doc: trusted ips context

when traefik is behind a reverse proxy, we need to tell it which
networks to trust with x-real-ip headers

.env.sample

@@ -232,3 +232,14 @@ WRITE_TIMEOUT=0s
 
 ## Enable onion service support
 #ONION_ENABLED=1
+
+## Access logs
+#COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"
+
+## Behind a reverse proxy
+#
+# YAML array of subnets from which Traefik's trusts the x-real-ip
+# header when behind a reverse proxy.
+#
+# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
+#TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example

MAINTENANCE.md

@@ -29,3 +29,4 @@ Everyone can apply to be a recipe maintainer:
 1. Watch the repository to always get updates
 2. Simply add your self to the list in the [README.md](./README.md) and open a new pull request with the change.
 3. Once the pull request gets merged you will be added to the [traefik maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/traefik-maintainers).
+4. Join the room [#cc-|-traefik-maintenance:matrix.org](#cc-|-traefik-maintenance:matrix.org) and chat to other maintainers.

README.md

@@ -80,3 +80,19 @@ If you want to collect Prometheus metrics for Anubis, for instance with
 Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).
 
 [`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
+
+## Access logs
+
+To keep access logs on a volume, uncomment the "Access logs" section.
+
+You'll need to setup rotation yourself and send the USR1 signal to
+Traefik for reloading.  For instance, with `logrotate:
+
+```
+# /etc/logrotate.d/traefik.conf
+/var/lib/docker/volumes/traefik_SERVICE_NAME_access-logs/_data/access_log.jsonl {
+  postrotate
+    pkill -USR1 traefik
+  endscript
+}
+```

abra.sh

@@ -1,4 +1,4 @@
 export TRAEFIK_YML_VERSION=v34
-export FILE_PROVIDER_YML_VERSION=v14
-export ENTRYPOINT_VERSION=v8
-export IOCAINE_ENTRYPOINT_VERSION=v1
+export FILE_PROVIDER_YML_VERSION=v12
+export ENTRYPOINT_VERSION=v5
+export ANUBIS_YML_VERSION=v1

compose.access-log.yml

@@ -0,0 +1,10 @@
+---
+version: "3.8"
+services:
+  app:
+    environment:
+      ACCESS_LOG_ENABLED: "true"
+    volumes:
+      - "access-logs:/var/log/"
+volumes:
+  access-logs:

compose.iocaine.yml

@@ -1,22 +0,0 @@
----
-version: "3.8"
-
-services:
-  app:
-    environment:
-      IOCAINE_ENABLE: "1"
-      IOCAINE_PLUGIN_VERSION: "v1.2.0"
-    volumes:
-      - "plugins-local:/plugins-local"
-
-  iocaine:
-    image: "git.madhouse-project.org/iocaine/iocaine:3.5.0"
-    environment:
-      RUST_LOG: "iocaine=info"
-    ports:
-      - "127.0.0.1:42069:42069"
-    networks:
-      - proxy
-
-volumes:
-  plugins-local:

compose.yml

@@ -27,9 +27,6 @@ services:
       - source: entrypoint
         target: /custom-entrypoint.sh
         mode: 0555
-      - source: iocaine_entrypoint
-        target: /entrypoint.iocaine.sh
-        mode: 0555
     networks:
       - proxy
       - internal
@@ -120,10 +117,6 @@ configs:
     name: ${STACK_NAME}_entrypoint_${ENTRYPOINT_VERSION}
     file: entrypoint.sh.tmpl
     template_driver: golang
-  iocaine_entrypoint:
-    name: ${STACK_NAME}_entrypoint_${IOCAINE_ENTRYPOINT_VERSION}
-    file: entrypoint.iocaine.sh.tmpl
-    template_driver: golang
 
 volumes:
   letsencrypt:

entrypoint.iocaine.sh.tmpl

@@ -1,15 +0,0 @@
-#!/bin/sh
-
-set -e
-
-apk --no-cache add git go
-iocaine_path="/plugins-local/src/git.mstar.dev/mstar/traefik-iocaine-middleware"
-if [ ! -d "$iocaine_path" ]; then
-  git clone --depth 1 --branch $IOCAINE_PLUGIN_VERSION https://git.mstar.dev/mstar/traefik-iocaine-middleware.git $iocaine_path
-else
-	git -C $iocaine_path fetch origin 'refs/tags/*:refs/tags/*'
-	git -C $iocaine_path checkout tags/$IOCAINE_PLUGIN_VERSION
-fi
-(cd $iocaine_path && go mod vendor)
-
-exit 0

entrypoint.sh.tmpl

@@ -15,8 +15,4 @@ export DO_AUTH_TOKEN=$(cat "$DO_AUTH_TOKEN_FILE")
 export AZURE_CLIENT_SECRET=$(cat "$AZURE_CLIENT_SECRET_FILE")
 {{ end }}
 
-{{ if eq (env "IOCAINE_ENABLE") "1" }}
-/entrypoint.iocaine.sh
-{{ end }}
-
 /entrypoint.sh "$@"

file-provider.yml.tmpl

@@ -17,15 +17,6 @@ http:
         authResponseHeaders:
           - X-Forwarded-User
     {{ end }}
-    {{ if eq (env "IOCAINE_ENABLE") "1" }}
-    iocaine:
-      plugin:
-        iocaine:
-          iocaineHttpUrl: "http://iocaine:42069"
-          methods:
-            - GET
-            - HEAD
-    {{ end }}
     {{ if eq (env "BASIC_AUTH") "1" }}
     basicauth:
       basicAuth:
@@ -70,4 +61,4 @@ tls:
   certificates:
     - certFile: /run/secrets/ssl_cert
       keyFile: /run/secrets/ssl_key
-  {{ end }}
+  {{ end }}

traefik.yml.tmpl

@@ -6,6 +6,21 @@ log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
 
+{{ if eq (env "ACCESS_LOG_ENABLED") "true" }}
+accessLog:
+  format: "json"
+  filePath: "/var/log/access_log.jsonl"
+  fields:
+    defaultMode: "keep"
+    headers:
+      defaultMode: "keep"
+      names:
+        Authorization: "drop"
+        Cookie: "drop"
+    queryParameters:
+      defaultMode: "keep"
+{{ end }}
+
 providers:
   swarm:
     endpoint: "tcp://socket-proxy:2375"
@@ -33,6 +48,10 @@ entrypoints:
           to: web-secure
   web-secure:
     address: ":443"
+{{ if ne (env "TRUSTED_IPS") "" }}
+    forwardedHeaders:
+      trustedIPs: {{ env "TRUSTED_IPS" }}
+{{ end }}
     transport:
       respondingTimeouts:
         readTimeout: {{ env "READ_TIMEOUT" }}
@@ -46,10 +65,6 @@ entrypoints:
         allowEncodedPercent: true
         allowEncodedQuestionMark: true
         allowEncodedHash: true
-			{{- if eq (env "IOCAINE_ENABLE") "1" }}
-      middlewares:
-        - iocaine@file
-			{{- end }}
   {{- if eq (env "GITEA_SSH_ENABLED") "1" }}
   gitea-ssh:
     address: ":2222"
@@ -161,10 +176,3 @@ certificatesResolvers:
           - "1.1.1.1:53"
           - "9.9.9.9:53"
       {{- end }}
-
-{{ if eq (env "IOCAINE_ENABLE") "1" }}
-experimental:
-  localPlugins:
-    iocaine:
-      moduleName: git.mstar.dev/mstar/traefik-iocaine-middleware
-{{ end }}