feat: support UDP proxy of port 2022 and 2023 for P2Panda apps (#70)

# Support P2P communication between P2Panda Apps

Apps built with the set of [P2Panda](https://p2panda.org/) libraries perform P2P communication over two UDP ports. The default ports for these are 2022 and 2023.

There aren't really a lot (any?) P2Panda web apps out there, most are desktop or mobile apps.

So, this change is being specifically request by the [LoRes Tech](https://lores.tech/) project in order to support our [LoRes Node](https://github.com/local-resilience-tech/lores-node/) app. We have a recipe drafted for this [here](https://codeberg.org/lores/lores-node-coop-cloud-recipe) and we will push that to the catalogue once this change is in.

It seems better to make this kiwix change as general as possible, which is why we called the flag `P2PANDA_ENABLED` rather than `LORES_NODE_ENABLED`. In practice if there was a larger ecosystem of such apps, we'd probably need to make the actual port numbers configurable.

Reviewed-on: coop-cloud/traefik#70
Reviewed-by: p4u1 <p4u1@noreply.git.coopcloud.tech>
Co-authored-by: Jade Ambrose <jade@noreply.git.coopcloud.tech>
Co-committed-by: Jade Ambrose <jade@noreply.git.coopcloud.tech>

.drone.yml

@@ -16,7 +16,7 @@ steps:
       STACK_NAME: traefik
       LETS_ENCRYPT_ENV: production
       LETS_ENCRYPT_EMAIL: helo@autonomic.zone
-      TRAEFIK_YML_VERSION: v21
+      TRAEFIK_YML_VERSION: v26
       FILE_PROVIDER_YML_VERSION: v10
       ENTRYPOINT_VERSION: v4
 trigger:

.env.sample

@@ -10,6 +10,7 @@ LETS_ENCRYPT_EMAIL=certs@example.com
 # DASHBOARD_ENABLED=true
 # WARN, INFO etc.
 LOG_LEVEL=WARN
+LOG_MAX_AGE=1
 
 # This is here so later lines can extend it; you likely don't wanna edit
 COMPOSE_FILE="compose.yml"
@@ -58,6 +59,17 @@ COMPOSE_FILE="compose.yml"
 #DIGITALOCEAN_ENABLED=1
 #SECRET_DIGITALOCEAN_AUTH_TOKEN_VERSION=v1
 
+## Azure, https://azure.com
+## To insert your Azure client secret:
+## abra app secret insert {myapp.example.coop} azure_secret v1 "<CLIENT_SECRET>"
+#COMPOSE_FILE="$COMPOSE_FILE:compose.azure.yml"
+#AZURE_ENABLED=1
+#AZURE_TENANT_ID=
+#AZURE_CLIENT_ID=
+#AZURE_SUBSCRIPTION_ID=
+#AZURE_RESOURCE_GROUP=
+#SECRET_AZURE_SECRET_VERSION=v1
+
 #####################################################################
 # Manual wildcard certificate insertion                             #
 #####################################################################
@@ -119,6 +131,10 @@ COMPOSE_FILE="compose.yml"
 # COMPOSE_FILE="$COMPOSE_FILE:compose.gitea.yml"
 # GITEA_SSH_ENABLED=1
 
+## P2Panda UDP
+# COMPOSE_FILE="$COMPOSE_FILE:compose.p2panda.yml"
+# P2PANDA_ENABLED=1
+
 ## Foodsoft SMTP
 # COMPOSE_FILE="$COMPOSE_FILE:compose.foodsoft.yml"
 # FOODSOFT_SMTP_ENABLED=1
@@ -147,3 +163,11 @@ COMPOSE_FILE="compose.yml"
 # NOTE(3wc): as of 2024-04-01 only the `icecast` recipe uses this
 #COMPOSE_FILE="$COMPOSE_FILE:compose.web-alt.yml"
 #WEB_ALT_ENABLED=1
+
+## Matrix
+#COMPOSE_FILE="$COMPOSE_FILE:compose.irc.yml"
+#IRC_ENABLED=1
+
+## Garage
+#COMPOSE_FILE="$COMPOSE_FILE:compose.garage.yml"
+#GARAGE_RPC_ENABLED=1

