Blog of spblinux

services:
  traefik:
    env_file:
      - path: /share/Container/container-station-data/application/traefik/.env
    image: traefik:v3.7
    container_name: traefik
    restart: always
    ports:
      # web, webs is set as default
      - 192.168.224.252:80:80/tcp # web
      - 192.168.224.252:443:443/tcp # webs
      - 192.168.224.252:443:443/udp # https http3 quic: webs
      # label: - traefik.routers.ROUTERNAME.entrypoints=web2,webs2
      # - 192.168.226.252:80:81/tcp # web2
      - 192.168.224.252:65480:81/tcp # web2, limit to 1 network adapter
      #- 192.168.226.252:443:444/tcp # webs2
      - 192.168.224.252:65443:444/tcp # webs2, limit to 1 network adapter
       # label: - traefik.routers.ROUTERNAME.entrypoints=web2,webs2,webs3
    - "[::]:443:445/tcp" # webs3, limit to ipv6, all network adapters
      #- 192.168.226.252:443:444/udp # https http3 quic: webs2
      - 8081:8080 # http api dashboard; also at https://YOURDOMAIN.TLD
    volumes:
      #- /var/run/docker.sock:/var/run/docker.sock:ro # better use socket-proxy instead
      - /share/Container/container-station-data/application/traefik:/etc/traefik/ # put the provided traefik.yml and fileConfig.yml files at this location
      - /share/Container/container-station-data/application/traefik/logs:/logs
    environment:
      - TZ=Europe/Zurich
    labels:
      - traefik.enable=true
      - traefik.http.routers.api.rule=Host(`YOURDOMAIN.TLD`) # Define the (sub)domain for the traefik dashboard.
      - traefik.http.routers.api.service=api@internal # Enable Traefik API.
      - traefik.http.routers.traefik.middlewares=rate-limit@file
      #- traefik.http.routers.api.middlewares=local-ipwhitelist@file,basic-auth@file # protect dashboard with basic auth and restrict access to private class subnets only
      #- traefik.http.middlewares.basic-auth-global.basicauth.users=admin:$$apr1$$epoKf5li$$QfTMJZOCS/halv3CiIUEu0 # protect the traefik dashboard by basic auth (pw=password)
    # extra_hosts:
    #  - host.docker.internal:172.17.0.1
    security_opt:
      - no-new-privileges:true
    networks:
      - traefik-net
      - socketproxy-net
  socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
    container_name: socket-proxy
    environment:
      - CONTAINERS=1
      - EVENTS=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - socketproxy-net
    restart: always
    labels:
      - com.centurylinklabs.watchtower.enable=false
    read_only: true
    tmpfs:
      - /run
networks:
  traefik-net:
      external: true # docker network ls; docker network create --ipv6 traefik-net
  socketproxy-net:    
    internal: true

# Traefik global configuration
global:
  checkNewVersion: true
  sendAnonymousUsage: false

# Enable traefik ui dashboard
api:
  dashboard: true
  insecure: true

# Log level INFO|DEBUG|ERROR
log:
  level: INFO

# crowdsec bouncer
#experimental:
#  plugins:
#    bouncer:
#      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
#      version: v1.7.1

#metrics:
#  influxDB2:
#     address: http://influxdb2:8086
#     token: my-secure-token-secret
#     org: influx-org
#     bucket: influx-bucket
#     addEntryPointsLabels: true
#     addRoutersLabels: true
#     addServicesLabels: true
#     pushInterval: 60s  

# Configuring Multiple Filters
accessLog:
  filePath: "/logs/traefik.log"
  format: json
  filters:
    statusCodes:
      - "200-299" # log successful http requests
      - "300-399" # log redirect http requests
      - "400-599" # log failed http requests
    #retryAttempts: true
    #minDuration: "10ms"
  # collect logs as in-memory buffer before writing into log file
  bufferingSize: 0
  fields:
    headers:
      defaultMode: drop # drop all headers per default
      names:
          User-Agent: keep # log user agent strings

# The setting below is to allow insecure backend connections.  
serverTransport:
  insecureSkipVerify: true

# Traefik entrypoints (network ports) configuration
entryPoints:
#    asDefault: true # in use unless changed by label traefik.http.routers.ROUTERNAME.entrypoints=web,webs
  # Not used in apps, but redirect everything from HTTP to HTTPS
  web:
    asDefault: true
    address: :80
#    forwardedHeaders:
    http:
      # https://doc.traefik.io/traefik/migrate/v3/#underscoreheadersstrategy
      underscoreHeadersStrategy: delete
      redirections:
        entryPoint:
          to: webs
          scheme: https
  web2:
    address: :81
#    forwardedHeaders:
    http:
      # https://doc.traefik.io/traefik/migrate/v3/#underscoreheadersstrategy
      underscoreHeadersStrategy: delete
      redirections:
        entryPoint:
          to: webs2
          scheme: https
  web3:
    address: "[::]:82"
#    forwardedHeaders:
    http:
      # https://doc.traefik.io/traefik/migrate/v3/#underscoreheadersstrategy
      underscoreHeadersStrategy: delete
      redirections:
        entryPoint:
          to: webs3
          scheme: https

  # HTTPS endpoint, with domain wildcard
  webs:
    asDefault: true
    address: :443
    forwardedHeaders:
      # reuse list of Cloudflare Trusted IP's above for HTTPS requests
#      trustedIPs: *trustedIps
    # enable HTTP3 QUIC via UDP/443
    http3:
      advertisedPort: '443'      
    http:
      # https://doc.traefik.io/traefik/migrate/v3/#underscoreheadersstrategy
      aliasHeadersStrategy: delete
      # use dynamically generated self-signed certificate
      #tls: {}
      # or use a pre-defined certificate resolver from below
      # if so, remove above line with tls: {}
      tls:
        certResolver: myresolver-dns
        domains:
          - main: YOURDOMAIN.TLD # change this to your proxy domain
            sans:
              - '*.YOURDOMAIN.TLD' # change this to your proxy domain
      middlewares:
        - security-headers@file # reference to a dynamic middleware for setting http security headers per default
  webs2:
    address: :444
    forwardedHeaders:
      # reuse list of Cloudflare Trusted IP's above for HTTPS requests
#      trustedIPs: *trustedIps
    # enable HTTP3 QUIC via UDP/443
    #http3:
    #  advertisedPort: '444'      
    http:
      # https://doc.traefik.io/traefik/migrate/v3/#underscoreheadersstrategy
      aliasHeadersStrategy: delete
      # use dynamically generated self-signed certificate
      #tls: {}
      # or use a pre-defined certificate resolver from below
      # if so, remove above line with tls: {}
      tls:
        certResolver: myresolver-dns
        domains:
          - main: YOURDOMAIN.TLD # change this to your proxy domain
            sans:
              - '*.YOURDOMAIN.TLD' # change this to your proxy domain
      middlewares:
        - security-headers@file # reference to a dynamic middleware for setting http security headers per default
  webs3:
    address: "[::]:445"
    forwardedHeaders:
      # reuse list of Cloudflare Trusted IP's above for HTTPS requests
#      trustedIPs: *trustedIps
    # enable HTTP3 QUIC via UDP/443
    #http3:
    #  advertisedPort: '444'      
    http:
      # https://doc.traefik.io/traefik/migrate/v3/#underscoreheadersstrategy
      aliasHeadersStrategy: delete
      # use dynamically generated self-signed certificate
      #tls: {}
      # or use a pre-defined certificate resolver from below
      # if so, remove above line with tls: {}
      tls:
        certResolver: myresolver-dns
        domains:
          - main: YOURDOMAIN.TLD # change this to your proxy domain
            sans:
              - '*.YOURDOMAIN.TLD' # change this to your proxy domain
      middlewares:
        - security-headers@file # reference to a dynamic middleware for setting http security headers per default

providers:
  providersThrottleDuration: 2s

  # File provider for connecting things that are outside of docker / defining middleware
  file:
    filename: /etc/traefik/fileConfig.yml
    watch: true

  # Docker provider for connecting all apps that are inside of the docker network
  docker:
    watch: true
    network: traefik-net # add Your Docker Network Name Here
    endpoint: "tcp://socket-proxy:2375" # use socket-proxy for secure access to docker api
    defaultRule: "Host(`{{ index .Labels \"com.docker.compose.service\"}}.YOURDOMAIN.TLD`)" # subdomain==service name; change 'YOURDOMAIN.TLD' to your proxy domain
#    defaultRule: "Host(`{{ .Name }}.YOURDOMAIN.TLD`)" # subdomain==SERVICENAME-CONTAINERNAME; change 'YOURDOMAIN.TLD' to your proxy domain
    exposedByDefault: false # only containers with label traefik.enable=true are routed by traefik

# Use letsencrypt to generate ssl certificates
certificatesResolvers:
  # ACME HTTP CHALLENGE
  myresolver-http:
    acme:
      email: osth@sunrise.ch  # the email address used for ssl certificate registration
      storage: /etc/traefik/acme.json
      httpChallenge: # acme http challenge; requires port 80 and proper dns entries
        entryPoint: web # specify the entry point for the HTTP challenge (adjust if needed)
  # ACME DNS CHALLENGE
  myresolver-dns:
    acme:
      email: YOU@MAIL.ORG  # the email address used for ssl certificate registration
      storage: /etc/traefik/acme.json
      dnsChallenge: # acme dns challenge; requires api token of dns provider
#        provider: YOURDNSHOST2
        provider: desec
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

http:

