doc: release notes

feat: period is also configurable
feat: implement basic rate limiting by ip address
2026-10-08 11:40:34 -03:00 · 2026-10-08 11:24:14 -03:00 · 2026-10-03 01:31:30 -03:00 · 2026-09-28 08:48:50 +00:00 · 2026-09-28 08:47:58 +00:00 · 2026-09-11 13:30:15 +02:00
20 changed files with 184 additions and 135 deletions
@@ -110,11 +110,11 @@ WRITE_TIMEOUT=0s

 # Set wildcards = 1, and uncomment compose_file to enable.
 # Create your certs elsewhere and add them like:
-# abra app secret insert {myapp.example.coop} ssl_cert v1 "$(cat /path/to/fullchain.pem)"
-# abra app secret insert {myapp.example.coop} ssl_key v1 "$(cat /path/to/privkey.pem)"
+# abra app secret insert traefik.example.coop ssl_cert v1 -f /path/to/fullchain.pem
+# abra app secret insert traefik.example.coop ssl_key v1 -f /path/to/privkey.pem
 #WILDCARDS_ENABLED=1
-#SECRET_WILDCARD_CERT_VERSION=v1
-#SECRET_WILDCARD_KEY_VERSION=v1
+#SECRET_WILDCARD_CERT_VERSION=v1 # generate=false
+#SECRET_WILDCARD_KEY_VERSION=v1 # generate=false
 #COMPOSE_FILE="$COMPOSE_FILE:compose.wildcard.yml"

 #####################################################################
@@ -139,10 +139,14 @@ WRITE_TIMEOUT=0s
 #####################################################################

 ## Enable prometheus metrics collection
-## used used by the coop-cloud monitoring stack
-## BASIC_AUTH should also be enabled
+## Metrics are served unauthenticated on :8082, reachable only from
+## other services on the proxy network (e.g. monitoring-ng's Alloy,
+## which auto-discovers it via the prometheus.io/scrape label)
 #COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
 #METRICS_ENABLED=1
+
+## Setting METRICS_FQDN also adds a public metrics endpoint (behind
+## basic auth). BASIC_AUTH should be enabled for this.
 #METRICS_FQDN=metrics.traefik.example.com

 #####################################################################
@@ -159,6 +163,10 @@ WRITE_TIMEOUT=0s
 #COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml"
 #SMTP_ENABLED=1

+## PGSQL recipe open port 5432
+#COMPOSE_FILE="$COMPOSE_FILE:compose.pgsql.yml"
+#PGSQL_ENABLED=1
+
 ## Compy
 #COMPOSE_FILE="$COMPOSE_FILE:compose.compy.yml"
 #COMPY_ENABLED=1
@@ -207,6 +215,8 @@ WRITE_TIMEOUT=0s
 ## Garage
 #COMPOSE_FILE="$COMPOSE_FILE:compose.garage.yml"
 #GARAGE_RPC_ENABLED=1
+#COMPOSE_FILE="$COMPOSE_FILE:compose.garage-admin.yml"
+#GARAGE_ADMIN_ENABLED=1

 ## Nextcloud Talk HPB
 #COMPOSE_FILE="$COMPOSE_FILE:compose.nextcloud-talk-hpb.yml"
@@ -223,11 +233,29 @@ WRITE_TIMEOUT=0s
 #ANUBIS_SERVE_ROBOTS_TXT=true
 #ANUBIS_SLOG_LEVEL=INFO

-## Crowdsec
-#COMPOSE_FILE="$COMPOSE_FILE:compose.crowdsec.yml"
-#CROWDSEC_ENABLED=1
-#CROWDSEC_BOUNCER_ENABLED=1
-#CROWDSEC_TRAEFIK_BOUNCER_API_KEY="some-api-key"
+## Anubis metrics
+#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis-metrics.yml"