MAINTENANCE.md

@@ -0,0 +1,24 @@
+# Traefik Recipe Maintenance
+
+All contributions should be made via a pull request. This is to ensure a certain quality / consistency, that others can rely on.
+
+
+## Maintainer Responsibilities
+
+A recipe maintainer has the following responsibilities:
+- respond to pull requests / issues within a week
+- make image security updates within a day
+- make image patch / minor updates within a week
+- make image major updates within a month
+
+In order to fullfill these responsibilities a recipe maintainer:
+- has to watch the repository (to get notifications)
+- needs to make sure renovate is configured properly
+
+## Merge rules
+
+A pull request can be merged if it is approved by at least one maintainer. For pull requests opened by a maintainer they need to be approved by another maintainer.
+
+## Becoming a maintainer
+
+Everyone can apply to be a recipe maintainer. Simply add your self to the list in the [README.md](./README.md) and open a new pull request with the change.

README.md

@@ -1,12 +1,14 @@
 # Traefik
 
-[![Build Status](https://drone.autonomic.zone/api/badges/coop-cloud/traefik/status.svg)](https://drone.autonomic.zone/coop-cloud/traefik)
+[![Build Status](https://build.coopcloud.tech/api/badges/coop-cloud/traefik/status.svg)](https://build.coopcloud.tech/coop-cloud/traefik)
 
 > https://docs.traefik.io
 
 <!-- metadata -->
+* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1)
+* **Status**: `stable`
 * **Category**: Utilities
-* **Status**: ?
+* **Features**: ?
 * **Image**: [`traefik`](https://hub.docker.com/_/traefik), 4, upstream
 * **Healthcheck**: Yes
 * **Backups**: No
@@ -23,6 +25,13 @@
    your Docker swarm box
 4. `abra app deploy YOURAPPDOMAIN`
 
+## Configuring basic auth
+
+1. Create the usersfile locally: `htpasswd -c usersfile <username>`
+2. Uncomment the Basic Auth section in your .env file
+3. Insert the secret: `abra app secret insert <domain> usersfile v1 -f usersfile
+4. Redploy your app: `abra app deploy -f <domain>`
+
 ## Configuring wildcard SSL using DNS
 
 Automatic certificate generation will Just Work™ for most recipes  which use a fixed

abra.sh

@@ -1,3 +1,3 @@
-export TRAEFIK_YML_VERSION=v21
+export TRAEFIK_YML_VERSION=v26
 export FILE_PROVIDER_YML_VERSION=v10
-export ENTRYPOINT_VERSION=v4
+export ENTRYPOINT_VERSION=v5

compose.azure.yml

@@ -0,0 +1,17 @@
+version: "3.8"
+
+services:
+  app:
+    environment:
+      - AZURE_TENANT_ID
+      - AZURE_CLIENT_ID
+      - AZURE_SUBSCRIPTION_ID
+      - AZURE_RESOURCE_GROUP
+      - AZURE_CLIENT_SECRET_FILE=/run/secrets/azure_secret
+    secrets:
+      - azure_secret
+
+secrets:
+  azure_secret:
+    name: ${STACK_NAME}_azure_secret_${SECRET_AZURE_SECRET_VERSION}
+    external: true

compose.garage.yml

@@ -0,0 +1,7 @@
+version: "3.8"
+services:
+  app:
+    environment:
+      - GARAGE_RPC_ENABLED
+    ports:
+      - "3901:3901"

compose.irc.yml

@@ -0,0 +1,7 @@
+version: "3.8"
+services:
+  app:
+    environment:
+      - IRC_ENABLED
+    ports:
+      - "6697:6697"

compose.p2panda.yml

@@ -0,0 +1,14 @@
+version: "3.8"
+services:
+  app:
+    environment:
+      - P2PANDA_ENABLED
+    ports:
+      - target: 2022
+        published: 2022
+        protocol: udp
+        mode: host
+      - target: 2023
+        published: 2023
+        protocol: udp
+        mode: host

