From bc8c850405043b66a60cdfea88b848eba5ed4fc3 Mon Sep 17 00:00:00 2001
From: Netshade <netshade@niefelheim.com>
Date: Fri, 16 Aug 2024 16:34:38 +0200
Subject: [PATCH] Added traefik in composer as swarm wouldn't do what I wanted.

---
 compose/traefik/docker-compose.swr | 119 +++++++++++++++++++++++++++++
 compose/traefik/docker-compose.yml |  15 ++++
 2 files changed, 134 insertions(+)
 create mode 100644 compose/traefik/docker-compose.swr
 create mode 100644 compose/traefik/docker-compose.yml

diff --git a/compose/traefik/docker-compose.swr b/compose/traefik/docker-compose.swr
new file mode 100644
index 0000000..22a4f34
--- /dev/null
+++ b/compose/traefik/docker-compose.swr
@@ -0,0 +1,119 @@
+version: '3.3'
+
+services:
+  
+  traefik:
+    # Use the latest v3.0 Traefik image available
+    image: traefik:v3.0
+    ports:
+      # Listen on port 80, default for HTTP, necessary to redirect to HTTPS
+      #- 80:80
+      # Listen on port 443, default for HTTPS
+      #- 443:443
+      # Listen on port 8080, traefiks web-ui
+      - 8080:8080
+    deploy:
+      placement:
+        constraints:
+          # Make the traefik service run only on the node with this label
+          # as the node with it has the volume for certificates
+          - node.labels.traefik-public.traefik-public-certificates == true
+      labels:
+        # Enable Traefik for this service, to make it available in the public network
+        - traefik.enable=true
+        # Use the traefik-public network (declared below)
+        - traefik.docker-network=traefik-public
+        # Use the custome label "traefik.constraint-label=traefik-public"
+        # This public Traefik will only use services with this label
+        # That way you can add other internal Traefik instances per stack if needed
+        #- traefik.constraint-label=traefik-public
+        # admin-auth middleware with HTTP Basic auth
+        # Using the environment variables USERNAME and HASHED_PASSOWRD
+        - traefik.http.middlewares.admin-auth.basicauth.users=${USERNAME?Variable not set}:${HASHED_PASSWORD?Variable not set}
+        # https-redirect middleware to redirect HTTP to HTTPS
+        # It can be re-used by other stacks in other Docker Compose files
+        - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
+        - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
+        # traefik-http set up only to use the middleware to redirect to https
+        # Uses the environment variable DOMAIN
+        - traefik.http.routers.traefik-public-http.rule=Host(`${DOMAIN?Variable not set}`)
+        - traefik.http.routers.traefik-public-http.entrypoints=http
+        - traefik.http.routers.traefik-public-http.middlewares=https-redirect
+        # traefik-https the actual router using HTTPS
+        # Uses the environment variable DOMAIN
+        - traefik.http.routers.traefik-public-https.rule=Host(`${DOMAIN?Variable not set}`)
+        - traefik.http.routers.traefik-public-https.entrypoints=https
+        - traefik.http.routers.traefik-public-https.tls=true
+        # Use the special Traefik service api@internal with the web UI/Dashboard
+        - traefik.http.routers.traefik-public-https.service=api@internal
+        # Use the "le" (Let's Encrypt) resolver created below
+        - traefik.http.routers.traefik-public-https.tls.certresolver=le
+        # Enable HTTP Basic auth, using the middleware created above
+        - traefik.http.routers.traefik-public-https.middlewares=admin-auth
+        # Define the port inside of the Docker service to use
+        - traefik.http.services.traefik-public.loadbalancer.server.port=8080
+    volumes:
+      # Add Docker as a mounted volume, so that Traefik can read the labels of other services
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      # Mount the volume to store the certificates
+      - traefik-public-certificates:/certificates
+      # Mount the volume to store logs
+      - traefik-logs:/logs
+      # Mount the directory where rules are saved
+      - /data/share/traefik/rules:/rules
+    command:
+      - --global.checkNewVersion=true
+      # Enable Docker in Traefik, so that it reads labels from Docker services
+      - --providers.docker
+      # Add a constraint to only use services with the label "traefik.constraint-label=traefik-public"
+      - --providers.docker.constraints=Label(`traefik.constraint-label`, `traefik-public`)
+      # Do not expose all Docker services, only the ones explicitly exposed
+      - --providers.docker.exposedbydefault=false
+      # Enable Docker Swarm mode
+      - --providers.swarm.endpoint=unix:///var/run/docker.sock
+      # Create an entrypoint "http" listening on port 80
+      - --entrypoints.http.address=:80
+      # Create an entrypoint "https" listening on port 443
+      - --entrypoints.https.address=:443
+      # Create the certificate resolver "le" for Let's Encrypt, uses the environment variable EMAIL
+      - --certificatesresolvers.le.acme.email=${EMAIL?Variable not set}
+      # Store the Let's Encrypt certificates in the mounted volume
+      - --certificatesresolvers.le.acme.storage=/certificates/acme.json
+      # Use the TLS Challenge for Let's Encrypt
+      - --certificatesresolvers.le.acme.tlschallenge=true
+      # Enable the access log, with HTTP requests
+      - --accesslog
+      # Enable the Traefik log, for configurations and errors
+      - --log
+      # Enable the Dashboard and API
+      - --api=true
+      - --api.dashboard=true
+      - --api.insecure=true
+      - --log=true
+      - --log.filePath=/logs/trafeik.log
+      - --log.level=INFO
+      - --accessLog=true
+      - --accessLog.filePath=/logs/access.log
+      - --accessLog.bufferingSize=100
+      - --accessLog.filters.statusCodes=204-299,400-499,500-599
+      - --providers.file.directory=rules
+      - --providers.file.watch=true
+    networks:
+      # Use the public network created to be shared between Traefik and
+      # any other service that needs to be publicly available with HTTPS
+      - traefik-public
+
+volumes:
+    # Create a volume to store the certificates, there is a constraint to make sure
+    # Traefik is always deployed to the same Docker node with the same volume containing
+    # the HTTPS certificates
+    traefik-public-certificates:
+      driver: local
+    traefik-logs:
+      driver: local
+
+networks:
+    # Use the previously created public network "traefik-public", shared with other
+    # services that need to be publicly available via this Traefik
+    traefik-public:
+      external: true
diff --git a/compose/traefik/docker-compose.yml b/compose/traefik/docker-compose.yml
new file mode 100644
index 0000000..a623f8c
--- /dev/null
+++ b/compose/traefik/docker-compose.yml
@@ -0,0 +1,15 @@
+version: '3'
+
+services:
+  reverse-proxy:
+    image: traefik:v3.1
+    command: --api.insecure=true --providers.docker
+    ports:
+      # The HTTP port
+      - "180:80"
+      # The HTTPS port
+      - "1443:443"
+      # The web UI (enabled by --api.insecure=true)
+      - "8080:8080"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock