Replace nginx reverse proxy by traefik

This commit is contained in:
Paul-Henri Froidmont 2018-04-25 15:26:28 +02:00
parent fd30d66ffb
commit cfaa48e02a
30 changed files with 271 additions and 161 deletions

View file

@ -22,6 +22,7 @@
- { role: torrent-docker, tags: [ 'torrent', 'docker' ] } - { role: torrent-docker, tags: [ 'torrent', 'docker' ] }
- { role: monit, tags: [ 'monit' ] } - { role: monit, tags: [ 'monit' ] }
- { role: arch-mirror-docker, tags: [ 'mirror', 'docker' ] } - { role: arch-mirror-docker, tags: [ 'mirror', 'docker' ] }
- { role: traefik-proxy-docker, tags: [ 'traefik', 'docker' ] }
# vars_prompt: # vars_prompt:
# - name: "ansible_sudo_pass" # - name: "ansible_sudo_pass"
# prompt: "Sudo password" # prompt: "Sudo password"

View file

@ -1,21 +1,24 @@
version: '2.2' version: '2.2'
networks: networks:
proxy-tier: web:
external: external:
name: nginx-proxy name: web
services: services:
arch-mirror: arch-mirror:
image: nginx:latest image: nginx:latest
expose: expose:
- 80 - 80
environment: labels:
- VIRTUAL_HOST=arch.banditlair.com - "traefik.backend=arch-mirror"
- VIRTUAL_NETWORK=nginx-proxy - "traefik.docker.network=web"
- VIRTUAL_PORT=80 - "traefik.frontend.rule=Host:arch.banditlair.com"
- "traefik.enable=true"
- "traefik.port=80"
- "traefik.default.protocol=http"
volumes: volumes:
- /srv/repo:/usr/share/nginx/html:ro - /srv/repo:/usr/share/nginx/html:ro
networks: networks:
- proxy-tier - web
restart: always restart: always

View file

@ -1,2 +1,2 @@
dependencies: dependencies:
- nginx-proxy-docker - traefik-proxy-docker

View file

@ -1,9 +1,9 @@
version: '2.2' version: '2.2'
networks: networks:
proxy-tier: web:
external: external:
name: nginx-proxy name: web
services: services:
emby: emby:
@ -15,9 +15,13 @@ services:
environment: environment:
- UID=33 - UID=33
- GID=33 - GID=33
- VIRTUAL_HOST=emby.banditlair.com labels:
- VIRTUAL_NETWORK=nginx-proxy - "traefik.backend=emby"
- VIRTUAL_PORT=8096 - "traefik.docker.network=web"
- "traefik.frontend.rule=Host:emby.banditlair.com"
- "traefik.enable=true"
- "traefik.port=8096"
- "traefik.default.protocol=http"
networks: networks:
- proxy-tier - web
restart: always restart: always

View file

@ -1,2 +1,2 @@
dependencies: dependencies:
- nginx-proxy-docker - traefik-proxy-docker

View file

@ -1,18 +1,21 @@
version: '2.2' version: '2.2'
networks: networks:
proxy-tier: web:
external: external:
name: nginx-proxy name: web
services: services:
gitlab: gitlab:
image: 'gitlab/gitlab-ce:latest' image: 'gitlab/gitlab-ce:latest'
hostname: ${GITLAB_DOMAIN} hostname: ${GITLAB_DOMAIN}
environment: labels:
- VIRTUAL_HOST=${GITLAB_DOMAIN} - "traefik.backend=gitlab"
- VIRTUAL_NETWORK=nginx-proxy - "traefik.docker.network=web"
- VIRTUAL_PORT=9090 - "traefik.frontend.rule=Host:gitlab.banditlair.com"
- "traefik.enable=true"
- "traefik.port=9090"
- "traefik.default.protocol=http"
ports: ports:
- "2224:22" - "2224:22"
expose: expose:
@ -24,7 +27,7 @@ services:
- /backups/gitlab:/var/opt/gitlab/backups - /backups/gitlab:/var/opt/gitlab/backups
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
networks: networks:
- proxy-tier - web
restart: always restart: always
runner: runner:

