Attempt to disable Letsencrypt for self-signed joy

2021-04-17 23:03:30 +02:00
13 changed files with 157 additions and 58 deletions
@@ -0,0 +1,21 @@
+---
+kind: pipeline
+name: deploy to swarm-test.autonomic.zone
+steps:
+  - name: deployment
+    image: decentral1se/stack-ssh-deploy:latest
+    settings:
+      host: swarm-test.autonomic.zone
+      stack: traefik
+      deploy_key:
+        from_secret: drone_ssh_swarm_test
+    environment:
+      DOMAIN: traefik.swarm-test.autonomic.zone
+      STACK_NAME: traefik
+      LETS_ENCRYPT_ENV: production
+      LETS_ENCRYPT_EMAIL: helo@autonomic.zone
+      TRAEFIK_YML_VERSION: v3
+      FILE_PROVIDER_YML_VERSION: v2
+trigger:
+  branch:
+    - master
@@ -0,0 +1,27 @@
+TYPE=traefik
+
+DOMAIN=traefik.example.com
+LETS_ENCRYPT_ENV=production
+
+LETS_ENCRYPT_DISABLED=0
+LETS_ENCRYPT_EMAIL=certs@example.com
+# DASHBOARD_ENABLED=true
+# WARN, INFO etc.
+LOG_LEVEL=WARN
+
+## Enable Keycloak
+#COMPOSE_FILE="compose.yml:compose.keycloak.yml"
+#KEYCLOAK_MIDDLEWARE_ENABLED=1
+
+## SMTP port 587
+#COMPOSE_FILE="compose.yml:compose.smtp.yml"
+#SMTP_ENABLED=1
+
+## Gitea SSH
+# GITEA_SSH_ENABLED=1
+
+## Foodsoft SMTP
+# FOODSOFT_SMTP_ENABLED=1
+
+## Host-mode networking
+#COMPOSE_FILE="compose.yml:compose.host.yml"
@@ -1 +1 @@
-.env
+.envrc
@@ -1,24 +1,26 @@
 # Traefik

-Wiki Cafe's configuration for a traefik deployment. Originally slimmed down from an `abra` [recipe](https://git.coopcloud.tech/coop-cloud/traefik) by [Co-op Cloud](https://coopcloud.tech/).
+[![Build Status](https://drone.autonomic.zone/api/badges/coop-cloud/traefik/status.svg)](https://drone.autonomic.zone/coop-cloud/traefik)

+> https://docs.traefik.io

-## Deploying the app with Docker Swarm
+<!-- metadata -->
+* **Category**: Utilities
+* **Status**: ?
+* **Image**: [`traefik`](https://hub.docker.com/_/traefik), ❶💚, upstream
+* **Healthcheck**: Yes
+* **Backups**: No
+* **Email**: N/A
+* **Tests**: ❷💛
+* **SSO**: ? (Keycloak)
+<!-- endmetadata -->

-Set the environment variables from the .env file during the shell session.
+## Basic usage

-```
-set -a && source .env && set +a
-```
+1. Set up Docker Swarm and [`abra`]
+2. `abra app new traefik`
+3. `abra app YOURAPPDOMAIN config` - be sure to change `DOMAIN` to something that resolves to
+   your Docker swarm box
+4. `abra app YOURAPPDOMAIN deploy`

