79 lines
3.4 KiB
YAML
79 lines
3.4 KiB
YAML
version: "3.3"
|
|
|
|
services:
|
|
traefik:
|
|
container_name: traefik
|
|
image: "traefik:v2.11"
|
|
restart: unless-stopped
|
|
environment:
|
|
- TRAEFIK_API_DASHBOARD=true
|
|
- TRAEFIK_DOMAIN=${TRAEFIK_DOMAIN}
|
|
- LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL}
|
|
- HASHED_PASSWORD=${HASHED_PASSWORD}
|
|
- HTTP_PUBLISH_PORT=${HTTP_PUBLISH_PORT}
|
|
- HTTPS_PUBLISH_PORT=${HTTPS_PUBLISH_PORT}
|
|
labels:
|
|
# Enable Traefik for this service, to make it available in the public network
|
|
- traefik.enable=true
|
|
# Use the traefik-public network (declared below)
|
|
- traefik.docker.network=traefik-public
|
|
# admin-auth middleware with HTTP Basic auth
|
|
# Using the environment variables USERNAME and HASHED_PASSWORD
|
|
- traefik.http.middlewares.admin-auth.basicauth.users=admin:${HASHED_PASSWORD:?No HASHED_PASSWORD set}
|
|
|
|
# HTTP router (for redirects)
|
|
- traefik.http.routers.traefik-public-http.rule=Host(`${TRAEFIK_DOMAIN:?No TRAEFIK_DOMAIN set}`)
|
|
- traefik.http.routers.traefik-public-http.entrypoints=http
|
|
- traefik.http.routers.traefik-public-http.middlewares=https-redirect
|
|
|
|
# HTTPS router for dashboard
|
|
- traefik.http.routers.traefik-public-https.rule=Host(`${TRAEFIK_DOMAIN:?No TRAEFIK_DOMAIN set}`)
|
|
- traefik.http.routers.traefik-public-https.entrypoints=https
|
|
- traefik.http.routers.traefik-public-https.tls=true
|
|
- traefik.http.routers.traefik-public-https.tls.certresolver=le
|
|
# Use the special Traefik service api@internal with the web UI/Dashboard
|
|
- traefik.http.routers.traefik-public-https.service=api@internal
|
|
# Enable HTTP Basic auth, using the middleware created above
|
|
- traefik.http.routers.traefik-public-https.middlewares=admin-auth
|
|
|
|
# Middleware for HTTPS redirect
|
|
- traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
|
|
- traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
|
|
|
|
# Define the port inside of the Docker service to use
|
|
- traefik.http.services.traefik-public.loadbalancer.server.port=8080
|
|
command:
|
|
# Enable Docker in Traefik, so that it reads labels from Docker services
|
|
- --providers.docker=true
|
|
# Do not expose all Docker services, only the ones explicitly exposed
|
|
- --providers.docker.exposedbydefault=false
|
|
# Create an entrypoint http listening on port 80
|
|
- --entrypoints.http.address=:80
|
|
# Create an entrypoint https listening on port 443
|
|
- --entrypoints.https.address=:443
|
|
# Create the certificate resolver "le" for Let's Encrypt, uses HTTP challenge
|
|
- --certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL:?No LETSENCRYPT_EMAIL set}
|
|
- --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
|
|
- --certificatesresolvers.le.acme.httpchallenge=true
|
|
- --certificatesresolvers.le.acme.httpchallenge.entrypoint=http
|
|
# Enable the access log, with HTTP requests
|
|
- --accesslog
|
|
# Enable the Traefik log, for configurations and errors
|
|
- --log
|
|
# Enable the Dashboard and API
|
|
- --api
|
|
ports:
|
|
- ${HTTP_PUBLISH_PORT:-80}:80
|
|
- ${HTTPS_PUBLISH_PORT:-443}:443
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
# Create a volume to store the certificates
|
|
- ./letsencrypt:/letsencrypt
|
|
networks:
|
|
- traefik-public
|
|
|
|
networks:
|
|
traefik-public:
|
|
name: traefik-public
|
|
external: false
|