refactor: adjust local portbinding

.env.sample

@@ -110,11 +110,11 @@ WRITE_TIMEOUT=0s
 
 # Set wildcards = 1, and uncomment compose_file to enable.
 # Create your certs elsewhere and add them like:
-# abra app secret insert traefik.example.coop ssl_cert v1 -f /path/to/fullchain.pem
-# abra app secret insert traefik.example.coop ssl_key v1 -f /path/to/privkey.pem
+# abra app secret insert {myapp.example.coop} ssl_cert v1 "$(cat /path/to/fullchain.pem)"
+# abra app secret insert {myapp.example.coop} ssl_key v1 "$(cat /path/to/privkey.pem)"
 #WILDCARDS_ENABLED=1
-#SECRET_WILDCARD_CERT_VERSION=v1 # generate=false
-#SECRET_WILDCARD_KEY_VERSION=v1 # generate=false
+#SECRET_WILDCARD_CERT_VERSION=v1
+#SECRET_WILDCARD_KEY_VERSION=v1
 #COMPOSE_FILE="$COMPOSE_FILE:compose.wildcard.yml"
 
 #####################################################################
@@ -139,14 +139,10 @@ WRITE_TIMEOUT=0s
 #####################################################################
 
 ## Enable prometheus metrics collection
-## Metrics are served unauthenticated on :8082, reachable only from
-## other services on the proxy network (e.g. monitoring-ng's Alloy,
-## which auto-discovers it via the prometheus.io/scrape label)
+## used used by the coop-cloud monitoring stack
+## BASIC_AUTH should also be enabled
 #COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
 #METRICS_ENABLED=1
-
-## Setting METRICS_FQDN also adds a public metrics endpoint (behind
-## basic auth). BASIC_AUTH should be enabled for this.
 #METRICS_FQDN=metrics.traefik.example.com
 
 #####################################################################
@@ -215,8 +211,6 @@ WRITE_TIMEOUT=0s
 ## Garage
 #COMPOSE_FILE="$COMPOSE_FILE:compose.garage.yml"
 #GARAGE_RPC_ENABLED=1
-#COMPOSE_FILE="$COMPOSE_FILE:compose.garage-admin.yml"
-#GARAGE_ADMIN_ENABLED=1
 
 ## Nextcloud Talk HPB
 #COMPOSE_FILE="$COMPOSE_FILE:compose.nextcloud-talk-hpb.yml"
@@ -238,24 +232,3 @@ WRITE_TIMEOUT=0s
 
 ## Enable onion service support
 #ONION_ENABLED=1
-
-## Access logs
-#COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
-
-## Behind a reverse proxy
-#
-# YAML array of subnets from which Traefik's trusts the x-real-ip
-# header when behind a reverse proxy.
-#
-# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
-#TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example
-
-## Rate limits
-# You can enable universal rate limits by setting RATE_LIMIT_EVERYTHING
-# to true, otherwise each app needs to export their own middleware labels.
-#
-# https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/ratelimit/
-#RATE_LIMIT_EVERYTHING=false
-#RATE_LIMIT_AVERAGE=100
-#RATE_LIMIT_BURST=200
-#RATE_LIMIT_PERIOD=1s

MAINTENANCE.md

@@ -29,4 +29,3 @@ Everyone can apply to be a recipe maintainer:
 1. Watch the repository to always get updates
 2. Simply add your self to the list in the [README.md](./README.md) and open a new pull request with the change.
 3. Once the pull request gets merged you will be added to the [traefik maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/traefik-maintainers).
-4. Join the room [#cc-|-traefik-maintenance:matrix.org](#cc-|-traefik-maintenance:matrix.org) and chat to other maintainers.

README.md

@@ -80,19 +80,3 @@ If you want to collect Prometheus metrics for Anubis, for instance with
 Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).
 
 [`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
-
-## Access logs
-
-To keep access logs on a volume, uncomment the "Access logs" section.
-
-You'll need to setup rotation yourself and send the USR1 signal to
-Traefik for reloading.  For instance, with `logrotate:
-
-```
-# /etc/logrotate.d/traefik.conf
-/var/lib/docker/volumes/traefik_SERVICE_NAME_access-logs/_data/access_log.jsonl {
-  postrotate
-    pkill -USR1 traefik
-  endscript
-}
-```

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v37
+export TRAEFIK_YML_VERSION=v34
 export FILE_PROVIDER_YML_VERSION=v14
-export ENTRYPOINT_VERSION=v5
-export ANUBIS_YML_VERSION=v1
+export ENTRYPOINT_VERSION=v8
+export IOCAINE_ENTRYPOINT_VERSION=v1

compose.access-log.yml

@@ -1,10 +0,0 @@
----
-version: "3.8"
-services:
-  app:
-    environment:
-      ACCESS_LOG_ENABLED: "true"
-    volumes:
-      - "access-logs:/var/log/"
-volumes:
-  access-logs:

compose.garage-admin.yml

@@ -1,10 +0,0 @@
-version: "3.8"
-services:
-  app:
-    environment:
-      - GARAGE_ADMIN_ENABLED
-    ports:
-      - target: 3903
-        published: 3903
-        protocol: tcp
-        mode: host

compose.iocaine.yml

@@ -0,0 +1,22 @@
+---
+version: "3.8"
+
+services:
+  app:
+    environment:
+      IOCAINE_ENABLE: "1"
+      IOCAINE_PLUGIN_VERSION: "v1.2.0"
+    volumes:
+      - "plugins-local:/plugins-local"
+
+  iocaine:
+    image: "git.madhouse-project.org/iocaine/iocaine:3.5.0"
+    environment:
+      RUST_LOG: "iocaine=info"
+    ports:
+      - "127.0.0.1:42069:42069"
+    networks:
+      - proxy
+
+volumes:
+  plugins-local:

compose.metrics.yml

@@ -3,9 +3,3 @@ services:
   app:
     environment:
       - METRICS_ENABLED
-    deploy:
-      labels:
-        # lets monitoring-ng's Alloy auto-discover and scrape metrics-internal
-        # via the proxy network.
-        - "prometheus.io/scrape=true"
-        - "prometheus.io/port=8082"

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v3.7.13"
+    image: "traefik:v3.7.10"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
@@ -27,6 +27,9 @@ services:
       - source: entrypoint
         target: /custom-entrypoint.sh
         mode: 0555
+      - source: iocaine_entrypoint
+        target: /entrypoint.iocaine.sh
+        mode: 0555
     networks:
       - proxy
       - internal
@@ -57,12 +60,12 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.service=api@internal"
         - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=6.3.0+v3.7.13"
+        - "coop-cloud.${STACK_NAME}.version=6.1.0+v3.7.10"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.4.5
+    image: lscr.io/linuxserver/socket-proxy:3.4.3
     deploy:
       endpoint_mode: dnsrr
     environment:
@@ -117,6 +120,10 @@ configs:
     name: ${STACK_NAME}_entrypoint_${ENTRYPOINT_VERSION}
     file: entrypoint.sh.tmpl
     template_driver: golang
+  iocaine_entrypoint:
+    name: ${STACK_NAME}_entrypoint_${IOCAINE_ENTRYPOINT_VERSION}
+    file: entrypoint.iocaine.sh.tmpl
+    template_driver: golang
 
 volumes:
   letsencrypt:

entrypoint.iocaine.sh.tmpl

@@ -0,0 +1,15 @@
+#!/bin/sh
+
+set -e
+
+apk --no-cache add git go
+iocaine_path="/plugins-local/src/git.mstar.dev/mstar/traefik-iocaine-middleware"
+if [ ! -d "$iocaine_path" ]; then
+  git clone --depth 1 --branch $IOCAINE_PLUGIN_VERSION https://git.mstar.dev/mstar/traefik-iocaine-middleware.git $iocaine_path
+else
+	git -C $iocaine_path fetch origin 'refs/tags/*:refs/tags/*'
+	git -C $iocaine_path checkout tags/$IOCAINE_PLUGIN_VERSION
+fi
+(cd $iocaine_path && go mod vendor)
+
+exit 0

entrypoint.sh.tmpl

@@ -15,4 +15,8 @@ export DO_AUTH_TOKEN=$(cat "$DO_AUTH_TOKEN_FILE")
 export AZURE_CLIENT_SECRET=$(cat "$AZURE_CLIENT_SECRET_FILE")
 {{ end }}
 