 ## Enable onion service support
 #ONION_ENABLED=1
+
+## Access logs
+#COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
+
+## Behind a reverse proxy
+#
+# YAML array of subnets from which Traefik's trusts the x-real-ip
+# header when behind a reverse proxy.
+#
+# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
+#TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example
+
+## Rate limits
+# You can enable universal rate limits by setting RATE_LIMIT_EVERYTHING
+# to true, otherwise each app needs to export their own middleware labels.
+#
+# https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/ratelimit/
+#RATE_LIMIT_EVERYTHING=false
+#RATE_LIMIT_AVERAGE=100
+#RATE_LIMIT_BURST=200
+#RATE_LIMIT_PERIOD=1s
@@ -29,3 +29,4 @@ Everyone can apply to be a recipe maintainer:
 1. Watch the repository to always get updates
 2. Simply add your self to the list in the [README.md](./README.md) and open a new pull request with the change.
 3. Once the pull request gets merged you will be added to the [traefik maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/traefik-maintainers).
+4. Join the room [#cc-|-traefik-maintenance:matrix.org](#cc-|-traefik-maintenance:matrix.org) and chat to other maintainers.
@@ -5,7 +5,7 @@
 > https://docs.traefik.io

 <!-- metadata -->
-* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@decentral1se](https://git.coopcloud.tech/decentral1se), [@javielico](https://git.coopcloud.tech/javielico), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
+* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@javielico](https://git.coopcloud.tech/javielico), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
 * **Status**: `stable`
 * **Category**: Utilities
 * **Features**: ?
@@ -72,54 +72,27 @@ After deploying these changes, go to each recipe that supports Anubis
 and follow the process there.  **Enabling Anubis here is not enough for
 protection your apps.**

-## Crowdsec
-
-IMPORTANT even though Crowdsec is Open Source, the software sends information of the attacker IP and what decision(ban or captcha) to a centralized server for communit managed block lists.
-
-On first deployment you need to generate an empty secret, because the lapi key is created at runtime.
-```
-abra app secret insert <domain> crowdsec_lapi_key v1
-```
-
-Then deploy your traefik recipe with the crowdsec compose and variables enabled and set `CROWDSEC_BOUNCER_ENABLED=0` to prevent initializing the bouncer that has no key yet.
-
-When traefik is running, generate the LAPI key with the following command:
-```
-abra app run <domain> crowdsec cscli bouncers add crowdsecBouncer
-```
-
-After that insert the LAPI key(command below) and redeploy traefik with `CROWDSEC_BOUNCER_ENABLED=1` and `CROWDSEC_TRAEFIK_CONFIG_VERSION=v2`.
-```
-abra app secret insert <domain> crowdsec_lapi_key v2 -f -t <path-to/lapi-key-file>
-```
-
-When it is up and running go to the recipe you want to protect and add the following snippet and redeploy.
-```
---
-version: "3.8"
-services:
-  app:
-    deploy:
-      labels:
-        - "traefik.http.routers.${STACK_NAME}.middlewares=crowdsec@file"
-```
-
-You can see if it is working by checking the ban list.
-```
-abra app run <domain> crowdsec cscli decisions list
-```
-
-When there are not bans yet you can try by banning your own IP.
-```
-abra app run <domain> crowdsec cscli decisions add --ip <your-ip> -d 10m # this will be effective 10min
-```
-Remove it with:
-```
-abra app run <domain> crowdsec cscli decisions remove --ip <your-ip> # this can still take a few minutes because of cache
-```
+If you want to collect Prometheus metrics for Anubis, for instance with
+[monitoring-ng](/monitoring-ng), uncomment the "Anubis metrics" section.

 ## Enabling onion service

 Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).

 [`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
+
+## Access logs
+
+To keep access logs on a volume, uncomment the "Access logs" section.
+
+You'll need to setup rotation yourself and send the USR1 signal to
+Traefik for reloading.  For instance, with `logrotate:
+
+```
+# /etc/logrotate.d/traefik.conf
+/var/lib/docker/volumes/traefik_SERVICE_NAME_access-logs/_data/access_log.jsonl {
+  postrotate
+    pkill -USR1 traefik
+  endscript
+}
+```
@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v33
-export FILE_PROVIDER_YML_VERSION=v15
+export TRAEFIK_YML_VERSION=v37
+export FILE_PROVIDER_YML_VERSION=v14
 export ENTRYPOINT_VERSION=v5
-export CROWDSEC_TRAEFIK_CONFIG_VERSION=v1
+export ANUBIS_YML_VERSION=v1
@@ -0,0 +1,7 @@
+bots:
+- import: (data)/meta/default-config.yaml
+{{ if eq (env "ANUBIS_METRICS_ENABLED") "true" }}
+metrics:
+  bind: ":9090"
+  network: "tcp"
+{{ end }}
@@ -0,0 +1,10 @@
+---
+version: "3.8"
+services:
+  app:
+    environment:
+      ACCESS_LOG_ENABLED: "true"
+    volumes:
+      - "access-logs:/var/log/"
+volumes:
+  access-logs:
@@ -0,0 +1,11 @@
+---
+version: "3.8"
+services:
+  anubis:
+    environment:
+      ANUBIS_METRICS_ENABLED: "true"
+    deploy:
+      labels:
+      - "prometheus.io/scrape=true"
+      - "prometheus.io/port=9090"
+      - "prometheus.io/path=/metrics"
@@ -7,7 +7,7 @@ services:
      - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
      - "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true"
  anubis:
-    image: "ghcr.io/techarohq/anubis:v1.25.0"
+    image: "ghcr.io/techarohq/anubis:v1.27.0"
    environment:
      BIND: ":8080"
      TARGET: " "
@@ -19,6 +19,10 @@ services:
      OG_CACHE_CONSIDER_HOST: "${ANUBIS_OG_CACHE_CONSIDER_HOST}"
      SERVE_ROBOTS_TXT: "${ANUBIS_SERVE_ROBOTS_TXT}"
      SLOG_LEVEL: "${ANUBIS_SLOG_LEVEL:-INFO}"
+      POLICY_FNAME: "/data/cfg/botPolicy.yaml"
+    configs:
+    - source: anubis_yml
+      target: /data/cfg/botPolicy.yaml
    networks:
    - proxy
    deploy:
@@ -29,3 +33,8 @@ services:
      - "traefik.http.routers.anubis.entrypoints=web-secure"
      - "traefik.http.services.anubis.loadbalancer.server.port=8080"
      - "traefik.http.routers.anubis.service=anubis"
+configs:
+  anubis_yml:
+    name: ${STACK_NAME}_anubis_yml_${ANUBIS_YML_VERSION}
+    file: anubis.yml.tmpl
+    template_driver: golang
@@ -1,42 +0,0 @@
-version: "3.8"
-services:
-  app:
-    deploy:
-      labels:
-        - "traefik.http.routers.${STACK_NAME}.middlewares=crowdsec@file"
-    secrets:
-      - crowdsec_lapi_key
-  crowdsec:
-    image: crowdsecurity/crowdsec:v1.7.8
-    environment:
-      GID: "${GID-1000}"
-      COLLECTIONS: "crowdsecurity/linux crowdsecurity/traefik"
-    volumes:
-      - crowdsec-db:/var/lib/crowdsec/data/
-      - crowdsec-config:/etc/crowdsec/
-      - traefik-logs:/var/log/traefik/:ro
-    configs:
-      - source: crowdsec_traefik_config
-        target: /etc/crowdsec/acquis.d/traefik_config.yaml
-        mode: 0555
-    networks:
-      - internal
-    deploy:
-      update_config:
-        failure_action: rollback
-        order: stop-first
-
-configs:
-  crowdsec_traefik_config:
-    name: ${STACK_NAME}_crowdsec_traefik_${CROWDSEC_TRAEFIK_CONFIG_VERSION}
-    file: crowdsec_traefik_config.yaml.tmpl
-    template_driver: golang
-
-secrets:
-  crowdsec_lapi_key:
-    external: true
-    name: ${STACK_NAME}_crowdsec_lapi_key_${SECRET_CROWDSEC_LAPI_KEY_VERSION}
-
-volumes:
-  crowdsec-db:
-  crowdsec-config:
@@ -0,0 +1,10 @@
+version: "3.8"
+services:
+  app:
+    environment:
+      - GARAGE_ADMIN_ENABLED
+    ports:
+      - target: 3903
+        published: 3903
+        protocol: tcp
+        mode: host
@@ -3,3 +3,9 @@ services:
  app:
    environment:
      - METRICS_ENABLED
+    deploy:
+      labels:
+        # lets monitoring-ng's Alloy auto-discover and scrape metrics-internal
+        # via the proxy network.
+        - "prometheus.io/scrape=true"
+        - "prometheus.io/port=8082"
@@ -0,0 +1,12 @@
+---
+version: "3.8"
+
+services:
+  app:
+    environment:
+      - PGSQL_ENABLED
+    ports:
+      - target: 5432
+        published: 5432
+        protocol: tcp
+        mode: host
@@ -3,7 +3,7 @@ version: "3.8"

 services:
  app:
-    image: "traefik:v3.7.8"
+    image: "traefik:v3.7.13"
    # Note(decentral1se): *please do not* add any additional ports here.
    # Doing so could break new installs with port conflicts. Please use
    # the usual `compose.$app.yml` approach for any additional ports
@@ -19,7 +19,6 @@ services:
    volumes:
      - "letsencrypt:/etc/letsencrypt"
      - "file-providers:/etc/traefik/file-providers"
-      - "traefik-logs:/var/log/traefik"
    configs:
      - source: traefik_yml
        target: /etc/traefik/traefik.yml
@@ -58,12 +57,12 @@ services:
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}.service=api@internal"
        - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=6.0.0+v3.7.7"
+        - "coop-cloud.${STACK_NAME}.version=6.3.0+v3.7.13"
        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
        - "backupbot.backup=${ENABLE_BACKUPS:-true}"

  socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.4.2
+    image: lscr.io/linuxserver/socket-proxy:3.4.5
    deploy:
      endpoint_mode: dnsrr
    environment:
@@ -122,4 +121,3 @@ configs:
 volumes:
  letsencrypt:
  file-providers:
-  traefik-logs:
@@ -1,5 +0,0 @@
-filenames:
-  - /var/log/traefik/*
-labels:
-  type: traefik
-
@@ -22,16 +22,11 @@ http:
      basicAuth:
        usersFile: "/run/secrets/usersfile"
    {{ end }}
-    {{ if eq (env "CROWDSEC_ENABLED") "1" }}
-    crowdsec:
-      plugin:
-        bouncer:
-          enabled: {{ if eq (env "CROWDSEC_BOUNCER_ENABLED") "1" }}true{{ else }}false{{ end }}
-          logLevel: DEBUG
-          crowdsecMode: live
-          crowdsecLapiKey: "{{ if eq (env "CROWDSEC_BOUNCER_ENABLED") "1" }}{{ secret "crowdsec_lapi_key" }}{{ else }}please_set_CROWDSEC_BOUNCER_ENABLED_to_1{{ end }}"
-          crowdsecLapiHost: crowdsec:8080
-    {{ end }}
+    ip-rate-limit:
+      rateLimit:
+        average: {{ or (env "RATE_LIMIT_AVERAGE") "100" }}
+        burst: {{ or (env "RATE_LIMIT_BURST") "200" }}
+        period: {{ or (env "RATE_LIMIT_PERIOD") "1s" }}
    security:
      headers:
        frameDeny: true
@@ -42,6 +37,7 @@ http:
        stsSeconds: "31536000"
  {{ if eq (env "METRICS_ENABLED") "1" }}
  routers:
+    {{ if ne (env "METRICS_FQDN") "" }}
    traefik-metrics:
      rule: "Host(`{{ env "METRICS_FQDN" }}`)"
      entrypoints:
@@ -51,6 +47,14 @@ http:
      middlewares:
        - basicauth@file
      service: prometheus@internal
+    {{ end }}
+    # reachable from other services on the proxy network only (this port
+    # isn't published to the host), without auth
+    traefik-metrics-internal:
+      rule: "PathPrefix(`/`)"
+      entrypoints:
+        - metrics-internal
+      service: prometheus@internal
  {{ end }}