View file

@ -1,2 +1,2 @@
dependencies: dependencies:
- nginx-proxy-docker - traefik-proxy-docker

View file

@ -1,9 +1,9 @@
version: '2' version: '2'
networks: networks:
proxy-tier: web:
external: external:
name: nginx-proxy name: web
services: services:
front: front:
@ -19,8 +19,8 @@ services:
- "$BIND_ADDRESS4:465:465" - "$BIND_ADDRESS4:465:465"
- "$BIND_ADDRESS4:587:587" - "$BIND_ADDRESS4:587:587"
volumes: volumes:
- "../proxy/nginx/certs/${DOMAIN}.crt:/certs/cert.pem" - "../traefik/certs/ssl/banditlair.com.crt:/certs/cert.pem"
- "../proxy/nginx/certs/${DOMAIN}.key:/certs/key.pem" - "../traefik/certs/ssl/banditlair.com.key:/certs/key.pem"
redis: redis:
image: redis:alpine image: redis:alpine
restart: always restart: always
@ -73,10 +73,13 @@ services:
env_file: .env env_file: .env
expose: expose:
- 80 - 80
environment: labels:
- VIRTUAL_HOST=mailu.banditlair.com,mail.banditlair.com - "traefik.backend=mailu-admin"
- VIRTUAL_NETWORK=nginx-proxy - "traefik.docker.network=web"
- VIRTUAL_PORT=80 - "traefik.frontend.rule=Host:mailu.banditlair.com"
- "traefik.enable=true"
- "traefik.port=80"
- "traefik.default.protocol=http"
volumes: volumes:
- "$ROOT/data:/data" - "$ROOT/data:/data"
- "$ROOT/dkim:/dkim" - "$ROOT/dkim:/dkim"
@ -84,7 +87,7 @@ services:
depends_on: depends_on:
- redis - redis
networks: networks:
- proxy-tier - web
- default - default
webmail: webmail:
@ -92,14 +95,17 @@ services:
restart: always restart: always
expose: expose:
- 8888 - 8888
environment: labels:
- VIRTUAL_HOST=webmail.banditlair.com - "traefik.backend=webmail"
- VIRTUAL_NETWORK=nginx-proxy - "traefik.docker.network=web"
- VIRTUAL_PORT=8888 - "traefik.frontend.rule=Host:webmail.banditlair.com"
- "traefik.enable=true"
- "traefik.port=8888"
- "traefik.default.protocol=http"
volumes: volumes:
- "$ROOT/webmail:/rainloop/data" - "$ROOT/webmail:/rainloop/data"
networks: networks:
- proxy-tier - web
- default - default
fetchmail: fetchmail:

View file

@ -1,2 +1,2 @@
dependencies: dependencies:
- nginx-proxy-docker - traefik-proxy-docker

View file

@ -3,7 +3,6 @@ services:
db: db:
image: postgres:9.6 image: postgres:9.6
restart: always restart: always
# Adding 127.0.0.1 ensures the port isn't exposed ON the host
ports: ports:
- "127.0.0.1:5432:5432" - "127.0.0.1:5432:5432"
volumes: volumes:
@ -22,10 +21,13 @@ services:
- "127.0.0.1:8008:8008" - "127.0.0.1:8008:8008"
- "8448:8448" - "8448:8448"
- "3478:3478" - "3478:3478"
environment: labels:
- VIRTUAL_HOST=matrix.banditlair.com - "traefik.backend=synapse"
- VIRTUAL_NETWORK=nginx-proxy - "traefik.docker.network=web"
- VIRTUAL_PORT=8008 - "traefik.frontend.rule=Host:matrix.banditlair.com"
- "traefik.enable=true"
- "traefik.port=8008"
- "traefik.default.protocol=http"
volumes: volumes:
- /var/lib/matrix/media_store:/data/media_store - /var/lib/matrix/media_store:/data/media_store
- /var/log/synapse:/data/log - /var/log/synapse:/data/log
@ -33,13 +35,13 @@ services:
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
networks: networks:
- matrix - matrix
- proxy-tier - web
restart: always restart: always
networks: networks:
matrix: matrix:
external: external:
name: matrix-network name: matrix-network
proxy-tier: web:
external: external:
name: nginx-proxy name: web

