refactor: adjust local portbinding

Reviewed-on: #133
Reviewed-by: p4u1 <133+p4u1@noreply.git.coopcloud.tech>
Co-authored-by: Javielico <103+javielico@noreply.git.coopcloud.tech>

.env.sample

@@ -15,6 +15,13 @@ LOG_MAX_AGE=1
 # This is here so later lines can extend it; you likely don't wanna edit
 COMPOSE_FILE="compose.yml"
 
+# Increase read timeout (or change it to 0s) to ensure large file
+# uploads work.
+#
+# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-transport-respondingTimeouts-readTimeout
+READ_TIMEOUT=60s
+WRITE_TIMEOUT=0s
+
 #####################################################################
 # General settings                                                  #
 #####################################################################
@@ -152,6 +159,10 @@ COMPOSE_FILE="compose.yml"
 #COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml"
 #SMTP_ENABLED=1
 
+## PGSQL recipe open port 5432
+#COMPOSE_FILE="$COMPOSE_FILE:compose.pgsql.yml"
+#PGSQL_ENABLED=1
+
 ## Compy
 #COMPOSE_FILE="$COMPOSE_FILE:compose.compy.yml"
 #COMPY_ENABLED=1
@@ -216,5 +227,8 @@ COMPOSE_FILE="compose.yml"
 #ANUBIS_SERVE_ROBOTS_TXT=true
 #ANUBIS_SLOG_LEVEL=INFO
 
+## Anubis metrics
+#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis-metrics.yml"
+
 ## Enable onion service support
 #ONION_ENABLED=1

README.md

@@ -5,7 +5,7 @@
 > https://docs.traefik.io
 
 <!-- metadata -->
-* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@decentral1se](https://git.coopcloud.tech/decentral1se), [@javielico](https://git.coopcloud.tech/javielico), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
+* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@javielico](https://git.coopcloud.tech/javielico), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
 * **Status**: `stable`
 * **Category**: Utilities
 * **Features**: ?
@@ -72,6 +72,9 @@ After deploying these changes, go to each recipe that supports Anubis
 and follow the process there.  **Enabling Anubis here is not enough for
 protection your apps.**
 
+If you want to collect Prometheus metrics for Anubis, for instance with
+[monitoring-ng](/monitoring-ng), uncomment the "Anubis metrics" section.
+
 ## Enabling onion service
 
 Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).

abra.sh

@@ -1,3 +1,4 @@
-export TRAEFIK_YML_VERSION=v31
-export FILE_PROVIDER_YML_VERSION=v12
-export ENTRYPOINT_VERSION=v5
+export TRAEFIK_YML_VERSION=v34
+export FILE_PROVIDER_YML_VERSION=v14
+export ENTRYPOINT_VERSION=v8
+export IOCAINE_ENTRYPOINT_VERSION=v1

anubis.yml.tmpl

@@ -0,0 +1,7 @@
+bots:
+- import: (data)/meta/default-config.yaml
+{{ if eq (env "ANUBIS_METRICS_ENABLED") "true" }}
+metrics:
+  bind: ":9090"
+  network: "tcp"
+{{ end }}

compose.anubis-metrics.yml

@@ -0,0 +1,11 @@
+---
+version: "3.8"
+services:
+  anubis:
+    environment:
+      ANUBIS_METRICS_ENABLED: "true"
+    deploy:
+      labels:
+      - "prometheus.io/scrape=true"
+      - "prometheus.io/port=9090"
+      - "prometheus.io/path=/metrics"

