diff --git a/config/docker/2022/yml-files/docker-socket-proxy.yml b/config/docker/2022/yml-files/docker-socket-proxy.yml new file mode 100644 index 0000000..d573bd8 --- /dev/null +++ b/config/docker/2022/yml-files/docker-socket-proxy.yml @@ -0,0 +1,72 @@ +version: "3.7" +########################### NETWORKS +# There is no need to create any networks outside this docker-compose file. +# You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please. +# Docker Compose version 3.5 or higher required to define networks this way. +networks: + gl_proxy: + name: gl_proxy + driver: bridge + ipam: + config: + - subnet: $GL_PROXY_SUBNET + - gateway: $GL_PROXY_GATEWAY + default: + driver: bridge + gl_socket_proxy: + name: gl_socket_proxy + driver: bridge + ipam: + config: + - subnet: $GL_SOCKET_PROXY_SUBNET + - gateway: $GL_SOCKET_PROXY_GATEWAY + +########################### SERVICES +services: + # Docker Socket Proxy - Security Enchanced Proxy for Docker Socket + socket-proxy: + container_name: gl-socket-proxy + image: tecnativa/docker-socket-proxy + restart: always + networks: + gl_socket_proxy: + ipv4_address: $SOCKET_PROXY_IP # You can specify a static IP + privileged: true + #ports: + # - "127.0.0.1:2375:2375" # Port 2375 should only ever get exposed to the internal network. When possible use this line. + # I use the next line instead, as I want portainer to manage multiple docker endpoints within my home network. + # - "2375:2375" + volumes: + - "/var/run/docker.sock:/var/run/docker.sock" + environment: + - LOG_LEVEL=info # debug,info,notice,warning,err,crit,alert,emerg + ## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.). + # 0 to revoke access. + # 1 to grant access. + ## Granted by Default + - EVENTS=1 + - PING=1 + - VERSION=1 + ## Revoked by Default + # Security critical + - AUTH=0 + - SECRETS=0 + - POST=1 # Ouroboros + # Not always needed + - BUILD=0 + - COMMIT=0 + - CONFIGS=0 + - CONTAINERS=1 # Traefik, portainer, etc. + - DISTRIBUTION=0 + - EXEC=1 + - IMAGES=1 # Portainer + - INFO=1 # Portainer + - NETWORKS=1 # Portainer + - NODES=0 + - PLUGINS=0 + - SERVICES=1 # Portainer + - SESSION=0 + - SWARM=0 + - SYSTEM=0 + - TASKS=1 # Portaienr + - VOLUMES=1 # Portainer diff --git a/config/docker/2022/yml-files/dockergc.yml b/config/docker/2022/yml-files/dockergc.yml new file mode 100644 index 0000000..e0fcff2 --- /dev/null +++ b/config/docker/2022/yml-files/dockergc.yml @@ -0,0 +1,47 @@ +version: "3.7" +########################### NETWORKS +# There is no need to create any networks outside this docker-compose file. +# You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please. +# Docker Compose version 3.5 or higher required to define networks this way. +networks: + gl_proxy: + name: gl_proxy + driver: bridge + ipam: + config: + - subnet: $GL_PROXY_SUBNET + - gateway: $GL_PROXY_GATEWAY + default: + driver: bridge + gl_socket_proxy: + name: gl_socket_proxy + driver: bridge + ipam: + config: + - subnet: $GL_SOCKET_PROXY_SUBNET + - gateway: $GL_SOCKET_PROXY_GATEWAY + +########################### SERVICES +services: + # Docker-GC - Automatic Docker Garbage Collection + # Create docker-gc-exclude file + dockergc: + image: clockworksoul/docker-gc-cron:latest + container_name: docker-gc + restart: unless-stopped + networks: + - gl_socket_proxy + depends_on: + - socket-proxy + volumes: + # - /var/run/docker.sock:/var/run/docker.sock # Use Docker Socket Proxy instead for improved security + - $DOCKERDIR/appdata/docker-gc/docker-gc-exclude:/etc/docker-gc-exclude + environment: + CRON: 0 0 0 * * ? # Everyday at midnight. Previously 0 0 * * * + FORCE_IMAGE_REMOVAL: 1 + FORCE_CONTAINER_REMOVAL: 0 + GRACE_PERIOD_SECONDS: 604800 + DRY_RUN: 0 + CLEAN_UP_VOLUMES: 1 + TZ: $TZ + DOCKER_HOST: $DOCKER_ENDPOINT \ No newline at end of file diff --git a/config/docker/2022/yml-files/dozzle.yml b/config/docker/2022/yml-files/dozzle.yml new file mode 100644 index 0000000..f14b55c --- /dev/null +++ b/config/docker/2022/yml-files/dozzle.yml @@ -0,0 +1,70 @@ +version: "3.7" +########################### NETWORKS +# There is no need to create any networks outside this docker-compose file. +# You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please. +# Docker Compose version 3.5 or higher required to define networks this way. +networks: + gl_proxy: + name: gl_proxy + driver: bridge + ipam: + config: + - subnet: $GL_PROXY_SUBNET + - gateway: $GL_PROXY_GATEWAY + default: + driver: bridge + gl_socket_proxy: + name: gl_socket_proxy + driver: bridge + ipam: + config: + - subnet: $GL_SOCKET_PROXY_SUBNET + - gateway: $GL_SOCKET_PROXY_GATEWAY + +########################### SECRETS +#secrets: +# htpasswd: +# file: $SECRETSDIR/htpasswd +# authelia_jwt_secret: +# file: $SECRETSDIR/authelia_jwt_secret +# authelia_session_secret: +# file: $SECRETSDIR/authelia_session_secret +# authelia_storage_mysql_password: +# file: $DOCKERDIR/secrets/authelia_storage_mysql_password +# authelia_notifier_smtp_password: +# file: $DOCKERDIR/secrets/authelia_notifier_smtp_password +# authelia_duo_api_secret_key: +# file: $DOCKERDIR/secrets/authelia_duo_api_secret_key +########################### SERVICES +services: + dozzle: + container_name: gl-dozzle + image: amir20/dozzle:latest + restart: unless-stopped + networks: + gl_proxy: + ipv4_address: $DOZZLE_IP0 + gl_socket_proxy: + ipv4_address: $DOZZLE_IP1 + security_opt: + - no-new-privileges:true + # ports: + # - "$HEIMDALL_PORT:80" + #volumes: + # - $DOCKERDIR/appdata/$APP:/config + environment: + DOZZLE_LEVEL: info + DOZZLE_TAILSIZE: 300 + DOZZLE_FILTER: "status=running" + # DOZZLE_FILTER: "label=log_me" # limits logs displayed to containers with this label + DOCKER_HOST: $DOCKER_ENDPOINT + labels: + - "traefik.enable=true" + ## HTTP Routers + - "traefik.http.routers.dozzle-rtr.entrypoints=https" + - "traefik.http.routers.dozzle-rtr.rule=HostHeader(`dozzle.$DOMAINNAME0`)" + ## Middlewares + - "traefik.http.routers.dozzle-rtr.middlewares=chain-authelia@file" + ## HTTP Services + - "traefik.http.routers.dozzle-rtr.service=dozzle-svc" + - "traefik.http.services.dozzle-svc.loadbalancer.server.port=8080" \ No newline at end of file diff --git a/config/docker/2022/yml-files/gl-env.env b/config/docker/2022/yml-files/gl-env.env new file mode 100644 index 0000000..caee2d1 --- /dev/null +++ b/config/docker/2022/yml-files/gl-env.env @@ -0,0 +1,82 @@ +##### SYSTEM + +PUID=1001 +PGID=995 +TZ=Europe/HelsinkI +USERDIR=/home/gurulandia +DOCKERDIR=/gurulandia/data/docker +SECRETSDIR=/gurulandia/data/docker/secrets +DOCKER_ENDPOINT=tcp://socket-proxy:2375 + +##### SUBNETS + +PROXY_SUBNET=192.168.91.0/24 +SOCKET_PROXY_SUBNET=192.168.92.0/24 + +##### GATEWAYS + +PROXY_GATEWAY=192.168.91.1 +SOCKET_PROXY_GATEWAY=192.168.92.1 + +##### IP ADDRESSES + +HEIMDALL_IP=192.168.91.2 +VSCODE_IP=192.168.91.3 +YOURLS_IP=192.168.91.4 +LIBRESPEED_IP=192.168.91.5 +ADMINER_IP=192.168.91.6 +DOZZLE_IP0=192.168.91.7 +GLANCES_IP0=192.168.91.8 +CLOUDDNS_IP=192.168.91.9 +CERTDUMPER_IP=192.168.91.10 + +AUTHELIA_IP=192.168.91.252 +PORTAINER_IP0=192.168.91.253 +TRAEFIK_IP0=192.168.91.254 + +DOZZLE_IP1=192.168.92.7 +GLANCES_IP1=192.168.92.8 +TRAEFIK_IP1=192.168.92.252 +PORTAINER_IP1=192.168.92.253 +SOCKET_PROXY_IP=192.168.92.254 + +#SERVER_IP= +#PIHOLE_IP= +#LOCAL_NETWORK= + +##### PORTS + +LIBRESPEED_PORT=30001 + +##### DOMAIN + +DOMAINNAME0=gurulandia.eu +DOMAINNAME1=local.gurulandia.eu + +CLOUDFLARE_EMAIL=gurulandia@outlook.com +CLOUDFLARE_IP_RANGES=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,172.64.0.0/13,131.0.72.0/22,104.16.0.0/13,104.24.0.0/14 + +##### DUCKDNS + +DUCKDNSDOMAIN0=gurulandia.duckdns.org +DUCKDNS_TOKEN=99636f9f-46d7-4d80-b171-6ae486d1bc7b + +##### Certificate + +CERTRESOLVER=dns-cloudflare +DNS_PROVIDER=cloudflare +RESOLVER0=1.1.1.1:53 +RESOLVER1=1.0.0.1:53 + +##### DATABASE + +DB_HOST=192.168.99.60 +DB_PORT=3306 +MYSQL_ROOT_PASSWORD= + +VSCODE_PASSWORD=glvscode + +EMAIL=gurulandia@outlook.com + +GUAC_MYSQL_USER=guacamole +GUAC_MYSQL_PASSWORD=guacamole \ No newline at end of file diff --git a/config/docker/2022/yml-files/glances.yml b/config/docker/2022/yml-files/glances.yml new file mode 100644 index 0000000..8bff8a6 --- /dev/null +++ b/config/docker/2022/yml-files/glances.yml @@ -0,0 +1,69 @@ +version: "3.7" +########################### NETWORKS +# There is no need to create any networks outside this docker-compose file. +# You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please. +# Docker Compose version 3.5 or higher required to define networks this way. +networks: + gl_proxy: + name: gl_proxy + driver: bridge + ipam: + config: + - subnet: $GL_PROXY_SUBNET + - gateway: $GL_PROXY_GATEWAY + default: + driver: bridge + gl_socket_proxy: + name: gl_socket_proxy + driver: bridge + ipam: + config: + - subnet: $GL_SOCKET_PROXY_SUBNET + - gateway: $GL_SOCKET_PROXY_GATEWAY + +########################### SECRETS +#secrets: +# htpasswd: +# file: $SECRETSDIR/htpasswd +# authelia_jwt_secret: +# file: $SECRETSDIR/authelia_jwt_secret +# authelia_session_secret: +# file: $SECRETSDIR/authelia_session_secret +# authelia_storage_mysql_password: +# file: $DOCKERDIR/secrets/authelia_storage_mysql_password +# authelia_notifier_smtp_password: +# file: $DOCKERDIR/secrets/authelia_notifier_smtp_password +# authelia_duo_api_secret_key: +# file: $DOCKERDIR/secrets/authelia_duo_api_secret_key +########################### SERVICES +services: + glances: + container_name: gl-glances + image: nicolargo/glances:latest + restart: unless-stopped + networks: + gl_proxy: + ipv4_address: $GLANCES_IP0 + gl_socket_proxy: + ipv4_address: $GLANCES_IP1 + security_opt: + - no-new-privileges:true + # ports: + # - "$HEIMDALL_PORT:80" + volumes: + - $DOCKERDIR/appdata/glances/glances.conf:/glances/conf/glances.conf + environment: + # GLANCES_OPT: "-C /glances/conf/glances.conf --quiet --export influxdb" + # GLANCES_OPT: "--export influxdb" + GLANCES_OPT: "-w" + DOCKER_HOST: $DOCKER_ENDPOINT + labels: + - "traefik.enable=true" + ## HTTP Routers + - "traefik.http.routers.glances-rtr.entrypoints=https" + - "traefik.http.routers.glances-rtr.rule=HostHeader(`glances.$DOMAINNAME0`)" + ## Middlewares + - "traefik.http.routers.glances-rtr.middlewares=chain-authelia@file" + ## HTTP Services + - "traefik.http.routers.glances-rtr.service=glances-svc" + - "traefik.http.services.glances-svc.loadbalancer.server.port=61208" \ No newline at end of file