Merge pull request 'Update traefik Docker tag to v3.7.13' (#35) from renovate/traefik-3.x into main

Reviewed-on: #12

.gitignore

@@ -10,3 +10,4 @@ lib/
 **/headscale/run/
 **/crowdsec/config/
 **/crowdsec/data/
+**/beszel/data/

docker-compose.yml

@@ -8,6 +8,7 @@ include:
   - path:
       - ${SERVICE_PATH}/crowdsec/crowdsec.yml
       - ${SERVICE_PATH}/headscale/headscale.yml
+      - ${SERVICE_PATH}/beszel/beszel.yml
       - ${SERVICE_PATH}/traefik/traefik.yml
     env_file: ${SERVICE_PATH}/.env
 

services/beszel/beszel.yml

@@ -0,0 +1,17 @@
+services:
+  beszel-agent:
+    extends:
+      file: ${TEMPLATES_PATH}
+      service: default
+    image: henrygd/beszel-agent:0.19.0
+    container_name: beszel-agent
+    network_mode: host
+    volumes:
+      - ${SERVICE_PATH}/beszel/data:/var/lib/beszel-agent
+      - ${SERVICE_PATH}/beszel/socket:/beszel_socket
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      LISTEN: /beszel_socket/beszel.sock
+      HUB_URL: http://100.64.0.3:3004
+      TOKEN: ${BESZEL_VPS_TOKEN}
+      KEY: ${BESZEL_VPS_KEY}

services/crowdsec/appsec.yaml

@@ -1,6 +0,0 @@
-appsec_configs:
-  - crowdsecurity/appsec-default
-labels:
-  type: appsec
-listen_addr: 0.0.0.0:7422
-source: appsec

services/crowdsec/config.yaml

@@ -47,5 +47,5 @@ api:
 prometheus:
   enabled: true
   level: full
-  listen_addr: "[::]"
+  listen_addr: "100.64.0.3"
   listen_port: 6060

services/crowdsec/crowdsec.yml

@@ -4,10 +4,10 @@ services:
       file: ${TEMPLATES_PATH}
       service: default
     container_name: crowdsec
-    image: crowdsecurity/crowdsec:v1.7.4
+    image: crowdsecurity/crowdsec:v1.8.1
     environment:
       COLLECTIONS: crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules crowdsecurity/http-cve
-      CROWDSEC_BOUNCER_API_KEY: ${CROWDSEC_API_KEY}
+      BOUNCER_KEY_traefik: ${CROWDSEC_API_KEY}
       CUSTOM_HOSTNAME: crowdsec
     ports:
       - 6061:8080
@@ -15,10 +15,7 @@ services:
     networks:
       - ip4net
     volumes:
-      - ${SERVICE_PATH}/crowdsec/config/acquis.yaml:/etc/crowdsec/acquis.yaml:ro
-      - ${SERVICE_PATH}/crowdsec/config/config.yaml:/etc/crowdsec/config.yaml
       - ${SERVICE_PATH}/crowdsec/config:/etc/crowdsec
-      - ${SERVICE_PATH}/crowdsec/appsec.yaml:/etc/crowdsec/acquis.d/appsec.yaml
       - ${SERVICE_PATH}/crowdsec/data:/var/lib/crowdsec/data
       - /var/log/traefik:/var/log/crowdsec:ro
       - /var/log/syslog:/var/log/syslog:ro

services/headscale/config-template.yaml.j2

@@ -137,7 +137,10 @@ derp:
 disable_check_updates: false
 
 # Time before an inactive ephemeral node is deleted?
-ephemeral_node_inactivity_timeout: 30m
+# ephemeral_node_inactivity_timeout: 30m
+node:
+  ephemeral:
+    inactivity_timeout: 30m
 
 database:
   # Database type. Available options: sqlite, postgres
@@ -398,8 +401,3 @@ logtail:
   # As there is currently no support for overriding the log server in headscale, this is
   # disabled by default. Enabling this will make your clients send logs to Tailscale Inc.
   enabled: false
-
-# Enabling this option makes devices prefer a random port for WireGuard traffic over the
-# default static port 41641. This option is intended as a workaround for some buggy
-# firewall devices. See https://tailscale.com/kb/1181/firewalls/ for more information.
-randomize_client_port: false

services/headscale/headscale.yml

@@ -23,4 +23,4 @@ services:
       - "traefik.http.routers.headscale.entrypoints=https"
       - "traefik.http.routers.headscale.tls.certresolver=myresolver"
       - "traefik.http.routers.headscale.tls=true"
-      - "traefik.http.routers.headscale.middlewares=crowdsec-bouncer@file"
+      # - "traefik.http.routers.headscale.middlewares=crowdsec-bouncer@file"