View file

@ -1,2 +1,2 @@
dependencies: dependencies:
- nginx-proxy-docker - traefik-proxy-docker

View file

@ -1,9 +1,9 @@
version: '3' version: '3'
networks: networks:
proxy-tier: web:
external: external:
name: nginx-proxy name: web
services: services:
web: web:
@ -11,15 +11,18 @@ services:
volumes: volumes:
- /var/lib/nextcloud:/var/www/html:ro - /var/lib/nextcloud:/var/www/html:ro
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
environment: labels:
- VIRTUAL_HOST=${CLOUD_DOMAIN} - "traefik.backend=nextcloud"
- VIRTUAL_NETWORK=nginx-proxy - "traefik.docker.network=web"
- VIRTUAL_PORT=80 - "traefik.frontend.rule=Host:cloud.banditlair.com"
- "traefik.enable=true"
- "traefik.port=80"
- "traefik.default.protocol=http"
depends_on: depends_on:
- app - app
# - collabora # - collabora
networks: networks:
- proxy-tier - web
- default - default
restart: always restart: always
@ -65,17 +68,18 @@ services:
tty: true tty: true
expose: expose:
- '80' - '80'
environment: labels:
- VIRTUAL_HOST=office.banditlair.com - "traefik.backend=onlyoffice"
- VIRTUAL_NETWORK=nginx-proxy - "traefik.docker.network=web"
- VIRTUAL_PORT=80 - "traefik.frontend.rule=Host:office.banditlair.com"
- LETSENCRYPT_HOST=office.banditlair.com - "traefik.enable=true"
- LETSENCRYPT_EMAIL=letsencrypt.account@banditlair.com - "traefik.port=80"
- "traefik.default.protocol=http"
volumes: volumes:
- /var/lib/onlyoffice:/var/www/onlyoffice/Data - /var/lib/onlyoffice:/var/www/onlyoffice/Data
- /var/log/onlyoffice:/var/log/onlyoffice - /var/log/onlyoffice:/var/log/onlyoffice
networks: networks:
- proxy-tier - web
- default - default
restart: always restart: always

View file

@ -1,2 +1,2 @@
dependencies: dependencies:
- nginx-proxy-docker - traefik-proxy-docker

View file

@ -1 +0,0 @@
COMPOSE_PROJECT_NAME=proxy

View file

@ -1,34 +0,0 @@
version: '2.2'
networks:
default:
external:
name: nginx-proxy
services:
nginx:
image: jwilder/nginx-proxy
ports:
- 80:80
- 443:443
labels:
com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
volumes:
- ./nginx/conf.d:/etc/nginx/conf.d
- ./nginx/vhost.d:/etc/nginx/vhost.d
- ./nginx/html:/usr/share/nginx/html
- ./nginx/certs:/etc/nginx/certs:ro
- /var/run/docker.sock:/tmp/docker.sock:ro
- /etc/localtime:/etc/localtime:ro
restart: always
letsencrypt-companion:
image: jrcs/letsencrypt-nginx-proxy-companion
# environment:
# - DEBUG=true
volumes_from:
- nginx
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./nginx/certs:/etc/nginx/certs:rw
restart: always

View file

@ -1 +0,0 @@
client_max_body_size 10G;

View file

@ -1,2 +0,0 @@
dependencies:
- base-docker

View file

@ -1,10 +0,0 @@
---
- name: Copy proxy config
copy: src=proxy dest={{docker_compose_files_folder}}
#- name: Copy certificates
# copy: src={{backup_folder}}/{{docker_compose_files_folder}}/proxy/nginx/certs dest={{docker_compose_files_folder}}/proxy/nginx
- name: Create nginx-proxy docker network
docker_network:
name: nginx-proxy
- name: Start proxy docker project
docker_service: project_src={{docker_compose_files_folder}}/proxy state=present

