config traefik

docker-compose.yml

@@ -6,7 +6,6 @@
 # Whenever I need to remove some service then I can comment out the lines here.
 include:
   - path:
-      - ${SERVICE_PATH}/caddy/caddy.yml
       - ${SERVICE_PATH}/crowdsec/crowdsec.yml
       - ${SERVICE_PATH}/headscale/headscale.yml
       - ${SERVICE_PATH}/traefik/traefik.yml

services/caddy/Caddyfile

@@ -1,189 +0,0 @@
-(forward_headers) {
-        header {
-                Permissions-Policy interest-cohort=()
-                Strict-Transport-Security "max-age=31536000; includeSubdomains"
-                X-XSS-Protection "1; mode=block"
-                X-Content-Type-Options "nosniff"
-                X-Robots-Tag noindex, nofollow
-                Referrer-Policy "same-origin"
-                Content-Security-Policy "frame-ancestors {$public_domain }} *.{$public_domain}"
-                -Server
-                Permissions-Policy "geolocation=(self {$public_domain }} *.{$public_domain}), microphone=()"
-        }
-}
-
-auth.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-audiobookshelf.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-gitea.{$public_domain} {
-        reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-headscale.{$public_domain} {
-        reverse_proxy headscale:8080
-        tls {$email}
-        import forward_headers
-}
-
-immich.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-ldap.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-linkwarden.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-mealie.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-navidrome.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-ntfy.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-paperless.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-radicale.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-rss.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-pdf.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-superset.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-vaultwarden.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-vikunja.{$public_domain} {
-	reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}
-
-{$public_domain} {
-        reverse_proxy {$main_server_ip} {
-                transport http {
-                        tls_insecure_skip_verify
-                }
-        }
-        tls {$email}
-        import forward_headers
-}

services/caddy/caddy.yml

@@ -1,30 +0,0 @@
-services:
-  caddy:
-    extends:
-      file: ${TEMPLATES_PATH}
-      service: default
-    image: caddy 
-    container_name: caddy 
-    volumes:
-      - ${SERVICE_PATH}/caddy/config:/etc/headscale
-      - ${SERVICE_PATH}/caddy/Caddyfile:/etc/caddy/Caddyfile
-      - ${SERVICE_PATH}/caddy/site:/srv
-      - ${SERVICE_PATH}/caddy/data:/data
-      - ${SERVICE_PATH}/caddy/config:/config
-      - ${SERVICE_PATH}/caddy/certs:/certs
-    ports:
-      - "80:80"
-      - "443:443"
-      - "443:443/udp"
-    environment:
-      email: ${EMAIL}
-      public_domain: ${PUBLIC_DOMAIN}
-      private_domain: ${LOCAL_DOMAIN}
-      main_server_ip: ${MAIN_SERVER_NODE_IP:-10.10.10.2}
-    cap_add:
-      - NET_ADMIN
-    networks:
-      - ip4net
-    labels:
-      # Watchtower
-      - "com.centurylinklabs.watchtower.enable=true"

services/traefik/config/config.yml

@@ -30,7 +30,7 @@ http:
     authelia:
       rule: "Host(`auth.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -38,7 +38,7 @@ http:
     audiobookshelf:
       rule: "Host(`audiobookshelf.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -46,7 +46,7 @@ http:
     gitea:
       rule: "Host(`gitea.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -54,7 +54,7 @@ http:
     headscale:
       rule: "Host(`headscale.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -62,7 +62,7 @@ http:
     immich:
       rule: "Host(`immich.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -70,7 +70,7 @@ http:
     lldap:
       rule: "Host(`ldap.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -78,7 +78,7 @@ http:
     linkwarden:
       rule: "Host(`linkwarden.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -86,7 +86,7 @@ http:
     mealie:
       rule: "Host(`mealie.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -94,7 +94,7 @@ http:
     navidrome:
       rule: "Host(`navidrome.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -102,7 +102,7 @@ http:
     ntfy:
       rule: "Host(`ntfy.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -110,7 +110,7 @@ http:
     paperless:
       rule: "Host(`paperless.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -118,7 +118,7 @@ http:
     pdf:
       rule: "Host(`pdf.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -126,7 +126,7 @@ http:
     radicale:
       rule: "Host(`radicale.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -134,16 +134,15 @@ http:
     rss:
       rule: "Host(`rss.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
 
-<<<<<<< HEAD
     # superset:
     #   rule: "Host(`superset.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
     #   service: node 
-    #   entryPoints: https
+    #   entrypoints: https,http
     #   tls:
     #     certresolver: myresolver
     #   middlewares: crowdsec-bouncer@file
@@ -151,7 +150,7 @@ http:
     vaultwarden:
       rule: "Host(`vaultwarden.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -159,7 +158,7 @@ http:
     vikunja:
       rule: "Host(`vikunja.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
-      entryPoints: https 
+      entrypoints: https,http 
       tls:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
@@ -170,3 +169,12 @@ http:
         servers:
           - url: https://{{ env "TRAEFIK_MAIN_SERVER_NODE_IP" }}
 
+tls:
+  stores:
+    default:
+      defaultCertificate:
+        certFile: /etc/certs/server-vps-lan.crt
+        keyFile: /etc/certs/server-vps-lan.key
+  defaultCertificate:
+    - certFile: /etc/certs/server-vps-lan.crt
+      keyFile: /etc/certs/server-vps-lan.key

services/traefik/traefik.yml

@@ -16,7 +16,6 @@ services:
       TRAEFIK_PUBLIC_DOMAIN: ${PUBLIC_DOMAIN}
       TRAEFIK_MAIN_SERVER_NODE_IP: ${MAIN_SERVER_NODE_IP}
       TRAEFIK_CROWDSEC_API_KEY: ${CROWDSEC_API_KEY}
-      # INFOMANIAK_ACCESS_TOKEN: ${INFOMANIAK_CERTIFICATE_ACCESS_TOKEN}
     volumes:
       - "/var/log/traefik/:/var/log/traefik/"
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
@@ -33,6 +32,8 @@ services:
       - "traefik.http.routers.traefik.entrypoints=https"
       - "traefik.http.routers.traefik.tls=true"
 
+# openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout server-vps-lan.key -out vps-lan.crt \ -subj "/CN=server-vps-lan"
+
 # traefik-agent:
 #   extends:
 #     file: ${TEMPLATES_PATH}