 tls:
@@ -0,0 +1 @@
+Adds option ability to open ports for PGSQL recipe, new version of anubis, and ability to add anubis metrics on this release.
@@ -0,0 +1 @@
+1. compose.metrics.yml now adds prometheus.io/scrape labels so services like monitoring-ng can automatically discover and scrape Traefik's metrics.
@@ -0,0 +1 @@
+open port 3903 for garage and traefik security update
@@ -0,0 +1,6 @@
+# Rate limits
+
+You can enable rate limits globally by updating the .env file for
+Traefik.  Per-app rate limits need to be supported by each app!
+
+Limits can be tested with benchmarking tools like `wrk`.
@@ -5,11 +5,21 @@ core:
 log:
  level: {{ env "LOG_LEVEL" }}
  maxAge: {{ env "LOG_MAX_AGE" }}
-{{- if eq (env "CROWDSEC_ENABLED") "1" }}
-  filePath: "/var/log/traefik/traefik.log"
+
+{{ if eq (env "ACCESS_LOG_ENABLED") "true" }}
 accessLog:
-  filePath: "/var/log/traefik/access.log"
-{{- end }}
+  format: "json"
+  filePath: "/var/log/access_log.jsonl"
+  fields:
+    defaultMode: "keep"
+    headers:
+      defaultMode: "keep"
+      names:
+        Authorization: "drop"
+        Cookie: "drop"
+    queryParameters:
+      defaultMode: "keep"
+{{ end }}

 providers:
  swarm:
@@ -38,6 +48,10 @@ entrypoints:
          to: web-secure
  web-secure:
    address: ":443"
+{{ if ne (env "TRUSTED_IPS") "" }}
+    forwardedHeaders:
+      trustedIPs: {{ env "TRUSTED_IPS" }}
+{{ end }}
    transport:
      respondingTimeouts:
        readTimeout: {{ env "READ_TIMEOUT" }}
@@ -51,6 +65,10 @@ entrypoints:
        allowEncodedPercent: true
        allowEncodedQuestionMark: true
        allowEncodedHash: true
+  {{ if eq (env "RATE_LIMIT_EVERYTHING") "true" }}
+      middlewares:
+        - "ip-rate-limit@file"
+  {{ end }}
  {{- if eq (env "GITEA_SSH_ENABLED") "1" }}
  gitea-ssh:
    address: ":2222"
@@ -65,6 +83,10 @@ entrypoints:
  garage-rpc:
    address: ":3901"
  {{- end }}
+  {{- if eq (env "GARAGE_ADMIN_ENABLED") "1" }}
+  garage-admin:
+    address: ":3903"
+  {{- end }}
  {{- if eq (env "FOODSOFT_SMTP_ENABLED") "1" }}
  foodsoft-smtp:
    address: ":2525"
@@ -117,6 +139,10 @@ entrypoints:
  onion:
    address: ":9052"
  {{- end }}
+  {{- if eq (env "METRICS_ENABLED") "1" }}
+  metrics-internal:
+    address: ":8082"
+  {{- end }}

 ping:
  entryPoint: web
@@ -162,11 +188,3 @@ certificatesResolvers:
          - "1.1.1.1:53"
          - "9.9.9.9:53"
      {{- end }}
-
-{{ if eq (env "CROWDSEC_ENABLED") "1" }}
-experimental:
-  plugins:
-    bouncer:
-      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
-      version: v1.6.0
-{{- end }}
				`@@ -0,0 +1 @@`
				`Adds option ability to open ports for PGSQL recipe, new version of anubis, and ability to add anubis metrics on this release.`
				`@@ -0,0 +1 @@`
				`1. compose.metrics.yml now adds prometheus.io/scrape labels so services like monitoring-ng can automatically discover and scrape Traefik's metrics.`
				`@@ -0,0 +1 @@`
				`open port 3903 for garage and traefik security update`