  ## EXTERNAL ROUTING EXAMPLE - Only use if you want to proxy something manually ##
#  routers:
#    test3:
#      entryPoints:
#        - https
#        - http
#      rule: 'Host(`test3.YOURDOMAIN.TLD`)'
#      service: test3
#      middlewares:
#        - "local-ipwhitelist@file"
  #routers:
  #  homeassistant:
  #    entryPoints:
  #      - https
  #      - http
  #    rule: 'Host(`ha.example.com`)'
  #    service: homeassistant
  #    middlewares:
  #      - "local-ipwhitelist@file"

  #  pve:
  #    entryPoints:
  #      - https
  #      - http
  #    rule: 'Host(`pve.example.com`)'
  #    service: pve
  #    middlewares:
  #      - "local-ipwhitelist@file"

  ## SERVICES EXAMPLE ##
#  services:
#     test3:
#       loadBalancer:
#         serversTransport: insecureTransport
#         servers:
#           - url: https://t4.YOURDOMAIN.TLD
  #  homeassistant:
  #    loadBalancer:
  #      serversTransport: insecureTransport
  #      servers:
  #        - url: http://192.168.1.10:8123

  #  pve:
  #    loadBalancer:
  #      serversTransport: insecureTransport
  #      servers:
  #        - url: https://192.168.1.20:8006

  # allow self-signed certificates for proxied web services
  serversTransports:
    insecureTransport:
      insecureSkipVerify: true

  ## MIDDLEWARES ##
  middlewares:
    # UNUSED remove X-Frame-Options header by plugin because of only office
    #custom-allow-iframe:
    #  plugin:
    #    htransformation:
    #      Rules:
    #        - Header: 'X-Frame-Options'
    #          Name: 'allow iframe'
    #          Type: 'Del'
    #          SetOnResponse: 'True'

    # Only Allow Local networks
    local-ipwhitelist:
      ipAllowList:
        sourceRange:
          - 127.0.0.1/32 # localhost
          - 10.0.0.0/8 # private class A
          - 172.16.0.0/12 # private class B
          - 192.168.0.0/16 # private class C
        #ipstrategy: # enable this when cloudflare proxy in use
        #  depth: 1 # enable this when cloudflare proxy in use

    # Security headers
    security-headers:
      headers:
        customResponseHeaders: # field names are case-insensitive
          #X-Robots-Tag: "all,noarchive,nosnippet,notranslate,noimageindex"
          Server: "" # prevent version disclosure
          X-Powered-By: "" # prevent version disclosure
          X-Forwarded-Proto: "https"
          #Permissions-Policy: "accelerometer=(), autoplay=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), identity-credentials-get=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), storage-access=(), usb=(), web-share=(), window-management=(), xr-spatial-tracking=()"
          #Cross-Origin-Embedder-Policy: "unsafe-none"
          #Cross-Origin-Opener-Policy: "same-origin"
          #Cross-Origin-Resource-Policy: "same-site"
          #X-Permitted-Cross-Domain-Policies: "none"
        sslProxyHeaders:
          X-Forwarded-Proto: "https"
        hostsProxyHeaders:
          - "X-Forwarded-Host"
        #customRequestHeaders:
        #  X-Forwarded-Proto: "https"
        contentTypeNosniff: true # X-Content-Type-Options
        customFrameOptionsValue: "SAMEORIGIN" # X-Frame-Options
        browserXssFilter: false # X-XSS-Protection; deprecated
        referrerPolicy: "strict-origin-when-cross-origin" # Referrer-Policy
        forceSTSHeader: true # HTTP-Strict-Transport-Security (HSTS)
        stsIncludeSubdomains: true # HTTP-Strict-Transport-Security (HSTS)
        stsSeconds: 63072000 # HTTP-Strict-Transport-Security (HSTS)
        stsPreload: true # HTTP-Strict-Transport-Security (HSTS)
        #contentSecurityPolicy: "default-src 'self'; form-action 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content" # Content-Security-Policy (CSP)

    # Authelia guard
    #authelia:
    #  forwardauth:
    #    address: http://authelia:9091/api/authz/forward-auth # replace example.com with your domain name
    #    trustForwardHeader: true
    #    authResponseHeaders:
    #      - Remote-User
    #      - Remote-Groups
    #      - Remote-Name
    #      - Remote-Email

