chore: publish 6.2.0+v3.7.12 release

feat: Add labels for label-based metric scraping (#140 )
Co-authored-by: p4u1 <p4u1_f4u1@riseup.net>
2026-09-02 12:41:19 +02:00 · 2026-09-02 10:28:13 +00:00 · 2026-09-01 13:10:59 +00:00 · 2026-09-01 13:09:51 +00:00 · 2026-09-01 13:08:33 +00:00
7 changed files with 31 additions and 7 deletions
@@ -139,10 +139,14 @@ WRITE_TIMEOUT=0s
 #####################################################################

 ## Enable prometheus metrics collection
-## used used by the coop-cloud monitoring stack
-## BASIC_AUTH should also be enabled
+## Metrics are served unauthenticated on :8082, reachable only from
+## other services on the proxy network (e.g. monitoring-ng's Alloy,
+## which auto-discovers it via the prometheus.io/scrape label)
 #COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
 #METRICS_ENABLED=1
+
+## Setting METRICS_FQDN also adds a public metrics endpoint (behind
+## basic auth). BASIC_AUTH should be enabled for this.
 #METRICS_FQDN=metrics.traefik.example.com

 #####################################################################
@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v34
-export FILE_PROVIDER_YML_VERSION=v12
+export TRAEFIK_YML_VERSION=v35
+export FILE_PROVIDER_YML_VERSION=v13
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1
@@ -3,3 +3,9 @@ services:
  app:
    environment:
      - METRICS_ENABLED
+    deploy:
+      labels:
+        # lets monitoring-ng's Alloy auto-discover and scrape metrics-internal
+        # via the proxy network.
+        - "prometheus.io/scrape=true"
+        - "prometheus.io/port=8082"
@@ -3,7 +3,7 @@ version: "3.8"

 services:
  app:
-    image: "traefik:v3.7.10"
+    image: "traefik:v3.7.12"
    # Note(decentral1se): *please do not* add any additional ports here.
    # Doing so could break new installs with port conflicts. Please use
    # the usual `compose.$app.yml` approach for any additional ports
@@ -57,12 +57,12 @@ services:
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}.service=api@internal"
        - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=6.1.0+v3.7.10"
+        - "coop-cloud.${STACK_NAME}.version=6.2.0+v3.7.12"
        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
        - "backupbot.backup=${ENABLE_BACKUPS:-true}"

  socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.4.3
+    image: lscr.io/linuxserver/socket-proxy:3.4.4
    deploy:
      endpoint_mode: dnsrr
    environment:
@@ -32,6 +32,7 @@ http:
        stsSeconds: "31536000"
  {{ if eq (env "METRICS_ENABLED") "1" }}
  routers:
+    {{ if ne (env "METRICS_FQDN") "" }}
    traefik-metrics:
      rule: "Host(`{{ env "METRICS_FQDN" }}`)"
      entrypoints:
@@ -41,6 +42,14 @@ http:
      middlewares:
        - basicauth@file
      service: prometheus@internal
+    {{ end }}
+    # reachable from other services on the proxy network only (this port
+    # isn't published to the host), without auth
+    traefik-metrics-internal:
+      rule: "PathPrefix(`/`)"
+      entrypoints:
+        - metrics-internal
+      service: prometheus@internal
  {{ end }}

 tls:
@@ -0,0 +1 @@
+1. compose.metrics.yml now adds prometheus.io/scrape labels so services like monitoring-ng can automatically discover and scrape Traefik's metrics.
@@ -131,6 +131,10 @@ entrypoints:
  onion:
    address: ":9052"
  {{- end }}
+  {{- if eq (env "METRICS_ENABLED") "1" }}
+  metrics-internal:
+    address: ":8082"
+  {{- end }}

 ping:
  entryPoint: web
Author	SHA1	Message	Date
p4u1	e6ba592774	chore: publish 6.2.0+v3.7.12 release continuous-integration/drone/push Build is failing Details continuous-integration/drone/tag Build is passing Details	2026-09-02 12:41:19 +02:00
p4u1	39e52668d2	feat: Add labels for label-based metric scraping (#140 ) continuous-integration/drone/push Build is failing Details Co-authored-by: p4u1 <p4u1_f4u1@riseup.net>	2026-09-02 10:28:13 +00:00
fauno	ca4f4113d9	feat: trusted ips (#128 ) continuous-integration/drone/push Build is failing Details when traefik is behind a reverse proxy, we need to tell it which networks to trust with x-real-ip headers <!-- Thank you for doing recipe maintenance work! Please mark all checklist items which are relevant for your changes. Please remove the checklist items which are not relevant for your changes. Feel free to remove this comment. --> * [x] I have deployed and tested my changes * [x] I have [updated relevant versions in `abra.sh`](https://docs.coopcloud.tech/maintainers/upgrade/#updating-versions-in-the-abrash) * [x] I have made my environment variable changes [backwards compatible](https://docs.coopcloud.tech/maintainers/upgrade/#backwards-compatible-environment-variable-changes) * [ ] I have added a [release note entry](https://docs.coopcloud.tech/maintainers/upgrade/#creating-new-release-notes) Reviewed-on: #128 Reviewed-by: p4u1 <133+p4u1@noreply.git.coopcloud.tech> Co-authored-by: f <f@sutty.nl>	2026-09-01 13:10:59 +00:00
renovate-bot	0059b9011f	chore(deps): update traefik docker tag to v3.7.12 (#135 ) continuous-integration/drone/push Build is failing Details This PR contains the following updates: \| Package \| Update \| Change \| \|---\|---\|---\| \| [traefik](https://github.com/containous/traefik) \| patch \| `v3.7.10` -> `v3.7.12` \| > ❗ Important > > Release Notes retrieval for this PR were skipped because no github.com credentials were available. > If you are self-hosted, please see [this instruction](https://github.com/renovatebot/renovate/blob/master/docs/usage/examples/self-hosting.md#githubcom-token-for-release-notes). --- ### Configuration 📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=--> Reviewed-on: #135 Reviewed-by: p4u1 <133+p4u1@noreply.git.coopcloud.tech> Co-authored-by: Renovate Bot <renovate@coopcloud.tech>	2026-09-01 13:09:51 +00:00
renovate-bot	7c1c36e23a	chore(deps): update lscr.io/linuxserver/socket-proxy docker tag to v3.4.4 (#137 ) continuous-integration/drone/push Build is failing Details This PR contains the following updates: \| Package \| Update \| Change \| \|---\|---\|---\| \| [lscr.io/linuxserver/socket-proxy](https://github.com/linuxserver/docker-socket-proxy/packages) ([source](https://github.com/linuxserver/docker-socket-proxy)) \| patch \| `3.4.3` -> `3.4.4` \| > ❗ Important > > Release Notes retrieval for this PR were skipped because no github.com credentials were available. > If you are self-hosted, please see [this instruction](https://github.com/renovatebot/renovate/blob/master/docs/usage/examples/self-hosting.md#githubcom-token-for-release-notes). --- ### Configuration 📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=--> Reviewed-on: #137 Co-authored-by: Renovate Bot <renovate@coopcloud.tech>	2026-09-01 13:08:33 +00:00
				`@@ -0,0 +1 @@`
				`1. compose.metrics.yml now adds prometheus.io/scrape labels so services like monitoring-ng can automatically discover and scrape Traefik's metrics.`