View file

@ -1,9 +1,9 @@
version: '2.2' version: '2.2'
networks: networks:
proxy-tier: web:
external: external:
name: nginx-proxy name: web
services: services:
plex: plex:
@ -16,10 +16,14 @@ services:
- /tmp:/tmp - /tmp:/tmp
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
environment: environment:
- VIRTUAL_HOST=${PLEX_DOMAIN}
- VIRTUAL_NETWORK=nginx-proxy
- VIRTUAL_PORT=32400
- ADVERTISE_IP=https://plex.banditlair.com/ - ADVERTISE_IP=https://plex.banditlair.com/
labels:
- "traefik.backend=plex"
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:plex.banditlair.com"
- "traefik.enable=true"
- "traefik.port=32400"
- "traefik.default.protocol=http"
networks: networks:
- proxy-tier - web
restart: always restart: always

View file

@ -1,2 +1,2 @@
dependencies: dependencies:
- nginx-proxy-docker - traefik-proxy-docker

View file

@ -1,9 +1,9 @@
version: '2.2' version: '2.2'
networks: networks:
proxy-tier: web:
external: external:
name: nginx-proxy name: web
services: services:
searx: searx:
@ -11,11 +11,13 @@ services:
environment: environment:
- BASE_URL="https://banditlair.com" - BASE_URL="https://banditlair.com"
- IMAGE_PROXY=True - IMAGE_PROXY=True
- VIRTUAL_HOST=banditlair.com labels:
- VIRTUAL_NETWORK=nginx-proxy - "traefik.backend=searx"
- VIRTUAL_PORT=8888 - "traefik.docker.network=web"
- LETSENCRYPT_HOST=banditlair.com,mail.banditlair.com,mailu.banditlair.com,webmail.banditlair.com,gitlab.banditlair.com,cloud.banditlair.com,plex.banditlair.com,deluge.banditlair.com,rpg.banditlair.com,matrix.banditlair.com,emby.banditlair.com,arch.banditlair.com,sonarr.banditlair.com,radarr.banditlair.com,headphones.banditlair.com,jackett.banditlair.com,nzbget.banditlair.com - "traefik.frontend.rule=Host:banditlair.com"
- LETSENCRYPT_EMAIL=letsencrypt.account@banditlair.com - "traefik.enable=true"
- "traefik.port=8888"
- "traefik.default.protocol=http"
networks: networks:
- proxy-tier - web
restart: always restart: always

View file

@ -1,2 +1,2 @@
dependencies: dependencies:
- nginx-proxy-docker - traefik-proxy-docker

View file

@ -1,9 +1,9 @@
version: '2.2' version: '2.2'
networks: networks:
proxy-tier: web:
external: external:
name: nginx-proxy name: web
services: services:
deluge: deluge:
@ -31,12 +31,16 @@ services:
- DEBUG=false - DEBUG=false
- PUID=33 - PUID=33
- PGID=33 - PGID=33
- VIRTUAL_HOST=${DELUGE_DOMAIN} labels:
- VIRTUAL_NETWORK=nginx-proxy - "traefik.backend=deluge"
- VIRTUAL_PORT=8112 - "traefik.docker.network=web"
- "traefik.frontend.rule=Host:deluge.banditlair.com"
- "traefik.enable=true"
- "traefik.port=8112"
- "traefik.default.protocol=http"
restart: always restart: always
networks: networks:
- proxy-tier - web
sonarr: sonarr:
image: linuxserver/sonarr image: linuxserver/sonarr
@ -45,9 +49,13 @@ services:
environment: environment:
- PUID=33 - PUID=33
- PGID=33 - PGID=33
- VIRTUAL_HOST=sonarr.banditlair.com labels:
- VIRTUAL_NETWORK=nginx-proxy - "traefik.backend=sonarr"
- VIRTUAL_PORT=8989 - "traefik.docker.network=web"
- "traefik.frontend.rule=Host:sonarr.banditlair.com"
- "traefik.enable=true"
- "traefik.port=8989"
- "traefik.default.protocol=http"
volumes: volumes:
- /var/lib/deluge/completed:/downloads - /var/lib/deluge/completed:/downloads
- /var/lib/nzbget/downloads:/nzbget - /var/lib/nzbget/downloads:/nzbget
@ -56,7 +64,7 @@ services:
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
restart: always restart: always
networks: networks:
- proxy-tier - web
radarr: radarr:
image: linuxserver/radarr image: linuxserver/radarr
@ -65,9 +73,13 @@ services:
environment: environment:
- PUID=33 - PUID=33
- PGID=33 - PGID=33
- VIRTUAL_HOST=radarr.banditlair.com labels:
- VIRTUAL_NETWORK=nginx-proxy - "traefik.backend=radarr"
- VIRTUAL_PORT=7878 - "traefik.docker.network=web"
- "traefik.frontend.rule=Host:radarr.banditlair.com"
- "traefik.enable=true"
- "traefik.port=7878"
- "traefik.default.protocol=http"
volumes: volumes:
- /var/lib/deluge/completed:/downloads - /var/lib/deluge/completed:/downloads
- /var/lib/nzbget/downloads:/nzbget - /var/lib/nzbget/downloads:/nzbget
@ -76,7 +88,7 @@ services:
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
restart: always restart: always
networks: networks:
- proxy-tier - web
headphones: headphones:
image: linuxserver/headphones image: linuxserver/headphones
@ -85,9 +97,13 @@ services:
environment: environment:
- PUID=33 - PUID=33
- PGID=33 - PGID=33
- VIRTUAL_HOST=headphones.banditlair.com labels:
- VIRTUAL_NETWORK=nginx-proxy - "traefik.backend=headphones"
- VIRTUAL_PORT=8181 - "traefik.docker.network=web"
- "traefik.frontend.rule=Host:headphones.banditlair.com"
- "traefik.enable=true"
- "traefik.port=8181"
- "traefik.default.protocol=http"
volumes: volumes:
- /var/lib/deluge/completed:/downloads - /var/lib/deluge/completed:/downloads
- ./config/headphones:/config - ./config/headphones:/config
@ -95,7 +111,7 @@ services:
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
restart: always restart: always
networks: networks:
- proxy-tier - web
nzbget: nzbget:
image: linuxserver/nzbget image: linuxserver/nzbget
@ -104,16 +120,20 @@ services:
environment: environment:
- PUID=33 - PUID=33
- PGID=33 - PGID=33
- VIRTUAL_HOST=nzbget.banditlair.com labels:
- VIRTUAL_NETWORK=nginx-proxy - "traefik.backend=nzbget"
- VIRTUAL_PORT=6789 - "traefik.docker.network=web"
- "traefik.frontend.rule=Host:nzbget.banditlair.com"
- "traefik.enable=true"
- "traefik.port=6789"
- "traefik.default.protocol=http"
volumes: volumes:
- /var/lib/nzbget/downloads:/downloads - /var/lib/nzbget/downloads:/downloads
- ./config/nzbget:/config - ./config/nzbget:/config
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
restart: always restart: always
networks: networks:
- proxy-tier - web
jackett: jackett:
image: linuxserver/jackett image: linuxserver/jackett
@ -122,13 +142,17 @@ services:
environment: environment:
- PUID=33 - PUID=33
- PGID=33 - PGID=33
- VIRTUAL_HOST=jackett.banditlair.com labels:
- VIRTUAL_NETWORK=nginx-proxy - "traefik.backend=jackett"
- VIRTUAL_PORT=9117 - "traefik.docker.network=web"
- "traefik.frontend.rule=Host:jackett.banditlair.com"
- "traefik.enable=true"
- "traefik.port=9117"
- "traefik.default.protocol=http"
volumes: volumes:
# - /var/lib/deluge/completed:/downloads # - /var/lib/deluge/completed:/downloads
- ./config/jackett:/config - ./config/jackett:/config
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
restart: always restart: always
networks: networks:
- proxy-tier - web

View file

@ -1,2 +1,2 @@
dependencies: dependencies:
- nginx-proxy-docker - traefik-proxy-docker

View file

@ -0,0 +1,40 @@
debug = false
logLevel = "ERROR"
defaultEntryPoints = ["https","http"]
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[entryPoints.traefik]
address = ":8080"
# Activate API and Dashboard
[api]
entryPoint = "traefik"
dashboard = true
[retry]
[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "banditlair.com"
watch = true
exposedbydefault = false
[acme]
email = "letsencrypt.account@banditlair.com"
storage = "acme.json"
entryPoint = "https"
OnHostRule = true
[acme.httpChallenge]
entryPoint = "http"
[[acme.domains]]
main = "banditlair.com"
sans = ["mail.banditlair.com"]

View file

@ -0,0 +1,49 @@
version: '3'
services:
traefik:
container_name: traefik
image: traefik:1.6.0-rc6-alpine
ports:
- 80:80
- 443:443
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./data:/etc/traefik
- ./certs/acme.json:/acme.json
labels:
- "traefik.backend=traefik"
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:traefik.banditlair.com"
- "traefik.enable=true"
- "traefik.port=8080"
- "traefik.default.protocol=http"
- "traefik.frontend.auth.basic=admin:${TRAEFIK_DASHBOARD_PASSWORD_HASH}"
networks:
- web
restart: always
# Watch acme.json and dump certificates to files
certdumper:
container_name: traefik_certdumper
image: alpine:latest
depends_on:
- traefik
restart: unless-stopped
volumes:
- ./certs:/traefik
command: >
ash -c " \
apk --no-cache add inotify-tools jq openssl util-linux bash && \
wget https://raw.githubusercontent.com/containous/traefik/master/contrib/scripts/dumpcerts.sh -O dumpcerts.sh && \
mkdir -p /traefik/ssl/ && \
while true; do \
inotifywait -e modify /traefik/acme.json && \
bash dumpcerts.sh /traefik/acme.json /traefik/ssl/ && \
ln -f /traefik/ssl/certs/* /traefik/ssl/ && \
ln -f /traefik/ssl/private/* /traefik/ssl/; \
done"
networks:
web:
external: true

View file

@ -0,0 +1,12 @@
---
- name: Copy traefik config
copy: src=traefik dest={{docker_compose_files_folder}}
- name: Create traefik .env
template:
src: traefik/.env
dest: "{{docker_compose_files_folder}}/traefik/.env"
- name: Create web docker network
docker_network:
name: web
- name: Start traefik docker project
docker_service: project_src={{docker_compose_files_folder}}/traefik state=present

View file

@ -0,0 +1 @@
TRAEFIK_DASHBOARD_PASSWORD_HASH={{traefik_dashboard_password_hash}}

View file

@ -1,22 +1,25 @@
version: '2.2' version: '2.2'
networks: networks:
proxy-tier: web:
external: external:
name: nginx-proxy name: web
services: services:
rpg_wiki: rpg_wiki:
image: 'bitnami/dokuwiki:0.20170219.201708232029-r7' image: 'bitnami/dokuwiki:0.20170219.201708232029-r7'
expose: expose:
- 80 - 80
environment:
- VIRTUAL_HOST=rpg.banditlair.com
- VIRTUAL_NETWORK=nginx-proxy
- VIRTUAL_PORT=80
volumes: volumes:
- '/var/lib/wiki/rpg:/bitnami' - '/var/lib/wiki/rpg:/bitnami'
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
labels:
- "traefik.backend=rpg_wiki"
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:rpg.banditlair.com"
- "traefik.enable=true"
- "traefik.port=80"
- "traefik.default.protocol=http"
networks: networks:
- proxy-tier - web
restart: always restart: always

View file

@ -1,2 +1,2 @@
dependencies: dependencies:
- nginx-proxy-docker - traefik-proxy-docker