+{{ if eq (env "IOCAINE_ENABLE") "1" }}
+/entrypoint.iocaine.sh
+{{ end }}
+
 /entrypoint.sh "$@"

file-provider.yml.tmpl

@@ -17,16 +17,20 @@ http:
         authResponseHeaders:
           - X-Forwarded-User
     {{ end }}
+    {{ if eq (env "IOCAINE_ENABLE") "1" }}
+    iocaine:
+      plugin:
+        iocaine:
+          iocaineHttpUrl: "http://iocaine:42069"
+          methods:
+            - GET
+            - HEAD
+    {{ end }}
     {{ if eq (env "BASIC_AUTH") "1" }}
     basicauth:
       basicAuth:
         usersFile: "/run/secrets/usersfile"
     {{ end }}
-    ip-rate-limit:
-      rateLimit:
-        average: {{ or (env "RATE_LIMIT_AVERAGE") "100" }}
-        burst: {{ or (env "RATE_LIMIT_BURST") "200" }}
-        period: {{ or (env "RATE_LIMIT_PERIOD") "1s" }}
     security:
       headers:
         frameDeny: true
@@ -37,7 +41,6 @@ http:
         stsSeconds: "31536000"
   {{ if eq (env "METRICS_ENABLED") "1" }}
   routers:
-    {{ if ne (env "METRICS_FQDN") "" }}
     traefik-metrics:
       rule: "Host(`{{ env "METRICS_FQDN" }}`)"
       entrypoints:
@@ -47,14 +50,6 @@ http:
       middlewares:
         - basicauth@file
       service: prometheus@internal
-    {{ end }}
-    # reachable from other services on the proxy network only (this port
-    # isn't published to the host), without auth
-    traefik-metrics-internal:
-      rule: "PathPrefix(`/`)"
-      entrypoints:
-        - metrics-internal
-      service: prometheus@internal
   {{ end }}
 
 tls:

release/6.2.0+v3.7.12

@@ -1 +0,0 @@
-1. compose.metrics.yml now adds prometheus.io/scrape labels so services like monitoring-ng can automatically discover and scrape Traefik's metrics.

release/6.3.0+v3.7.13

@@ -1 +0,0 @@
-open port 3903 for garage and traefik security update

release/next

@@ -1,6 +0,0 @@
-# Rate limits
-
-You can enable rate limits globally by updating the .env file for
-Traefik.  Per-app rate limits need to be supported by each app!
-
-Limits can be tested with benchmarking tools like `wrk`.

traefik.yml.tmpl

@@ -6,21 +6,6 @@ log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
 
-{{ if eq (env "ACCESS_LOG_ENABLED") "true" }}
-accessLog:
-  format: "json"
-  filePath: "/var/log/access_log.jsonl"
-  fields:
-    defaultMode: "keep"
-    headers:
-      defaultMode: "keep"
-      names:
-        Authorization: "drop"
-        Cookie: "drop"
-    queryParameters:
-      defaultMode: "keep"
-{{ end }}
-
 providers:
   swarm:
     endpoint: "tcp://socket-proxy:2375"
@@ -48,10 +33,6 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
-{{ if ne (env "TRUSTED_IPS") "" }}
-    forwardedHeaders:
-      trustedIPs: {{ env "TRUSTED_IPS" }}
-{{ end }}
     transport:
       respondingTimeouts:
         readTimeout: {{ env "READ_TIMEOUT" }}
@@ -65,10 +46,10 @@ entrypoints:
         allowEncodedPercent: true
         allowEncodedQuestionMark: true
         allowEncodedHash: true
-  {{ if eq (env "RATE_LIMIT_EVERYTHING") "true" }}
+			{{- if eq (env "IOCAINE_ENABLE") "1" }}
       middlewares:
-        - "ip-rate-limit@file"
-  {{ end }}
+        - iocaine@file
+			{{- end }}
   {{- if eq (env "GITEA_SSH_ENABLED") "1" }}
   gitea-ssh:
     address: ":2222"
@@ -83,10 +64,6 @@ entrypoints:
   garage-rpc:
     address: ":3901"
   {{- end }}
-  {{- if eq (env "GARAGE_ADMIN_ENABLED") "1" }}
-  garage-admin:
-    address: ":3903"
-  {{- end }}
   {{- if eq (env "FOODSOFT_SMTP_ENABLED") "1" }}
   foodsoft-smtp:
     address: ":2525"
@@ -139,10 +116,6 @@ entrypoints:
   onion:
     address: ":9052"
   {{- end }}
-  {{- if eq (env "METRICS_ENABLED") "1" }}
-  metrics-internal:
-    address: ":8082"
-  {{- end }}
 
 ping:
   entryPoint: web
@@ -188,3 +161,10 @@ certificatesResolvers:
           - "1.1.1.1:53"
           - "9.9.9.9:53"
       {{- end }}
+
+{{ if eq (env "IOCAINE_ENABLE") "1" }}
+experimental:
+  localPlugins:
+    iocaine:
+      moduleName: git.mstar.dev/mstar/traefik-iocaine-middleware
+{{ end }}