feat: Add labels for label-based metric scraping

Add prometheus.io labels to compose.metrics.yml so monitoring-ng can
auto-discover and scrape Traefik's metrics on the internal network when
enabled.

.env.sample

@@ -215,8 +215,6 @@ WRITE_TIMEOUT=0s
 ## Garage
 #COMPOSE_FILE="$COMPOSE_FILE:compose.garage.yml"
 #GARAGE_RPC_ENABLED=1
-#COMPOSE_FILE="$COMPOSE_FILE:compose.garage-admin.yml"
-#GARAGE_ADMIN_ENABLED=1
 
 ## Nextcloud Talk HPB
 #COMPOSE_FILE="$COMPOSE_FILE:compose.nextcloud-talk-hpb.yml"
@@ -241,20 +239,3 @@ WRITE_TIMEOUT=0s
 
 ## Access logs
 #COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
-
-## Behind a reverse proxy
-#
-# YAML array of subnets from which Traefik's trusts the x-real-ip
-# header when behind a reverse proxy.
-#
-# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
-#TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example
-
-## Rate limits
-# You can enable universal rate limits by setting RATE_LIMIT_EVERYTHING
-# to true, otherwise each app needs to export their own middleware labels.
-#
-# https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/ratelimit/
-#RATE_LIMIT_EVERYTHING=false
-#RATE_LIMIT_AVERAGE=100
-#RATE_LIMIT_BURST=200

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v37
-export FILE_PROVIDER_YML_VERSION=v14
+export TRAEFIK_YML_VERSION=v35
+export FILE_PROVIDER_YML_VERSION=v13
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1

compose.garage-admin.yml

@@ -1,10 +0,0 @@
-version: "3.8"
-services:
-  app:
-    environment:
-      - GARAGE_ADMIN_ENABLED
-    ports:
-      - target: 3903
-        published: 3903
-        protocol: tcp
-        mode: host

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v3.7.13"
+    image: "traefik:v3.7.10"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
@@ -57,12 +57,12 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.service=api@internal"
         - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=6.2.0+v3.7.12"
+        - "coop-cloud.${STACK_NAME}.version=6.1.0+v3.7.10"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.4.4
+    image: lscr.io/linuxserver/socket-proxy:3.4.3
     deploy:
       endpoint_mode: dnsrr
     environment:

file-provider.yml.tmpl

@@ -22,11 +22,6 @@ http:
       basicAuth:
         usersFile: "/run/secrets/usersfile"
     {{ end }}
-    ip-rate-limit:
-      rateLimit:
-        average: {{ or (env "RATE_LIMIT_AVERAGE") "100" }}
-        burst: {{ or (env "RATE_LIMIT_BURST") "200" }}
-        period: "1s"
     security:
       headers:
         frameDeny: true
@@ -75,4 +70,4 @@ tls:
   certificates:
     - certFile: /run/secrets/ssl_cert
       keyFile: /run/secrets/ssl_key
-  {{ end }}
+  {{ end }}

traefik.yml.tmpl

@@ -48,14 +48,6 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
-{{ if ne (env "TRUSTED_IPS") "" }}
-    forwardedHeaders:
-      trustedIPs: {{ env "TRUSTED_IPS" }}
-{{ end }}
-{{ if eq (env "RATE_LIMIT_EVERYTHING") "true" }}
-    middlewares:
-      - "ip-rate-limit@file"
-{{ end }}
     transport:
       respondingTimeouts:
         readTimeout: {{ env "READ_TIMEOUT" }}
@@ -83,10 +75,6 @@ entrypoints:
   garage-rpc:
     address: ":3901"
   {{- end }}
-  {{- if eq (env "GARAGE_ADMIN_ENABLED") "1" }}
-  garage-admin:
-    address: ":3903"
-  {{- end }}
   {{- if eq (env "FOODSOFT_SMTP_ENABLED") "1" }}
   foodsoft-smtp:
     address: ":2525"