-Set the secrets.
-
-```
-printf "SECRET_HERE" | docker secret create SECRET_NAME -
-```
-
-Deploy using the `-c` flag to specify multiple compose files.
-
-```
-docker stack deploy traefik -c compose.yaml -c compose.googledomains.yaml
-```
+[`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
@@ -0,0 +1,2 @@
+export TRAEFIK_YML_VERSION=v7
+export FILE_PROVIDER_YML_VERSION=v1
@@ -1,10 +0,0 @@
-services:
-  app:
-    environment:
-      - GOOGLE_DOMAINS_ACCESS_TOKEN_FILE=/run/secrets/google_domains_access_token
-    secrets:
-      - google_domains_access_token
-
-secrets:
-  google_domains_access_token:
-    external: true
@@ -0,0 +1,18 @@
+---
+version: "3.8"
+
+services:
+  app:
+    deploy:
+      update_config:
+        order: stop-first
+    ports:
+      - target: 80
+        published: 80
+        mode: host
+      - target: 443
+        published: 443
+        mode: host
+      - target: 2222
+        published: 2222
+        mode: host
@@ -0,0 +1,10 @@
+---
+version: "3.8"
+
+services:
+  app:
+    deploy:
+      labels:
+        - "traefik.http.routers.traefik.middlewares=keycloak@file"
+    environment:
+      - KEYCLOAK_MIDDLEWARE_ENABLED
@@ -0,0 +1,7 @@
+---
+version: "3.8"
+
+services:
+  app:
+    ports:
+      - "587:587"
@@ -1,32 +1,36 @@
+version: "3.8"
 services:
  app:
-    image: "traefik:v2.10.4"
+    image: "traefik:v2.4.8"
    ports:
-      # HTTP
      - "80:80"
-      # HTTPS
      - "443:443"
+      - "2222:2222"
+      - "2525:2525"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "letsencrypt:/etc/letsencrypt"
    configs:
-      - source: traefik_yaml
-        target: /etc/traefik/traefik.yaml
-      - source: file_provider_yaml
-        target: /etc/traefik/file-provider.yaml
+      - source: traefik_yml
+        target: /etc/traefik/traefik.yml
+      - source: file_provider_yml
+        target: /etc/traefik/file-provider.yml
    networks:
      - proxy
    environment:
      - DASHBOARD_ENABLED
+      - LETS_ENCRYPT_DISABLED
+      - LETS_ENCRYPT_EMAIL
+      - FOODSOFT_SMTP_ENABLED
+      - GITEA_SSH_ENABLED
      - LOG_LEVEL
-      - LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER
+      - SMTP_ENABLED
    healthcheck:
      test: ["CMD", "traefik", "healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 1m
-    command: traefik
    deploy:
      update_config:
        failure_action: rollback
@@ -36,21 +40,21 @@ services:
        - "traefik.http.services.traefik.loadbalancer.server.port=web"
        - "traefik.http.routers.traefik.rule=Host(`${DOMAIN}`)"
        - "traefik.http.routers.traefik.entrypoints=web-secure"
-        - "traefik.http.routers.traefik.tls.certresolver=${LETS_ENCRYPT_ENV}"
+          #- "traefik.http.routers.traefik.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.routers.traefik.tls.options=default@file"
        - "traefik.http.routers.traefik.service=api@internal"
        - "traefik.http.routers.traefik.middlewares=security@file"
-
+        - coop-cloud.${STACK_NAME}.app.version=v2.4.8-d7d63b0d
 networks:
  proxy:
    external: true
-
 configs:
-  traefik_yaml:
-    file: traefik.yaml.tmpl
+  traefik_yml:
+    name: ${STACK_NAME}_traefik_yml_${TRAEFIK_YML_VERSION}
+    file: traefik.yml
    template_driver: golang
-  file_provider_yaml:
-    file: file-provider.yaml.tmpl
-    template_driver: golang
-
+  file_provider_yml:
+    name: ${STACK_NAME}_file_provider_yml_${FILE_PROVIDER_YML_VERSION}
+    file: file-provider.yml
 volumes:
-  letsencrypt:
+  letsencrypt:
@@ -1,6 +1,14 @@
 ---
 http:
  middlewares:
+    {{ if eq (env "KEYCLOAK_MIDDLEWARE_ENABLED") "1" }}
+    keycloak:
+      forwardAuth:
+        address: "http://traefik-forward-auth:4181"
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-Forwarded-User
+    {{ end }}
    security:
      headers:
        frameDeny: true
@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base"
+  ]
+}
@@ -9,7 +9,7 @@ providers:
    network: proxy
    swarmMode: true
  file:
-    filename: /etc/traefik/file-provider.yaml
+    filename: /etc/traefik/file-provider.yml

 api:
  dashboard: {{ env "DASHBOARD_ENABLED" }}
@@ -24,10 +24,23 @@ entrypoints:
          to: web-secure
  web-secure:
    address: ":443"
+  {{ if eq (env "GITEA_SSH_ENABLED") "1" }}
+  gitea-ssh:
+    address: ":2222"
+  {{ end }}
+  {{ if eq (env "FOODSOFT_SMTP_ENABLED") "1" }}
+  foodsoft-smtp:
+    address: ":2525"
+  {{ end }}
+  {{ if eq (env "SMTP_ENABLED") "1" }}
+  smtp-submission:
+    address: ":587"
+  {{ end }}

 ping:
  entryPoint: web

+{{ if not (eq (env "LETS_ENCRYPT_DISABLED") "1") }}
 certificatesResolvers:
  staging:
    acme:
@@ -36,19 +49,10 @@ certificatesResolvers:
      caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
      httpChallenge:
        entryPoint: web
-      dnsChallenge:
-        provider: {{ (env "LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER") }}
-        resolvers:
-          - "1.1.1.1:53"
-          - "8.8.8.8:53"
  production:
    acme:
      email: {{ env "LETS_ENCRYPT_EMAIL" }}
      storage: /etc/letsencrypt/production-acme.json
      httpChallenge:
        entryPoint: web
-      dnsChallenge:
-        provider: {{ (env "LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER") }}
-        resolvers:
-          - "1.1.1.1:53"
-          - "8.8.8.8:53"
+{{ end }}