Michael Schiemer
edcf509a4f
- Add PHP ini management classes (Access, IniDirective, IniKey, PhpIni) - Update deployment configurations (Wireguard, Traefik, Monitoring) - Add DNS stack and Ansible role - Add deployment debugging playbooks - Update framework components (FilePath, RedisConnectionPool) - Update .gitignore and documentation
83 lines
3.7 KiB
YAML
83 lines
3.7 KiB
YAML
services:
|
|
traefik:
|
|
image: traefik:v3.0
|
|
container_name: traefik
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
# Use host network mode to correctly identify client IPs from WireGuard
|
|
# Without this, Traefik sees Docker bridge IPs instead of real client IPs (10.8.0.x)
|
|
network_mode: host
|
|
# When using host network mode, we don't bind ports in docker-compose
|
|
# Traefik listens directly on host ports 80 and 443
|
|
# ports:
|
|
# - "80:80"
|
|
# - "443:443"
|
|
environment:
|
|
- TZ=Europe/Berlin
|
|
volumes:
|
|
# Docker socket for service discovery
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
# Static configuration
|
|
- ./traefik.yml:/traefik.yml:ro
|
|
# Dynamic configuration
|
|
- ./dynamic:/dynamic:ro
|
|
# SSL certificates
|
|
- ./acme.json:/acme.json
|
|
# Logs
|
|
- ./logs:/logs
|
|
labels:
|
|
# Enable Traefik for itself
|
|
- "traefik.enable=true"
|
|
|
|
# Dashboard - VPN-only access (WireGuard network required)
|
|
# Accessible only from WireGuard VPN network (10.8.0.0/24)
|
|
- "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.michaelschiemer.de`)"
|
|
- "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
|
|
- "traefik.http.routers.traefik-dashboard.tls=true"
|
|
- "traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.traefik-dashboard.service=api@internal"
|
|
# VPN-only + BasicAuth protection (order: vpn-only first, then BasicAuth)
|
|
- "traefik.http.routers.traefik-dashboard.middlewares=vpn-only@file,traefik-auth"
|
|
|
|
# BasicAuth for dashboard (user: admin, password: generate with htpasswd)
|
|
# htpasswd -nb admin your_password
|
|
- "traefik.http.middlewares.traefik-auth.basicauth.users=admin:$$apr1$$8kj9d7lj$$r.x5jhLVPLuCDLvJ6x0Hd0"
|
|
|
|
# Allow ACME challenges without redirect (higher priority)
|
|
- "traefik.http.routers.acme-challenge.rule=PathPrefix(`/.well-known/acme-challenge`)"
|
|
- "traefik.http.routers.acme-challenge.entrypoints=web"
|
|
- "traefik.http.routers.acme-challenge.priority=200"
|
|
|
|
# Global redirect to HTTPS (lower priority, matches everything else)
|
|
- "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
|
|
- "traefik.http.routers.http-catchall.entrypoints=web"
|
|
- "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
|
|
- "traefik.http.routers.http-catchall.priority=1"
|
|
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
|
|
- "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
|
|
|
|
# Security headers middleware
|
|
- "traefik.http.middlewares.security-headers.headers.frameDeny=true"
|
|
- "traefik.http.middlewares.security-headers.headers.contentTypeNosniff=true"
|
|
- "traefik.http.middlewares.security-headers.headers.browserXssFilter=true"
|
|
- "traefik.http.middlewares.security-headers.headers.stsSeconds=31536000"
|
|
- "traefik.http.middlewares.security-headers.headers.stsIncludeSubdomains=true"
|
|
- "traefik.http.middlewares.security-headers.headers.stsPreload=true"
|
|
|
|
# Compression middleware
|
|
- "traefik.http.middlewares.compression.compress=true"
|
|
|
|
# Rate limiting middleware (100 requests per second)
|
|
- "traefik.http.middlewares.rate-limit.ratelimit.average=100"
|
|
- "traefik.http.middlewares.rate-limit.ratelimit.burst=50"
|
|
healthcheck:
|
|
test: ["CMD", "traefik", "healthcheck", "--ping"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
# Note: network_mode: host is used, so we don't define networks here
|
|
# Traefik still discovers services via Docker labels using the Docker socket
|