compose.anubis.yml

@@ -5,8 +5,9 @@ services:
     deploy:
       labels:
       - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
+      - "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true"
   anubis:
-    image: "ghcr.io/techarohq/anubis:v1.25.0"
+    image: "ghcr.io/techarohq/anubis:v1.27.0"
     environment:
       BIND: ":8080"
       TARGET: " "
@@ -18,6 +19,10 @@ services:
       OG_CACHE_CONSIDER_HOST: "${ANUBIS_OG_CACHE_CONSIDER_HOST}"
       SERVE_ROBOTS_TXT: "${ANUBIS_SERVE_ROBOTS_TXT}"
       SLOG_LEVEL: "${ANUBIS_SLOG_LEVEL:-INFO}"
+      POLICY_FNAME: "/data/cfg/botPolicy.yaml"
+    configs:
+    - source: anubis_yml
+      target: /data/cfg/botPolicy.yaml
     networks:
     - proxy
     deploy:
@@ -28,3 +33,8 @@ services:
       - "traefik.http.routers.anubis.entrypoints=web-secure"
       - "traefik.http.services.anubis.loadbalancer.server.port=8080"
       - "traefik.http.routers.anubis.service=anubis"
+configs:
+  anubis_yml:
+    name: ${STACK_NAME}_anubis_yml_${ANUBIS_YML_VERSION}
+    file: anubis.yml.tmpl
+    template_driver: golang

compose.iocaine.yml

@@ -0,0 +1,22 @@
+---
+version: "3.8"
+
+services:
+  app:
+    environment:
+      IOCAINE_ENABLE: "1"
+      IOCAINE_PLUGIN_VERSION: "v1.2.0"
+    volumes:
+      - "plugins-local:/plugins-local"
+
+  iocaine:
+    image: "git.madhouse-project.org/iocaine/iocaine:3.5.0"
+    environment:
+      RUST_LOG: "iocaine=info"
+    ports:
+      - "127.0.0.1:42069:42069"
+    networks:
+      - proxy
+
+volumes:
+  plugins-local:

compose.pgsql.yml

@@ -0,0 +1,12 @@
+---
+version: "3.8"
+
+services:
+  app:
+    environment:
+      - PGSQL_ENABLED
+    ports:
+      - target: 5432
+        published: 5432
+        protocol: tcp
+        mode: host

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v3.7.5"
+    image: "traefik:v3.7.10"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
@@ -27,6 +27,9 @@ services:
       - source: entrypoint
         target: /custom-entrypoint.sh
         mode: 0555
+      - source: iocaine_entrypoint
+        target: /entrypoint.iocaine.sh
+        mode: 0555
     networks:
       - proxy
       - internal
@@ -34,6 +37,8 @@ services:
       - DASHBOARD_ENABLED
       - LOG_LEVEL
       - ${LOG_MAX_AGE:-0}
+      - READ_TIMEOUT=${READ_TIMEOUT:-60s}
+      - WRITE_TIMEOUT=${WRITE_TIMEOUT:-0s}
     healthcheck:
       test: ["CMD", "traefik", "healthcheck"]
       interval: 30s
@@ -55,12 +60,12 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.service=api@internal"
         - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=5.1.1+v3.6.15"
+        - "coop-cloud.${STACK_NAME}.version=6.1.0+v3.7.10"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.4.0
+    image: lscr.io/linuxserver/socket-proxy:3.4.3
     deploy:
       endpoint_mode: dnsrr
     environment:
@@ -115,6 +120,10 @@ configs:
     name: ${STACK_NAME}_entrypoint_${ENTRYPOINT_VERSION}
     file: entrypoint.sh.tmpl
     template_driver: golang
+  iocaine_entrypoint:
+    name: ${STACK_NAME}_entrypoint_${IOCAINE_ENTRYPOINT_VERSION}
+    file: entrypoint.iocaine.sh.tmpl
+    template_driver: golang
 
 volumes:
   letsencrypt:

entrypoint.iocaine.sh.tmpl

@@ -0,0 +1,15 @@
+#!/bin/sh
+
+set -e
+
+apk --no-cache add git go
+iocaine_path="/plugins-local/src/git.mstar.dev/mstar/traefik-iocaine-middleware"
+if [ ! -d "$iocaine_path" ]; then
+  git clone --depth 1 --branch $IOCAINE_PLUGIN_VERSION https://git.mstar.dev/mstar/traefik-iocaine-middleware.git $iocaine_path
+else
+	git -C $iocaine_path fetch origin 'refs/tags/*:refs/tags/*'
+	git -C $iocaine_path checkout tags/$IOCAINE_PLUGIN_VERSION
+fi
+(cd $iocaine_path && go mod vendor)
+
+exit 0

entrypoint.sh.tmpl

@@ -15,4 +15,8 @@ export DO_AUTH_TOKEN=$(cat "$DO_AUTH_TOKEN_FILE")
 export AZURE_CLIENT_SECRET=$(cat "$AZURE_CLIENT_SECRET_FILE")
 {{ end }}
 