    #crowdsec:
    #  plugin:
    #    bouncer:
    #      enabled: true
    #      defaultDecisionSeconds: 60
    #      crowdsecMode: live
    #      crowdsecAppsecEnabled: false
    #      crowdsecAppsecHost: crowdsec:7422
    #      crowdsecAppsecFailureBlock: true
    #      crowdsecAppsecUnreachableBlock: true
    #      crowdsecLapiKey: FIXME-LAPI-KEY # <--- replace this later
    #      crowdsecLapiHost: crowdsec:8080
    #      crowdsecLapiScheme: http
    #      crowdsecLapiTLSInsecureVerify: false
    #      banFilePath: /ban.html
    #      captchaProvider: hcaptcha
    #      captchaSiteKey: YourSiteKey
    #      captchaSecretKey: YourSecretKey
    #      captchaGracePeriodSeconds: 1800
    #      captchaFilePath: /captcha.html    
    #      forwardedHeadersTrustedIPs:
    #        # private class ranges
    #        - 10.0.0.0/8
    #        - 172.16.0.0/12
    #        - 192.168.0.0/16
    #        ## cloudflare ipv4
    #        #- 103.21.244.0/22
    #        #- 103.22.200.0/22
    #        #- 103.31.4.0/22
    #        #- 104.16.0.0/13
    #        #- 104.24.0.0/14
    #        #- 108.162.192.0/18
    #        #- 131.0.72.0/22
    #        #- 141.101.64.0/18
    #        #- 162.158.0.0/15
    #        #- 172.64.0.0/13
    #        #- 173.245.48.0/20
    #        #- 188.114.96.0/20
    #        #- 190.93.240.0/20
    #        #- 197.234.240.0/22
    #        #- 198.41.128.0/17
    #        ## cloudflare ipv6
    #        #- 2400:cb00::/32
    #        #- 2606:4700::/32
    #        #- 2803:f800::/32
    #        #- 2405:b500::/32
    #        #- 2405:8100::/32
    #        #- 2a06:98c0::/29
    #        #- 2c0f:f248::/32
    #      clientTrustedIPs:
    #        # private class ranges
    #        - 10.0.0.0/8
    #        - 172.16.0.0/12
    #        - 192.168.0.0/16

    # rate limiting
    rate-limit:
      rateLimit:
        average: 50
        period: 1s
        burst: 100
        # uncomment the next lines if behind cloudflare
        #sourceCriterion:
        #  requestHeaderName: CF-Connecting-IP        
    onlyoffice-ratelimit:
      rateLimit:
        average: 200
        period: 1s
        burst: 400


    # basic auth popup
    basic-auth:
      basicAuth:
        # https://hostingcanada.org/htpasswd-generator/
        users: "admin:$apr1$76boeqjp$tVQUCSSQky300AS.kgbZX/" # admin:password

# Only use secure ciphers - https://ssl-config.mozilla.org/#server=traefik&version=2.9&config=intermediate&guideline=5.6
tls:
  options:
    default:
      #sniStrict: true # prevents leaking default cert; see https://doc.traefik.io/traefik/v2.2/https/tls/#strict-sni-checking
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305

services:
  dockhand:
    env_file:
      - path: /share/Container/container-station-data/application/dockhand/.env
    image: fnsys/dockhand:latest
    container_name: dockhand
    restart: unless-stopped
    user: 0:0
    ports:
      - 127.0.0.1:3000:3000
    # use https://dockhand.YOURDOMAIN.TLD   
    networks:
      - traefik-net
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - dockhand_data:/app/data
      - /share/Container/container-station-data/application/dockhand:/share/Container/container-station-data/application/dockhand
      - /share/Container/container-station-data/application:/share/Container/container-station-data/application
    labels:
      - traefik.enable=true
      - traefik.http.services.dockhand.loadbalancer.server.port=3000
      # Assign middleware: default rate-limit,...
      - traefik.http.routers.dockhand.middlewares=rate-limit@file
volumes:
  dockhand_data: null
networks:
  traefik-net:
    external: true

services:
  test1: 
    image: nginx:alpine
    # ports:
    #  - "127.0.0.1:8083:80"
    # use https://test1.YOURDOMAIN.TLD
    networks:
      - traefik-net
    environment:
      - APP_ENV=${APP_ENV:-production}
    volumes:
#      - /share/YOURQNAPFOLDER/opt/test1/html:/usr/share/nginx/html:ro
      - /share/Container/container-station-data/application/test1/html:/usr/share/nginx/html:ro
      - /share/Container/container-station-data/application/test1/etcnginxconfd:/etc/nginx/conf.d
    restart: unless-stopped
    labels:
      - traefik.enable=true
      - traefik.http.services.test1.loadbalancer.server.port=80
      # - traefik.http.routers.test1.rule=Host(`t1.YOURDOMAIN.TLD`) # override default == SERVICENAME
      # Assign middleware: default rate-limit,...
      - traefik.http.routers.test1.middlewares=rate-limit@file
      - traefik.http.routers.test1.entrypoints=web,webs

networks:
   traefik-net:
     external: true