doc: better explanation for access logs coop-cloud/monitoring-ng#27

.env.sample

@@ -110,11 +110,11 @@ WRITE_TIMEOUT=0s
 
 # Set wildcards = 1, and uncomment compose_file to enable.
 # Create your certs elsewhere and add them like:
-# abra app secret insert traefik.example.coop ssl_cert v1 -f /path/to/fullchain.pem
-# abra app secret insert traefik.example.coop ssl_key v1 -f /path/to/privkey.pem
+# abra app secret insert {myapp.example.coop} ssl_cert v1 "$(cat /path/to/fullchain.pem)"
+# abra app secret insert {myapp.example.coop} ssl_key v1 "$(cat /path/to/privkey.pem)"
 #WILDCARDS_ENABLED=1
-#SECRET_WILDCARD_CERT_VERSION=v1 # generate=false
-#SECRET_WILDCARD_KEY_VERSION=v1 # generate=false
+#SECRET_WILDCARD_CERT_VERSION=v1
+#SECRET_WILDCARD_KEY_VERSION=v1
 #COMPOSE_FILE="$COMPOSE_FILE:compose.wildcard.yml"
 
 #####################################################################
@@ -249,13 +249,3 @@ WRITE_TIMEOUT=0s
 #
 # https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
 #TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example
-
-## Rate limits
-# You can enable universal rate limits by setting RATE_LIMIT_EVERYTHING
-# to true, otherwise each app needs to export their own middleware labels.
-#
-# https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/ratelimit/
-#RATE_LIMIT_EVERYTHING=false
-#RATE_LIMIT_AVERAGE=100
-#RATE_LIMIT_BURST=200
-#RATE_LIMIT_PERIOD=1s

.gitea/CODEOWNERS

@@ -1 +0,0 @@
-* @coop-cloud/traefik-maintainers

README.md

@@ -84,6 +84,9 @@ Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a n
 ## Access logs
 
 To keep access logs on a volume, uncomment the "Access logs" section.
+Logs will be kept for every app running, unless you opt-out of them.
+Apps supporting this will have an `ACCESS_LOGS` toggle, usually set to
+`false`, so they're already opt-in.
 
 You'll need to setup rotation yourself and send the USR1 signal to
 Traefik for reloading.  For instance, with `logrotate:

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v37
-export FILE_PROVIDER_YML_VERSION=v14
+export TRAEFIK_YML_VERSION=v36
+export FILE_PROVIDER_YML_VERSION=v13
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1

compose.anubis.yml

@@ -7,7 +7,7 @@ services:
       - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
       - "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true"
   anubis:
-    image: "ghcr.io/techarohq/anubis:v1.28.1"
+    image: "ghcr.io/techarohq/anubis:v1.27.0"
     environment:
       BIND: ":8080"
       TARGET: " "

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v3.7.14"
+    image: "traefik:v3.7.13"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
@@ -57,12 +57,12 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.service=api@internal"
         - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=6.4.0+v3.7.14"
+        - "coop-cloud.${STACK_NAME}.version=6.3.0+v3.7.13"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.4.7
+    image: lscr.io/linuxserver/socket-proxy:3.4.4
     deploy:
       endpoint_mode: dnsrr
     environment:

file-provider.yml.tmpl

@@ -22,11 +22,6 @@ http:
       basicAuth:
         usersFile: "/run/secrets/usersfile"
     {{ end }}
-    ip-rate-limit:
-      rateLimit:
-        average: {{ or (env "RATE_LIMIT_AVERAGE") "100" }}
-        burst: {{ or (env "RATE_LIMIT_BURST") "200" }}
-        period: {{ or (env "RATE_LIMIT_PERIOD") "1s" }}
     security:
       headers:
         frameDeny: true
@@ -75,4 +70,4 @@ tls:
   certificates:
     - certFile: /run/secrets/ssl_cert
       keyFile: /run/secrets/ssl_key
-  {{ end }}
+  {{ end }}

release/6.4.0+v3.7.14

@@ -1 +0,0 @@
-Security Update

release/next

@@ -1,6 +0,0 @@
-# Rate limits
-
-You can enable rate limits globally by updating the .env file for
-Traefik.  Per-app rate limits need to be supported by each app!
-
-Limits can be tested with benchmarking tools like `wrk`.

traefik.yml.tmpl

@@ -65,10 +65,6 @@ entrypoints:
         allowEncodedPercent: true
         allowEncodedQuestionMark: true
         allowEncodedHash: true
-  {{ if eq (env "RATE_LIMIT_EVERYTHING") "true" }}
-      middlewares:
-        - "ip-rate-limit@file"
-  {{ end }}
   {{- if eq (env "GITEA_SSH_ENABLED") "1" }}
   gitea-ssh:
     address: ":2222"