85 lines
2.5 KiB
YAML
85 lines
2.5 KiB
YAML
services:
|
|
traefik_socket_proxy:
|
|
container_name: traefik_socket_proxy
|
|
image: ghcr.io/11notes/socket-proxy:2.1.3
|
|
restart: unless-stopped
|
|
read_only: true
|
|
user: ${PUID}:${PGID}
|
|
environment:
|
|
TZ: ${TZ}
|
|
volumes:
|
|
- /run/docker.sock:/run/docker.sock:ro
|
|
- socket-proxy:/run/proxy
|
|
networks:
|
|
- frontend
|
|
|
|
traefik:
|
|
container_name: traefik
|
|
image: docker.io/library/traefik:v3.5.0
|
|
restart: unless-stopped
|
|
depends_on:
|
|
traefik_socket_proxy:
|
|
condition: service_healthy
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
secrets:
|
|
- cf_api_token
|
|
environment:
|
|
- CF_DNS_API_TOKEN_FILE=/run/secrets/cf_api_token
|
|
volumes:
|
|
- ${APPDATA_PATH}/traefik/data/acme.json:/acme.json
|
|
- ${APPDATA_PATH}/traefik/logs:/var/log/traefik
|
|
- /etc/localtime:/etc/localtime:ro
|
|
- socket-proxy:/var/run
|
|
ports:
|
|
- 80:80
|
|
- 443:443
|
|
- 443:443/udp
|
|
networks:
|
|
- frontend
|
|
command:
|
|
- --api.debug=true
|
|
- --serversTransport.insecureSkipVerify=true
|
|
|
|
# Entrypoints
|
|
- --entrypoints.web.address=:80
|
|
- --entrypoints.web.http.redirections.entrypoint.to=websecure
|
|
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
|
- --entrypoints.websecure.address=:443
|
|
- --entrypoints.websecure.http.tls.certresolver=letsencrypt
|
|
- --entrypoints.websecure.http.tls.domains[0].main=${DOMAIN}
|
|
- --entrypoints.websecure.http.tls.domains[0].sans=*.${DOMAIN}
|
|
|
|
# Providers
|
|
- --providers.docker.endpoint=unix:///var/run/docker.sock
|
|
- --providers.docker.exposedbydefault=false
|
|
- --providers.docker.constraints=Label(`traefik-instance`,`${TRAEFIK_INSTANCE}`)
|
|
|
|
# Certificates Resolvers
|
|
- --certificatesresolvers.letsencrypt.acme.email=${EMAIL}
|
|
- --certificatesresolvers.letsencrypt.acme.storage=acme.json
|
|
- --certificatesresolvers.letsencrypt.acme.caserver=https://acme-v02.api.letsencrypt.org/directory
|
|
- --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare
|
|
- --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53
|
|
|
|
# Log
|
|
- --log.level=INFO
|
|
- --log.filepath=/var/log/traefik/traefik.log
|
|
- --log.maxsize=10
|
|
- --log.maxbackups=5
|
|
|
|
# Access Log
|
|
- --accesslog.filepath=/var/log/traefik/access.log
|
|
- --accesslog.fields.names.StartUTC=drop
|
|
|
|
networks:
|
|
frontend:
|
|
external: true
|
|
|
|
secrets:
|
|
cf_api_token:
|
|
file: ${APPDATA_PATH}/traefik/secrets/cf_api_token
|
|
|
|
volumes:
|
|
socket-proxy:
|