81 lines
3.3 KiB
Plaintext
81 lines
3.3 KiB
Plaintext
version: '3.6'
|
|
|
|
# Docker json-file rotation — quiet tier (~10MB cap per container).
|
|
x-logging-quiet: &fibitex-logging-quiet
|
|
driver: json-file
|
|
options:
|
|
max-size: "5m"
|
|
max-file: "2"
|
|
|
|
services:
|
|
proxy:
|
|
logging: *fibitex-logging-quiet
|
|
restart: always
|
|
image: traefik:latest
|
|
ports:
|
|
<%- if @config['serverip']['enabled'] -%>
|
|
- "<%= @config['serverip']['ip'] %>:80:80"
|
|
- "<%= @config['serverip']['ip'] %>:443:443"
|
|
<%- else -%>
|
|
- "80:80"
|
|
- "443:443"
|
|
<%- end -%>
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
<%- if @config['ssl']['enabled'] -%>
|
|
- ../config/acme.json:/letsencrypt/acme.json
|
|
<%- end -%>
|
|
command:
|
|
- --log.level=INFO
|
|
- --api.dashboard=true <%#OK%>
|
|
- --providers.docker=true <%#OK%>
|
|
- --providers.docker.exposedbydefault=false
|
|
- --entryPoints.web.address=:80 <%#OK%>
|
|
<%- if @config['ssl']['enabled'] -%>
|
|
- --certificatesresolvers.letsencrypt.acme.email=<%= @config['ssl']['email'] %> <%#OK%>
|
|
- --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json <%#OK%>
|
|
- --certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
|
|
|
|
- --entrypoints.web.http.redirections.entrypoint.to=websecure <%#OK%>
|
|
- --entrypoints.web.http.redirections.entrypoint.scheme=https <%#OK%>
|
|
- --entrypoints.websecure.address=:443 <%#OK%>
|
|
|
|
- --entrypoints.websecure.http.tls=true <%#OK%>
|
|
- --entrypoints.websecure.http.tls.certResolver=letsencrypt <%#OK%>
|
|
|
|
|
|
<%# - "--entryPoints.websecure.forwardedHeaders.insecure" %>
|
|
<%# - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
|
|
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web" %>
|
|
|
|
# Un comment bllow 4 line for request to ssl cert. For now we use universal cloudflare cert
|
|
<%# - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
|
|
- --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare %>
|
|
|
|
<%# environment:
|
|
- CF_API_EMAIL=yaser.rezaei@gmail.com
|
|
- CF_API_KEY=b988f91ef34cea523436d293f14c327be282e %>
|
|
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.http-catchall.rule=hostregexp(`{host:[a-z-.]+}`)"
|
|
- "traefik.http.routers.http-catchall.entrypoints=web"
|
|
- "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
|
|
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
|
|
- "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
|
|
|
|
# dashboard Setting
|
|
- "traefik.http.routers.dashboard.rule=Host(`tra.<%= @config['app']['domain'] %>`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
|
|
- "traefik.http.routers.dashboard.service=api@internal"
|
|
- "traefik.http.routers.dashboard.middlewares=auth"
|
|
- "traefik.http.middlewares.auth.basicauth.users=yaser:{SHA}ueAuJOSpNyWTyI+JEiX57oeRevg="
|
|
# HaCE4UYTrCTck88uXkd9
|
|
- "traefik.http.routers.dashboard.tls=true"
|
|
- "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
|
|
|
|
# global redirect to https
|
|
- "traefik.http.routers.redirs.rule=hostregexp(`{host:.+}`)"
|
|
- "traefik.http.routers.redirs.entrypoints=web"
|
|
- "traefik.http.routers.redirs.middlewares=redirect-to-https"
|
|
<%- end -%>
|
|
|