Added traefik in composer as swarm wouldn't do what I wanted.
This commit is contained in:
parent
9b5c20450d
commit
bc8c850405
119
compose/traefik/docker-compose.swr
Normal file
119
compose/traefik/docker-compose.swr
Normal file
@ -0,0 +1,119 @@
|
|||||||
|
version: '3.3'
|
||||||
|
|
||||||
|
services:
|
||||||
|
|
||||||
|
traefik:
|
||||||
|
# Use the latest v3.0 Traefik image available
|
||||||
|
image: traefik:v3.0
|
||||||
|
ports:
|
||||||
|
# Listen on port 80, default for HTTP, necessary to redirect to HTTPS
|
||||||
|
#- 80:80
|
||||||
|
# Listen on port 443, default for HTTPS
|
||||||
|
#- 443:443
|
||||||
|
# Listen on port 8080, traefiks web-ui
|
||||||
|
- 8080:8080
|
||||||
|
deploy:
|
||||||
|
placement:
|
||||||
|
constraints:
|
||||||
|
# Make the traefik service run only on the node with this label
|
||||||
|
# as the node with it has the volume for certificates
|
||||||
|
- node.labels.traefik-public.traefik-public-certificates == true
|
||||||
|
labels:
|
||||||
|
# Enable Traefik for this service, to make it available in the public network
|
||||||
|
- traefik.enable=true
|
||||||
|
# Use the traefik-public network (declared below)
|
||||||
|
- traefik.docker-network=traefik-public
|
||||||
|
# Use the custome label "traefik.constraint-label=traefik-public"
|
||||||
|
# This public Traefik will only use services with this label
|
||||||
|
# That way you can add other internal Traefik instances per stack if needed
|
||||||
|
#- traefik.constraint-label=traefik-public
|
||||||
|
# admin-auth middleware with HTTP Basic auth
|
||||||
|
# Using the environment variables USERNAME and HASHED_PASSOWRD
|
||||||
|
- traefik.http.middlewares.admin-auth.basicauth.users=${USERNAME?Variable not set}:${HASHED_PASSWORD?Variable not set}
|
||||||
|
# https-redirect middleware to redirect HTTP to HTTPS
|
||||||
|
# It can be re-used by other stacks in other Docker Compose files
|
||||||
|
- traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
|
||||||
|
- traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
|
||||||
|
# traefik-http set up only to use the middleware to redirect to https
|
||||||
|
# Uses the environment variable DOMAIN
|
||||||
|
- traefik.http.routers.traefik-public-http.rule=Host(`${DOMAIN?Variable not set}`)
|
||||||
|
- traefik.http.routers.traefik-public-http.entrypoints=http
|
||||||
|
- traefik.http.routers.traefik-public-http.middlewares=https-redirect
|
||||||
|
# traefik-https the actual router using HTTPS
|
||||||
|
# Uses the environment variable DOMAIN
|
||||||
|
- traefik.http.routers.traefik-public-https.rule=Host(`${DOMAIN?Variable not set}`)
|
||||||
|
- traefik.http.routers.traefik-public-https.entrypoints=https
|
||||||
|
- traefik.http.routers.traefik-public-https.tls=true
|
||||||
|
# Use the special Traefik service api@internal with the web UI/Dashboard
|
||||||
|
- traefik.http.routers.traefik-public-https.service=api@internal
|
||||||
|
# Use the "le" (Let's Encrypt) resolver created below
|
||||||
|
- traefik.http.routers.traefik-public-https.tls.certresolver=le
|
||||||
|
# Enable HTTP Basic auth, using the middleware created above
|
||||||
|
- traefik.http.routers.traefik-public-https.middlewares=admin-auth
|
||||||
|
# Define the port inside of the Docker service to use
|
||||||
|
- traefik.http.services.traefik-public.loadbalancer.server.port=8080
|
||||||
|
volumes:
|
||||||
|
# Add Docker as a mounted volume, so that Traefik can read the labels of other services
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||||
|
# Mount the volume to store the certificates
|
||||||
|
- traefik-public-certificates:/certificates
|
||||||
|
# Mount the volume to store logs
|
||||||
|
- traefik-logs:/logs
|
||||||
|
# Mount the directory where rules are saved
|
||||||
|
- /data/share/traefik/rules:/rules
|
||||||
|
command:
|
||||||
|
- --global.checkNewVersion=true
|
||||||
|
# Enable Docker in Traefik, so that it reads labels from Docker services
|
||||||
|
- --providers.docker
|
||||||
|
# Add a constraint to only use services with the label "traefik.constraint-label=traefik-public"
|
||||||
|
- --providers.docker.constraints=Label(`traefik.constraint-label`, `traefik-public`)
|
||||||
|
# Do not expose all Docker services, only the ones explicitly exposed
|
||||||
|
- --providers.docker.exposedbydefault=false
|
||||||
|
# Enable Docker Swarm mode
|
||||||
|
- --providers.swarm.endpoint=unix:///var/run/docker.sock
|
||||||
|
# Create an entrypoint "http" listening on port 80
|
||||||
|
- --entrypoints.http.address=:80
|
||||||
|
# Create an entrypoint "https" listening on port 443
|
||||||
|
- --entrypoints.https.address=:443
|
||||||
|
# Create the certificate resolver "le" for Let's Encrypt, uses the environment variable EMAIL
|
||||||
|
- --certificatesresolvers.le.acme.email=${EMAIL?Variable not set}
|
||||||
|
# Store the Let's Encrypt certificates in the mounted volume
|
||||||
|
- --certificatesresolvers.le.acme.storage=/certificates/acme.json
|
||||||
|
# Use the TLS Challenge for Let's Encrypt
|
||||||
|
- --certificatesresolvers.le.acme.tlschallenge=true
|
||||||
|
# Enable the access log, with HTTP requests
|
||||||
|
- --accesslog
|
||||||
|
# Enable the Traefik log, for configurations and errors
|
||||||
|
- --log
|
||||||
|
# Enable the Dashboard and API
|
||||||
|
- --api=true
|
||||||
|
- --api.dashboard=true
|
||||||
|
- --api.insecure=true
|
||||||
|
- --log=true
|
||||||
|
- --log.filePath=/logs/trafeik.log
|
||||||
|
- --log.level=INFO
|
||||||
|
- --accessLog=true
|
||||||
|
- --accessLog.filePath=/logs/access.log
|
||||||
|
- --accessLog.bufferingSize=100
|
||||||
|
- --accessLog.filters.statusCodes=204-299,400-499,500-599
|
||||||
|
- --providers.file.directory=rules
|
||||||
|
- --providers.file.watch=true
|
||||||
|
networks:
|
||||||
|
# Use the public network created to be shared between Traefik and
|
||||||
|
# any other service that needs to be publicly available with HTTPS
|
||||||
|
- traefik-public
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
# Create a volume to store the certificates, there is a constraint to make sure
|
||||||
|
# Traefik is always deployed to the same Docker node with the same volume containing
|
||||||
|
# the HTTPS certificates
|
||||||
|
traefik-public-certificates:
|
||||||
|
driver: local
|
||||||
|
traefik-logs:
|
||||||
|
driver: local
|
||||||
|
|
||||||
|
networks:
|
||||||
|
# Use the previously created public network "traefik-public", shared with other
|
||||||
|
# services that need to be publicly available via this Traefik
|
||||||
|
traefik-public:
|
||||||
|
external: true
|
||||||
15
compose/traefik/docker-compose.yml
Normal file
15
compose/traefik/docker-compose.yml
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
version: '3'
|
||||||
|
|
||||||
|
services:
|
||||||
|
reverse-proxy:
|
||||||
|
image: traefik:v3.1
|
||||||
|
command: --api.insecure=true --providers.docker
|
||||||
|
ports:
|
||||||
|
# The HTTP port
|
||||||
|
- "180:80"
|
||||||
|
# The HTTPS port
|
||||||
|
- "1443:443"
|
||||||
|
# The web UI (enabled by --api.insecure=true)
|
||||||
|
- "8080:8080"
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
Loading…
x
Reference in New Issue
Block a user