services/traefik/config/config.yml

@@ -5,10 +5,11 @@ http:
     crowdsec-bouncer:
       plugin:
         crowdsec-bouncer-traefik-plugin:
-          enabled: true
+          enabled: true 
           logLevel: INFO
           updateIntervalSeconds: 60
-          crowdsecMode: stream
+          metricsUpdateIntervalSeconds: 600
+          crowdsecMode: stream 
           crowdsecAppsecEnabled: true
           crowdsecAppsecFailureBlock: true 
           crowdsecAppsecUnreachableBlock: true 
@@ -20,10 +21,11 @@ http:
           forwardedHeadersTrustedIPs:
             - 10.0.0.0/8
           clientTrustedIPs:
-            - 192.168.178.0/24
-          captchaProvider: hcaptcha
-          captchaSiteKey: b2d20610-8dda-4f40-8688-7ca8e1e628f8 # found in hcaptcha account
-          captchaSecretKey: {{ env "TRAEFIK_CAPTCHA_KEY" }}
+            - 192.168.1.0/24
+            - 100.64.0.0/24
+          # captchaProvider: hcaptcha
+          # captchaSiteKey: b2d20610-8dda-4f40-8688-7ca8e1e628f8 # found in hcaptcha account
+          # captchaSecretKey: {{ env "TRAEFIK_CAPTCHA_KEY" }}
           captchaGracePeriodSeconds: 1800
           captchaHTMLFilePath: /captcha.html
           banHTMLFilePath: /ban.html
@@ -53,14 +55,6 @@ http:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
 
-    headscale:
-      rule: "Host(`headscale.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
-      service: node 
-      entrypoints: https,http 
-      tls:
-        certresolver: myresolver
-      middlewares: crowdsec-bouncer@file
-
     immich:
       rule: "Host(`immich.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 
@@ -125,6 +119,14 @@ http:
         certresolver: myresolver
       middlewares: crowdsec-bouncer@file
 
+    quiz:
+      rule: "Host(`split.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
+      service: node 
+      entrypoints: https,http 
+      tls:
+        certresolver: myresolver
+      middlewares: crowdsec-bouncer@file
+
     radicale:
       rule: "Host(`radicale.{{ env "TRAEFIK_PUBLIC_DOMAIN" }}`)"
       service: node 

services/traefik/config/traefik.yml

@@ -74,4 +74,4 @@ experimental:
   plugins:
     crowdsec-bouncer-traefik-plugin:
       moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      version: "v1.5.0-beta1"
+      version: "v1.7.1"

services/traefik/traefik.yml

@@ -3,19 +3,25 @@ services:
     extends:
       file: ${TEMPLATES_PATH}
       service: default
-    image: traefik:v3.6.6
+    image: traefik:v3.7.13
     container_name: traefik
     ports:
       - "80:80"
       - "443:443"
       - "8079:8080"
     networks:
-      - ip4net
+      ip4net:
+        ipv4_address: 10.6.0.10
     environment:
       TRAEFIK_EMAIL: ${EMAIL}
       TRAEFIK_PUBLIC_DOMAIN: ${PUBLIC_DOMAIN}
       TRAEFIK_MAIN_SERVER_NODE_IP: ${MAIN_SERVER_NODE_IP}
       TRAEFIK_CROWDSEC_API_KEY: ${CROWDSEC_API_KEY}
+    deploy:
+      resources:
+        limits:
+          cpus: "0.3"
+          memory: 150M
     volumes:
       - "/var/log/traefik/:/var/log/traefik/"
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
@@ -32,63 +38,73 @@ services:
       - "traefik.http.routers.traefik.entrypoints=https"
       - "traefik.http.routers.traefik.tls=true"
 
-  traefik-agent:
-    extends:
-      file: ${TEMPLATES_PATH}
-      service: default
-    image: hhftechnology/traefik-log-dashboard-agent:2.4.0
-    container_name: traefik-log-dashboard-agent
-    networks:
-      - ip4net
-    ports:
-      - "8078:5000"
-    volumes:
-      - "/var/log/traefik/:/logs:ro"
-      - "${SERVICE_PATH}/traefik/log-dashboard/positions:/data"
-    environment:
-      TRAEFIK_LOG_DASHBOARD_ACCESS_PATH: /logs/access.log
-      TRAEFIK_LOG_DASHBOARD_AUTH_TOKEN: ${TRAEFIK_DASHBOARD_TOKEN}
-      TRAEFIK_LOG_DASHBOARD_SYSTEM_MONITORING: true
-      TRAEFIK_LOG_DASHBOARD_LOG_FORMAT: json
-    healthcheck:
-      test:
-        [
-          "CMD",
-          "wget",
-          "--no-verbose",
-          "--tries=1",
-          "--spider",
-          "http://localhost:5000/api/logs/status",
-        ]
-      interval: 2m
-      timeout: 10s
-      retries: 3
-      start_period: 30s
-
-  traefik-dashboard:
-    extends:
-      file: ${TEMPLATES_PATH}
-      service: default
-    image: hhftechnology/traefik-log-dashboard:2.4.0
-    container_name: traefik-log-dashboard
-    networks:
-      - ip4net
-    ports:
-      - "8077:3000"
-    volumes:
-      - "${SERVICE_PATH}/traefik/log-dashboard/dashboard:/app/data"
-      - "${SERVICE_PATH}/traefik/log-dashboard/positions:/data"
-    environment:
-      AGENT_API_URL: http://traefik-agent:5000
-      AGENT_API_TOKEN: ${TRAEFIK_DASHBOARD_TOKEN}
-      # Display Configuration
-      NEXT_PUBLIC_SHOW_DEMO_PAGE: false
-    depends_on:
-      traefik-agent:
-        condition: service_healthy
-    labels:
-      # traefik
-      - "traefik.enable=true"
-      - "traefik.http.routers.traefik-log-dashboard.rule=Host(`traefik-dashboard.${LOCAL_VPS_DOMAIN}`)"
-      - "traefik.http.routers.traefik-log-dashboard.entrypoints=https"
-      - "traefik.http.routers.traefik-log-dashboard.tls=true"
+  # traefik-agent:
+  #   extends:
+  #     file: ${TEMPLATES_PATH}
+  #     service: default
+  #   image: hhftechnology/traefik-log-dashboard-agent:2.4.1
+  #   container_name: traefik-agent
+  #   networks:
+  #     - ip4net
+  #   ports:
+  #     - "8078:5000"
+  #   volumes:
+  #     - "/var/log/traefik/:/logs:ro"
+  #     - "${SERVICE_PATH}/traefik/log-dashboard/positions:/data"
+  #   environment:
+  #     TRAEFIK_LOG_DASHBOARD_ACCESS_PATH: /logs/access.log
+  #     TRAEFIK_LOG_DASHBOARD_AUTH_TOKEN: ${TRAEFIK_DASHBOARD_TOKEN}
+  #     TRAEFIK_LOG_DASHBOARD_SYSTEM_MONITORING: true
+  #     TRAEFIK_LOG_DASHBOARD_LOG_FORMAT: json
+  #   deploy:
+  #     resources:
+  #       limits:
+  #         cpus: "0.15"
+  #         memory: 50M
+  #   healthcheck:
+  #     test:
+  #       [
+  #         "CMD",
+  #         "wget",
+  #         "--no-verbose",
+  #         "--tries=1",
+  #         "--spider",
+  #         "http://localhost:5000/api/logs/status",
+  #       ]
+  #     interval: 2m
+  #     timeout: 10s
+  #     retries: 3
+  #     start_period: 30s
+  #
+  # traefik-dashboard:
+  #   extends:
+  #     file: ${TEMPLATES_PATH}
+  #     service: default
+  #   image: hhftechnology/traefik-log-dashboard:2.4.1
+  #   container_name: traefik-dashboard
+  #   networks:
+  #     - ip4net
+  #   ports:
+  #     - "8077:3000"
+  #   volumes:
+  #     - "${SERVICE_PATH}/traefik/log-dashboard/dashboard:/app/data"
+  #     - "${SERVICE_PATH}/traefik/log-dashboard/positions:/data"
+  #   environment:
+  #     AGENT_API_URL: http://traefik-agent:5000
+  #     AGENT_API_TOKEN: ${TRAEFIK_DASHBOARD_TOKEN}
+  #     # Display Configuration
+  #     NEXT_PUBLIC_SHOW_DEMO_PAGE: false
+  #   depends_on:
+  #     traefik-agent:
+  #       condition: service_healthy
+  #   deploy:
+  #     resources:
+  #       limits:
+  #         cpus: "0.1"
+  #         memory: 120M
+  #   labels:
+  #     # traefik
+  #     - "traefik.enable=true"
+  #     - "traefik.http.routers.traefik-log-dashboard.rule=Host(`traefik-dashboard.${LOCAL_VPS_DOMAIN}`)"
+  #     - "traefik.http.routers.traefik-log-dashboard.entrypoints=https"
+  #     - "traefik.http.routers.traefik-log-dashboard.tls=true"