instructions
 6. Redeploy Traefik, using e.g. `abra app deploy YOURAPPDOMAIN -f`
 
 ## Blocking scrapers with [Anubis](https://anubis.techaro.lol/)

abra.sh

@@ -1,3 +1,3 @@
-export TRAEFIK_YML_VERSION=v30
-export FILE_PROVIDER_YML_VERSION=v12
+export TRAEFIK_YML_VERSION=v29
+export FILE_PROVIDER_YML_VERSION=v11
 export ENTRYPOINT_VERSION=v5

compose.anubis.yml

@@ -6,7 +6,7 @@ services:
       labels:
       - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
   anubis:
-    image: "ghcr.io/techarohq/anubis:v1.25.0"
+    image: "ghcr.io/techarohq/anubis:v1.24.0"
     environment:
       BIND: ":8080"
       TARGET: " "

compose.metrics.yml

@@ -3,3 +3,7 @@ services:
   app:
     environment:
       - METRICS_ENABLED
+    ports:
+      - target: 8082
+        published: 8082
+        mode: host

compose.porkbun.yml

@@ -1,18 +0,0 @@
-version: "3.8"
-
-services:
-  app:
-    environment:
-      - PORKBUN_API_KEY_FILE=/run/secrets/pb_api_key
-      - PORKBUN_SECRET_API_KEY_FILE=/run/secrets/pb_s_api_key
-    secrets:
-      - pb_api_key
-      - pb_s_api_key
-
-secrets:
-  pb_api_key:
-    name: ${STACK_NAME}_pb_api_key_${SECRET_PORKBUN_API_KEY_VERSION}
-    external: true
-  pb_s_api_key:
-    name: ${STACK_NAME}_pb_s_api_key_${SECRET_PORKBUN_SECRET_API_KEY_VERSION}
-    external: true

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v3.6.11"
+    image: "traefik:v3.6.7"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
@@ -55,12 +55,12 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.service=api@internal"
         - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=5.1.0+v3.6.11"
+        - "coop-cloud.${STACK_NAME}.version=3.10.0+v3.6.7"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.2.14
+    image: lscr.io/linuxserver/socket-proxy:3.2.10-r0-ls65
     deploy:
       endpoint_mode: dnsrr
     environment:

file-provider.yml.tmpl

@@ -30,18 +30,6 @@ http:
         stsIncludeSubdomains: true
         stsPreload: true
         stsSeconds: "31536000"
-  {{ if eq (env "METRICS_ENABLED") "1" }}
-  routers:
-    traefik-metrics:
-      rule: "Host(`{{ env "METRICS_FQDN" }}`)"
-      entrypoints:
-        - web-secure
-      tls:
-        certResolver: {{ env "LETS_ENCRYPT_ENV" }}
-      middlewares:
-        - basicauth@file
-      service: prometheus@internal
-  {{ end }}
 
 tls:
   options:

release/5.0.0+v3.6.10

@@ -1,10 +0,0 @@
-/!\ BREAKING CHANGE: Change metrics endpoint to use https instead of http 8082
-                     to prevent sending BASIC_AUTH in plaintext
-
-The metrics endpoint changed from http on port 8082 to the web-secure
-endpoint to prevent sending BASIC_AUTH credentials plaintext. If metrics is
-enabled you need to configure a FQDN for it by setting METRICS_FQDN in your
-.env. You should also update the scrape config files in prometheus for
-Traefik metrics from port 8082 to the new FQDN.
-
-All changes: https://git.coopcloud.tech/coop-cloud/traefik/compare/5.0.0+v3.6.10...4.0.0+v3.6.10

release/5.1.0+v3.6.11

@@ -1 +0,0 @@
-Patched CVES: CVE-2026-32595 and CVE-2026-32305

traefik.yml.tmpl

@@ -94,6 +94,13 @@ entrypoints:
   irc:
     address: ":6697"
   {{- end }}
+  {{- if eq (env "METRICS_ENABLED") "1" }}
+  metrics:
+    address: ":8082"
+    http:
+      middlewares:
+        - basicauth@file
+  {{- end }}
   {{- if eq (env "MATRIX_FEDERATION_ENABLED") "1" }}
   matrix-federation:
     address: ":9001"
@@ -115,8 +122,7 @@ ping:
 {{- if eq (env "METRICS_ENABLED") "1" }}
 metrics:
   prometheus:
-    entryPoint: web-secure
-    manualRouting: true
+    entryPoint: metrics
     addRoutersLabels: true
     addServicesLabels: true
 {{- end }}