+{{ if eq (env "IOCAINE_ENABLE") "1" }}
+/entrypoint.iocaine.sh
+{{ end }}
+
 /entrypoint.sh "$@"

file-provider.yml.tmpl

@@ -17,6 +17,15 @@ http:
         authResponseHeaders:
           - X-Forwarded-User
     {{ end }}
+    {{ if eq (env "IOCAINE_ENABLE") "1" }}
+    iocaine:
+      plugin:
+        iocaine:
+          iocaineHttpUrl: "http://iocaine:42069"
+          methods:
+            - GET
+            - HEAD
+    {{ end }}
     {{ if eq (env "BASIC_AUTH") "1" }}
     basicauth:
       basicAuth:
@@ -61,4 +70,4 @@ tls:
   certificates:
     - certFile: /run/secrets/ssl_cert
       keyFile: /run/secrets/ssl_key
-  {{ end }}
+  {{ end }}

release/6.0.0+v3.7.7

@@ -0,0 +1,13 @@
+!Breaking: Starting with v3.6.16, the Docker provider requires Docker API version v1.40 or above (Docker Engine v19.03). Users running older (end of life) versions of Docker Engine should update their Docker Engine or use the DOCKER_API_VERSION environment variable to override the API version used by Traefik.
+
+letsencrypt: Avoid HTTP-01 challenge if `LETS_ENCRYPT_DNS_CHALLENGE_ENABLED` is set, in order to rely on DNS-01 challenges for servers not exposed to the internet.
+
+matrix-federation: Entrypoint was changed to :8448 to match published port
+
+fix: ensure large uploads work. You can now set the following env vars:
+- READ_TIMEOUT
+- WRITE_TIMEOUT
+
+cloudflare: Add Cloudflare as DNS provider
+
+For more information take a look at the migration guide: https://doc.traefik.io/traefik/v3.7/migrate/v3/#v377

release/6.1.0+v3.7.10

@@ -0,0 +1 @@
+Adds option ability to open ports for PGSQL recipe, new version of anubis, and ability to add anubis metrics on this release.

release/next

@@ -1 +0,0 @@
-letsencrypt: Avoid HTTP-01 challenge if `LETS_ENCRYPT_DNS_CHALLENGE_ENABLED` is set, in order to rely on DNS-01 challenges for servers not exposed to the internet.

traefik.yml.tmpl

@@ -33,6 +33,10 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
+    transport:
+      respondingTimeouts:
+        readTimeout: {{ env "READ_TIMEOUT" }}
+        writeTimeout: {{ env "WRITE_TIMEOUT" }}
     http:
       encodedCharacters:
         allowEncodedSlash: true
@@ -42,6 +46,10 @@ entrypoints:
         allowEncodedPercent: true
         allowEncodedQuestionMark: true
         allowEncodedHash: true
+			{{- if eq (env "IOCAINE_ENABLE") "1" }}
+      middlewares:
+        - iocaine@file
+			{{- end }}
   {{- if eq (env "GITEA_SSH_ENABLED") "1" }}
   gitea-ssh:
     address: ":2222"
@@ -96,7 +104,7 @@ entrypoints:
   {{- end }}
   {{- if eq (env "MATRIX_FEDERATION_ENABLED") "1" }}
   matrix-federation:
-    address: ":9001"
+    address: ":8448"
   {{- end }}
   {{- if eq (env "NEXTCLOUD_TALK_HPB_ENABLED") "1" }}
   nextcloud-talk-hpb:
@@ -153,3 +161,10 @@ certificatesResolvers:
           - "1.1.1.1:53"
           - "9.9.9.9:53"
       {{- end }}
+
+{{ if eq (env "IOCAINE_ENABLE") "1" }}
+experimental:
+  localPlugins:
+    iocaine:
+      moduleName: git.mstar.dev/mstar/traefik-iocaine-middleware
+{{ end }}