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v2.11.24"
+    image: "traefik:v3.6.2"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
@@ -27,6 +27,7 @@ services:
     environment:
       - DASHBOARD_ENABLED
       - LOG_LEVEL
+      - ${LOG_MAX_AGE:-0}
     healthcheck:
       test: ["CMD", "traefik", "healthcheck"]
       interval: 30s
@@ -47,12 +48,12 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.service=api@internal"
         - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=3.1.0+v2.11.24"
+        - "coop-cloud.${STACK_NAME}.version=3.7.0+v3.6.2"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:1.26.2-r0-ls30
+    image: lscr.io/linuxserver/socket-proxy:3.2.8-r0-ls61
     deploy:
       endpoint_mode: dnsrr
     environment:
@@ -71,14 +72,14 @@ services:
       - IMAGES=0
       - INFO=0
       - NETWORKS=1 # Needs access
-      - NODES=0
-      - PING=0
+      - NODES=1
+      - PING=1
       - POST=0
       - PLUGINS=0
       - SECRETS=0
       - SERVICES=1 # Needs access
       - SESSION=0
-      - SWARM=0
+      - SWARM=1
       - SYSTEM=0
       - TASKS=1 # Needs access
       - VERSION=1 # Needs access

entrypoint.sh.tmpl

@@ -11,4 +11,8 @@ export OVH_APPLICATION_SECRET=$(cat "$OVH_APPLICATION_SECRET_FILE")
 export DO_AUTH_TOKEN=$(cat "$DO_AUTH_TOKEN_FILE")
 {{ end }}
 
+{{ if eq (env "AZURE_ENABLED") "1" }}
+export AZURE_CLIENT_SECRET=$(cat "$AZURE_CLIENT_SECRET_FILE")
+{{ end }}
+
 /entrypoint.sh "$@"

release/3.3.0+v2.11.26

@@ -0,0 +1 @@
+Fix CVE: https://github.com/traefik/traefik/security/advisories/GHSA-vrch-868g-9jx5

release/3.4.0+v3.4.4

@@ -0,0 +1 @@
+Updates Traefik from v2 to v3. Migration notes here: https://doc.traefik.io/traefik/migration/v2-to-v3-details/#configuration-details-for-migrating-from-traefik-v2-to-v3 By default, syntax for Traefik rules in recipes still use v2 syntax. To upgrade a recipe to use v3 label syntax, set the ruleSyntax label in the recipe per: https://doc.traefik.io/traefik/reference/routing-configuration/http/router/rules-and-priority/#rulesyntax

release/3.4.2+v3.4.5

@@ -0,0 +1 @@
+Bumps the TRAEFIK_YML_VERSION

release/3.5.0+v3.4.5

@@ -0,0 +1 @@
+Add support to azure DNS-01 acme challenge

release/3.6.0+v3.4.5

@@ -0,0 +1 @@
+Expose log_max_age option. This option controls Traefik's maximum retention for log files in number of days. By default (when LOG_MAX_AGE=0), files are not removed based on age.

renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}

traefik.yml.tmpl

@@ -1,13 +1,16 @@
 ---
+core:
+  defaultRuleSyntax: v2
+
 log:
   level: {{ env "LOG_LEVEL" }}
+  maxAge: {{ env "LOG_MAX_AGE" }}
 
 providers:
-  docker:
+  swarm:
     endpoint: "tcp://socket-proxy:2375"
     exposedByDefault: false
     network: proxy
-    swarmMode: true
   {{ if eq (env "FILE_PROVIDER_DIRECTORY_ENABLED") "1" }}
   file:
     directory: /etc/traefik/file-providers
@@ -34,6 +37,16 @@ entrypoints:
   gitea-ssh:
     address: ":2222"
   {{ end }}
+  {{ if eq (env "P2PANDA_ENABLED") "1" }}
+  p2panda-udp-v4:
+    address: ":2022/udp"
+  p2panda-udp-v6:
+    address: ":2023/udp"
+  {{ end }}
+  {{ if eq (env "GARAGE_RPC_ENABLED") "1" }}
+  garage-rpc:
+    address: ":3901"
+  {{ end }}
   {{ if eq (env "FOODSOFT_SMTP_ENABLED") "1" }}
   foodsoft-smtp:
     address: ":2525"
@@ -68,6 +81,10 @@ entrypoints:
   compy:
     address: ":9999"
   {{ end }}
+  {{ if eq (env "IRC_ENABLED") "1" }}
+  irc:
+    address: ":6697"
+  {{ end }}
   {{ if eq (env "METRICS_ENABLED") "1" }}
   metrics:
     address: ":8082"