diff --git a/.env.sample b/.env.sample index bc877f0..046c2ad 100644 --- a/.env.sample +++ b/.env.sample @@ -15,6 +15,13 @@ LOG_MAX_AGE=1 # This is here so later lines can extend it; you likely don't wanna edit COMPOSE_FILE="compose.yml" +# Increase read timeout (or change it to 0s) to ensure large file +# uploads work. +# +# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-transport-respondingTimeouts-readTimeout +READ_TIMEOUT=60s +WRITE_TIMEOUT=0s + ##################################################################### # General settings # ##################################################################### @@ -152,6 +159,10 @@ COMPOSE_FILE="compose.yml" #COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml" #SMTP_ENABLED=1 +## PGSQL recipe open port 5432 +#COMPOSE_FILE="$COMPOSE_FILE:compose.pgsql.yml" +#PGSQL_ENABLED=1 + ## Compy #COMPOSE_FILE="$COMPOSE_FILE:compose.compy.yml" #COMPY_ENABLED=1 @@ -216,5 +227,8 @@ COMPOSE_FILE="compose.yml" #ANUBIS_SERVE_ROBOTS_TXT=true #ANUBIS_SLOG_LEVEL=INFO +## Anubis metrics +#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis-metrics.yml" + ## Enable onion service support #ONION_ENABLED=1 diff --git a/README.md b/README.md index b845d48..6e141b9 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ > https://docs.traefik.io -* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@decentral1se](https://git.coopcloud.tech/decentral1se), [@javielico](https://git.coopcloud.tech/javielico), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla) +* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@javielico](https://git.coopcloud.tech/javielico), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla) * **Status**: `stable` * **Category**: Utilities * **Features**: ? @@ -72,6 +72,9 @@ After deploying these changes, go to each recipe that supports Anubis and follow the process there. **Enabling Anubis here is not enough for protection your apps.** +If you want to collect Prometheus metrics for Anubis, for instance with +[monitoring-ng](/monitoring-ng), uncomment the "Anubis metrics" section. + ## Enabling onion service Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion). diff --git a/anubis.yml.tmpl b/anubis.yml.tmpl new file mode 100644 index 0000000..7526aa9 --- /dev/null +++ b/anubis.yml.tmpl @@ -0,0 +1,7 @@ +bots: +- import: (data)/meta/default-config.yaml +{{ if eq (env "ANUBIS_METRICS_ENABLED") "true" }} +metrics: + bind: ":9090" + network: "tcp" +{{ end }} diff --git a/compose.anubis-metrics.yml b/compose.anubis-metrics.yml new file mode 100644 index 0000000..de5baa7 --- /dev/null +++ b/compose.anubis-metrics.yml @@ -0,0 +1,11 @@ +--- +version: "3.8" +services: + anubis: + environment: + ANUBIS_METRICS_ENABLED: "true" + deploy: + labels: + - "prometheus.io/scrape=true" + - "prometheus.io/port=9090" + - "prometheus.io/path=/metrics" diff --git a/compose.anubis.yml b/compose.anubis.yml index adb4411..e51dd35 100644 --- a/compose.anubis.yml +++ b/compose.anubis.yml @@ -5,8 +5,9 @@ services: deploy: labels: - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check" + - "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true" anubis: - image: "ghcr.io/techarohq/anubis:v1.25.0" + image: "ghcr.io/techarohq/anubis:v1.27.0" environment: BIND: ":8080" TARGET: " " @@ -18,6 +19,10 @@ services: OG_CACHE_CONSIDER_HOST: "${ANUBIS_OG_CACHE_CONSIDER_HOST}" SERVE_ROBOTS_TXT: "${ANUBIS_SERVE_ROBOTS_TXT}" SLOG_LEVEL: "${ANUBIS_SLOG_LEVEL:-INFO}" + POLICY_FNAME: "/data/cfg/botPolicy.yaml" + configs: + - source: anubis_yml + target: /data/cfg/botPolicy.yaml networks: - proxy deploy: @@ -28,3 +33,8 @@ services: - "traefik.http.routers.anubis.entrypoints=web-secure" - "traefik.http.services.anubis.loadbalancer.server.port=8080" - "traefik.http.routers.anubis.service=anubis" +configs: + anubis_yml: + name: ${STACK_NAME}_anubis_yml_${ANUBIS_YML_VERSION} + file: anubis.yml.tmpl + template_driver: golang diff --git a/compose.pgsql.yml b/compose.pgsql.yml new file mode 100644 index 0000000..c7d3f9e --- /dev/null +++ b/compose.pgsql.yml @@ -0,0 +1,12 @@ +--- +version: "3.8" + +services: + app: + environment: + - PGSQL_ENABLED + ports: + - target: 5432 + published: 5432 + protocol: tcp + mode: host \ No newline at end of file diff --git a/compose.yml b/compose.yml index a8e9c56..559ac05 100644 --- a/compose.yml +++ b/compose.yml @@ -3,7 +3,7 @@ version: "3.8" services: app: - image: "traefik:v3.7.5" + image: "traefik:v3.7.10" # Note(decentral1se): *please do not* add any additional ports here. # Doing so could break new installs with port conflicts. Please use # the usual `compose.$app.yml` approach for any additional ports @@ -37,6 +37,8 @@ services: - DASHBOARD_ENABLED - LOG_LEVEL - ${LOG_MAX_AGE:-0} + - READ_TIMEOUT=${READ_TIMEOUT:-60s} + - WRITE_TIMEOUT=${WRITE_TIMEOUT:-0s} healthcheck: test: ["CMD", "traefik", "healthcheck"] interval: 30s @@ -58,12 +60,12 @@ services: - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}" - "traefik.http.routers.${STACK_NAME}.service=api@internal" - "traefik.http.routers.${STACK_NAME}.middlewares=security@file" - - "coop-cloud.${STACK_NAME}.version=5.1.1+v3.6.15" + - "coop-cloud.${STACK_NAME}.version=6.1.0+v3.7.10" - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}" - "backupbot.backup=${ENABLE_BACKUPS:-true}" socket-proxy: - image: lscr.io/linuxserver/socket-proxy:3.4.0 + image: lscr.io/linuxserver/socket-proxy:3.4.3 deploy: endpoint_mode: dnsrr environment: diff --git a/release/6.0.0+v3.7.7 b/release/6.0.0+v3.7.7 new file mode 100644 index 0000000..204e5b7 --- /dev/null +++ b/release/6.0.0+v3.7.7 @@ -0,0 +1,13 @@ +!Breaking: Starting with v3.6.16, the Docker provider requires Docker API version v1.40 or above (Docker Engine v19.03). Users running older (end of life) versions of Docker Engine should update their Docker Engine or use the DOCKER_API_VERSION environment variable to override the API version used by Traefik. + +letsencrypt: Avoid HTTP-01 challenge if `LETS_ENCRYPT_DNS_CHALLENGE_ENABLED` is set, in order to rely on DNS-01 challenges for servers not exposed to the internet. + +matrix-federation: Entrypoint was changed to :8448 to match published port + +fix: ensure large uploads work. You can now set the following env vars: +- READ_TIMEOUT +- WRITE_TIMEOUT + +cloudflare: Add Cloudflare as DNS provider + +For more information take a look at the migration guide: https://doc.traefik.io/traefik/v3.7/migrate/v3/#v377 diff --git a/release/6.1.0+v3.7.10 b/release/6.1.0+v3.7.10 new file mode 100644 index 0000000..6ef23d1 --- /dev/null +++ b/release/6.1.0+v3.7.10 @@ -0,0 +1 @@ +Adds option ability to open ports for PGSQL recipe, new version of anubis, and ability to add anubis metrics on this release. \ No newline at end of file diff --git a/release/next b/release/next deleted file mode 100644 index 08d5a07..0000000 --- a/release/next +++ /dev/null @@ -1 +0,0 @@ -letsencrypt: Avoid HTTP-01 challenge if `LETS_ENCRYPT_DNS_CHALLENGE_ENABLED` is set, in order to rely on DNS-01 challenges for servers not exposed to the internet. diff --git a/traefik.yml.tmpl b/traefik.yml.tmpl index a4c0a68..843eaa3 100644 --- a/traefik.yml.tmpl +++ b/traefik.yml.tmpl @@ -33,6 +33,10 @@ entrypoints: to: web-secure web-secure: address: ":443" + transport: + respondingTimeouts: + readTimeout: {{ env "READ_TIMEOUT" }} + writeTimeout: {{ env "WRITE_TIMEOUT" }} http: encodedCharacters: allowEncodedSlash: true @@ -100,7 +104,7 @@ entrypoints: {{- end }} {{- if eq (env "MATRIX_FEDERATION_ENABLED") "1" }} matrix-federation: - address: ":9001" + address: ":8448" {{- end }} {{- if eq (env "NEXTCLOUD_TALK_HPB_ENABLED") "1" }} nextcloud-talk-hpb: