diff --git a/config/docker/2022/yml-files/heimdall.yml b/config/docker/2022/yml-files/heimdall.yml new file mode 100644 index 0000000..2bb3435 --- /dev/null +++ b/config/docker/2022/yml-files/heimdall.yml @@ -0,0 +1,53 @@ +version: "3.7" +########################### NETWORKS +# There is no need to create any networks outside this docker-compose file. +# You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please. +# Docker Compose version 3.5 or higher required to define networks this way. +networks: + gl_proxy: + name: gl_proxy + driver: bridge + ipam: + config: + - subnet: $GL_PROXY_SUBNET + - gateway: $GL_PROXY_GATEWAY + default: + driver: bridge + gl_socket_proxy: + name: gl_socket_proxy + driver: bridge + ipam: + config: + - subnet: $GL_SOCKET_PROXY_SUBNET + - gateway: $GL_SOCKET_PROXY_GATEWAY + +########################### SERVICES +services: + # Heimdall - Unified Frontend Alternative + heimdall: + container_name: gl-heimdall + image: linuxserver/heimdall:latest + restart: unless-stopped + networks: + gl_proxy: + ipv4_address: $HEIMDALL_IP + security_opt: + - no-new-privileges:true + # ports: + # - "$HEIMDALL_PORT:80" + volumes: + - $DOCKERDIR/appdata/heimdall:/config + environment: + - PUID=$PUID + - PGID=$PGID + - TZ=$TZ + labels: + - "traefik.enable=true" + ## HTTP Routers + - "traefik.http.routers.heimdall-rtr.entrypoints=https" + - "traefik.http.routers.heimdall-rtr.rule=Host(`home.$DOMAINNAME0`)" + ## Middlewares + - "traefik.http.routers.heimdall-rtr.middlewares=chain-authelia@file" + ## HTTP Services + - "traefik.http.routers.heimdall-rtr.service=heimdall-svc" + - "traefik.http.services.heimdall-svc.loadbalancer.server.port=80" diff --git a/config/docker/2022/yml-files/librespeed.yml b/config/docker/2022/yml-files/librespeed.yml new file mode 100644 index 0000000..8877320 --- /dev/null +++ b/config/docker/2022/yml-files/librespeed.yml @@ -0,0 +1,74 @@ +version: "3.7" +########################### NETWORKS +# There is no need to create any networks outside this docker-compose file. +# You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please. +# Docker Compose version 3.5 or higher required to define networks this way. +networks: + gl_proxy: + name: gl_proxy + driver: bridge + ipam: + config: + - subnet: $GL_PROXY_SUBNET + - gateway: $GL_PROXY_GATEWAY + default: + driver: bridge + gl_socket_proxy: + name: gl_socket_proxy + driver: bridge + ipam: + config: + - subnet: $GL_SOCKET_PROXY_SUBNET + - gateway: $GL_SOCKET_PROXY_GATEWAY + +########################### SECRETS +#secrets: +# htpasswd: +# file: $SECRETSDIR/htpasswd +# authelia_jwt_secret: +# file: $SECRETSDIR/authelia_jwt_secret +# authelia_session_secret: +# file: $SECRETSDIR/authelia_session_secret +# authelia_storage_mysql_password: +# file: $DOCKERDIR/secrets/authelia_storage_mysql_password +# authelia_notifier_smtp_password: +# file: $DOCKERDIR/secrets/authelia_notifier_smtp_password +# authelia_duo_api_secret_key: +# file: $DOCKERDIR/secrets/authelia_duo_api_secret_key +########################### SERVICES +services: + librespeed: + container_name: gl-librespeed + image: linuxserver/librespeed:latest + restart: unless-stopped + networks: + gl_proxy: + ipv4_address: $LIBRESPEED_IP + security_opt: + - no-new-privileges:true + #ports: + # - "$LIBRESPEED_PORT:80" + volumes: + - /$DOCKERDIR/appdata/librespeed:/config + environment: + - PUID=$PUID + - PGID=$PGID + - TZ=$TZ + #- DB_TYPE=mysql + #- DB_HOSTNAME=192.168.99.60 + #- DB_PORT=3306 + #- DB_NAME=GL_LibreSpeed + #- DB_USERNAME=librespeed + #- DB_PASSWORD=librespeed + - PASSWORD=librespeed + - CUSTOM_RESULTS=true + labels: + - "traefik.enable=true" + ## HTTP Routers + - "traefik.http.routers.librespeed-rtr.entrypoints=https" + - "traefik.http.routers.librespeed-rtr.rule=HostHeader(`speedtest.$DOMAINNAME0`)" + ## Middlewares + - "traefik.http.routers.librespeed-rtr.middlewares=chain-authelia@file" + ## HTTP Services + - "traefik.http.routers.librespeed-rtr.service=librespeed-svc" + - "traefik.http.services.librespeed-svc.loadbalancer.server.port=80" \ No newline at end of file diff --git a/config/docker/2022/yml-files/portainer.yml b/config/docker/2022/yml-files/portainer.yml new file mode 100644 index 0000000..aa3c774 --- /dev/null +++ b/config/docker/2022/yml-files/portainer.yml @@ -0,0 +1,55 @@ +version: "3.7" +########################### NETWORKS +# There is no need to create any networks outside this docker-compose file. +# You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please. +# Docker Compose version 3.5 or higher required to define networks this way. +networks: + proxy: + name: proxy + driver: bridge + ipam: + config: + - subnet: $PROXY_SUBNET + - gateway: $PROXY_GATEWAY + #default: + # driver: bridge +# gl_socket_proxy: +# name: socket_proxy +# driver: bridge +# ipam: +# config: +# - subnet: $SOCKET_PROXY_SUBNET +# - gateway: $SOCKET_PROXY_GATEWAY + +########################### SERVICES +services: + # Portainer - WebUI for Containers + portainer: + container_name: tmp-portainer + image: portainer/portainer-ce:latest + restart: unless-stopped + # command: -H $DOCKER_ENDPOINT # Use Docker Socket Proxy instead for improved security + networks: + proxy: + ipv4_address: $PORTAINER_IP0 + # gl_socket_proxy: + # ipv4_address: $PORTAINER_IP1 + security_opt: + - no-new-privileges:true + ports: + - '9000:9000' + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - $DOCKERDIR/appdata/portainer/data:/data # Change to local directory if you want to save/transfer config locally + environment: + - TZ=$TZ + labels: + # - "traefik.enable=true" + ## HTTP Routers + # - "traefik.http.routers.portainer-rtr.entrypoints=https" + # - "traefik.http.routers.portainer-rtr.rule=Host(`portainer.$DOMAINNAME0`)" + ## Middlewares + # - "traefik.http.routers.portainer-rtr.middlewares=chain-authelia@file" + ## HTTP Services + # - "traefik.http.routers.portainer-rtr.service=portainer-svc" + # - "traefik.http.services.portainer-svc.loadbalancer.server.port=9000" diff --git a/config/docker/2022/yml-files/traefik2.yml b/config/docker/2022/yml-files/traefik2.yml new file mode 100644 index 0000000..c079dba --- /dev/null +++ b/config/docker/2022/yml-files/traefik2.yml @@ -0,0 +1,147 @@ +version: "3.7" +########################### NETWORKS +# There is no need to create any networks outside this docker-compose file. +# You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please. +# Docker Compose version 3.5 or higher required to define networks this way. +networks: + gl_proxy: + name: gl_proxy + driver: bridge + ipam: + config: + - subnet: $GL_PROXY_SUBNET + - gateway: $GL_PROXY_GATEWAY + default: + driver: bridge + gl_socket_proxy: + name: gl_socket_proxy + driver: bridge + ipam: + config: + - subnet: $GL_SOCKET_PROXY_SUBNET + - gateway: $GL_SOCKET_PROXY_GATEWAY + +########################### SECRETS +secrets: + htpasswd: + file: $SECRETSDIR/htpasswd + cloudflare_email: + file: $SECRETSDIR/cloudflare_email + cloudflare_api_key: + file: $SECRETSDIR/cloudflare_api_key + cloudflare_api_token: + file: $SECRETSDIR/secrets/cloudflare_api_token + +########################### SERVICES +services: + # Traefik 2 - Reverse Proxy + # Touch (create empty files) traefik.log and acme/acme.json. Set acme.json permissions to 600. + # touch $DOCKERDIR/traefik2/acme/acme.json + # chmod 600 $DOCKERDIR/traefik2/acme/acme.json + # touch $DOCKERDIR/traefik2/traefik.log + traefik: + container_name: gl-traefik + image: traefik:latest + #image: traefik:livarot # picodon v2.3.x # chevrotin v2.2.x + restart: always + command: # CLI arguments + - --global.checkNewVersion=true + - --global.sendAnonymousUsage=true + - --entryPoints.http.address=:80 + - --entryPoints.https.address=:443 + #- --entrypoints.https.forwardedHeaders.trustedIPs=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12 + - --entrypoints.https.forwardedHeaders.trustedIPs=$CLOUDFLARE_IP_RANGES + - --entryPoints.traefik.address=:8080 + # - --entryPoints.ping.address=:8081 + - --api=true + # - --api.insecure=true + - --api.dashboard=true + #- --ping=true + #- --pilot.token=$TRAEFIK_PILOT_TOKEN + - --serversTransport.insecureSkipVerify=true + #- --log=true + #- --log.level=WARN # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC + #- --accessLog=true + #- --accessLog.filePath=/traefik.log + #- --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines + #- --accessLog.filters.statusCodes=400-499 + - --providers.docker=true + - --providers.docker.endpoint=$DOCKER_ENDPOINT # Use Docker Socket Proxy instead for improved security + # Automatically set Host rule for services + # - --providers.docker.defaultrule=Host(`{{ index .Labels "com.docker.compose.service" }}.$DOMAINNAME0`) + - --providers.docker.exposedByDefault=false + # - --entrypoints.https.http.middlewares=chain-oauth@file + - --entrypoints.https.http.tls.options=tls-opts@file + # Add dns-cloudflare as default certresolver for all services. Also enables TLS and no need to specify on individual services + - --entrypoints.https.http.tls.certresolver=$CERTRESOLVER + - --entrypoints.https.http.tls.domains[0].main=$DOMAINNAME0 + - --entrypoints.https.http.tls.domains[0].sans=*.$DOMAINNAME0 + - --entrypoints.https.http.tls.domains[1].main=$DOMAINNAME1 # Pulls main cert for second domain + - --entrypoints.https.http.tls.domains[1].sans=*.$DOMAINNAME1 # Pulls wildcard cert for second domain + - --providers.docker.network=gl_proxy + - --providers.docker.swarmMode=false + - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory + # - --providers.file.filename=/path/to/file # Load dynamic configuration from a file + - --providers.file.watch=true # Only works on top level files in the rules folder + # - --certificatesResolvers.dns-cloudflare.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory # LetsEncrypt Staging Server - uncomment when testing + - --certificatesResolvers.$CERTRESOLVER.acme.email=$CLOUDFLARE_EMAIL + - --certificatesResolvers.$CERTRESOLVER.acme.storage=/acme.json + - --certificatesResolvers.$CERTRESOLVER.acme.dnsChallenge.provider=$DNS_PROVIDER + - --certificatesResolvers.$CERTRESOLVER.acme.dnsChallenge.resolvers=$RESOLVER0 #,$RESOLVER1 + - --certificatesResolvers.$CERTRESOLVER.acme.dnsChallenge.delayBeforeCheck=90 # To delay DNS check and reduce LE hitrate + networks: + gl_proxy: + ipv4_address: $TRAEFIK_IP0 # You can specify a static IP + gl_socket_proxy: + ipv4_address: $TRAEFIK_IP1 + security_opt: + - no-new-privileges:true + #healthcheck: + # test: ["CMD", "traefik", "healthcheck", "--ping"] + # interval: 5s + # retries: 3 + ports: + - target: 80 + published: 80 + protocol: tcp + mode: host + - target: 443 + published: 443 + protocol: tcp + mode: host + # - target: 8080 + # published: 8080 + # protocol: tcp + # mode: host + volumes: + - $DOCKERDIR/appdata/traefik2/rules:/rules # file provider directory + - $DOCKERDIR/appdata/traefik2/acme/acme.json:/acme.json # cert location - you must touch this file and change permissions to 600 + #- $DOCKERDIR/appdata/traefik2/traefik.log:/traefik.log # for fail2ban - make sure to touch file before starting container + - $DOCKERDIR/shared:/shared + environment: + - CF_API_EMAIL_FILE=/run/secrets/cloudflare_email + - CF_API_KEY_FILE=/run/secrets/cloudflare_api_key + - HTPASSWD_FILE=/run/secrets/htpasswd # HTPASSWD_FILE can be whatever as it is not used/called anywhere. + secrets: + - cloudflare_email + - cloudflare_api_key + - htpasswd + labels: + #- "autoheal=true" + - "traefik.enable=true" + # HTTP-to-HTTPS Redirect + - "traefik.http.routers.http-catchall.entrypoints=http" + - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)" + - "traefik.http.routers.http-catchall.middlewares=redirect-to-https" + - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https" + # HTTP Routers + - "traefik.http.routers.traefik-rtr.entrypoints=https" + - "traefik.http.routers.traefik-rtr.rule=Host(`proxy.$DOMAINNAME0`)" + ## Services - API + - "traefik.http.routers.traefik-rtr.service=api@internal" + ## Healthcheck/ping + #- "traefik.http.routers.ping.rule=Host(`traefik.$DOMAINNAME0`) && Path(`/ping`)" + #- "traefik.http.routers.ping.tls=true" + #- "traefik.http.routers.ping.service=ping@internal" + ## Middlewares + - "traefik.http.routers.traefik-rtr.middlewares=chain-authelia@file" diff --git a/config/docker/2022/yml-files/vscode.yml b/config/docker/2022/yml-files/vscode.yml new file mode 100644 index 0000000..fbc32e9 --- /dev/null +++ b/config/docker/2022/yml-files/vscode.yml @@ -0,0 +1,57 @@ +version: "3.7" +########################### NETWORKS +# There is no need to create any networks outside this docker-compose file. +# You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please. +# Docker Compose version 3.5 or higher required to define networks this way. +networks: + gl_proxy: + name: gl_proxy + driver: bridge + ipam: + config: + - subnet: $GL_PROXY_SUBNET + - gateway: $GL_PROXY_GATEWAY + default: + driver: bridge + gl_socket_proxy: + name: gl_socket_proxy + driver: bridge + ipam: + config: + - subnet: $GL_SOCKET_PROXY_SUBNET + - gateway: $GL_SOCKET_PROXY_GATEWAY + +########################### SERVICES +services: + # VSCode - VSCode Editing + # sudo chown -R 1000:1000 /home/coder/project + vscode: + image: codercom/code-server:latest + container_name: gl-vscode + restart: always + networks: + gl_proxy: + ipv4_address: $VSCODE_IP + # ports: + # - "$VSCODE_PORT:8080" + volumes: + - $USERDIR/server:/home/coder/server + - $DOCKERDIR:/home/coder/docker + - $DOCKERDIR/appdata/vscode:/home/coder + #- /media/hdd1:/home/coder/hdd1 + environment: + PASSWORD: $VSCODE_PASSWORD + # Run as root first, create the directories, then change permissions to user:docker and 775. Disable run as root below. + #user: $PUID:$PGID + user: "0" + DOCKER_HOST: $DOCKER_ENDPOINT + labels: + - "traefik.enable=true" + ## HTTP Routers + - "traefik.http.routers.vscode-rtr.entrypoints=https" + - "traefik.http.routers.vscode-rtr.rule=Host(`code.$DOMAINNAME0`)" + ## Middlewares + - "traefik.http.routers.vscode-rtr.middlewares=chain-authelia@file" + ## HTTP Services + - "traefik.http.routers.vscode-rtr.service=vscode-svc" + - "traefik.http.services.vscode-svc.loadbalancer.server.port=8080" \ No newline at end of file