shmick/docker
1
0
Fork 0
Code Issues Pull Requests Actions Projects Releases Wiki Activity

Pruned services; added Grafana auth

Browse Source
This commit is contained in:
Matan Horovitz
2023-11-17 16:51:09 +02:00
parent 955e73d3b3
commit f540d1c46b
2 changed files with 107 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
docker-compose.yml
View File

@@ -1,7 +1,6 @@
version: "3.3"
services:
traefik:
image: "traefik:v2.6"
image: "traefik:v2.10.4"
container_name: "traefik"
privileged: true
command:
@@ -10,14 +9,14 @@ services:
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
- "--entrypoints.web.http.redirections.entrypoint.to=websecure"
- "--certificatesresolvers.pukekoresolver.acme.dnschallenge=true"
- "--certificatesresolvers.pukekoresolver.acme.dnschallenge.provider=cloudflare"
#- "--certificatesresolvers.pukekoresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
- "--certificatesresolvers.pukekoresolver.acme.email=matanhorovitz@protonmail.com"
- "--certificatesresolvers.pukekoresolver.acme.storage=/letsencrypt/acme.json"
- "--certificatesresolvers.pukekoresolver.acme.dnschallenge.resolvers=1.1.1.1:53"
- "--entrypoints.pukekos.address=:443"
- "--entrypoints.web.http.redirections.entrypoint.to=pukekos"
- "--certificatesresolvers.takaheresolver.acme.dnschallenge=true"
- "--certificatesresolvers.takaheresolver.acme.dnschallenge.provider=cloudflare"
# - "--certificatesresolvers.takaheresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
- "--certificatesresolvers.takaheresolver.acme.email=matanhorovitz@protonmail.com"
- "--certificatesresolvers.takaheresolver.acme.storage=/certs/acme.json"
- "--certificatesresolvers.takaheresolver.acme.dnschallenge.resolvers=1.1.1.1:53"
ports:
- "80:80"
- "443:443"
@@ -27,43 +26,38 @@ services:
- CF_API_EMAIL=matanhorovitz@protonmail.com
- CF_DNS_API_TOKEN=0dFNYA8qtzVhVtGi4nEb7_aclTOdGthYm5Q7N05n
volumes:
- "./letsencrypt:/letsencrypt"
- "./certs:/certs"
- "/var/run/docker.sock:/var/run/docker.sock"
networks:
- network
- internal
- arr_network
- filebrowser_network
- fotoprism_network
- gitea_network
- gitea_public_instance_network
- grocy_network
- vaultwarden_network
- vikunja_network
- freshrss_network
- homer_study_network
- jekyll_network
- jellyfin_network
- joplin_network
- paperless-ngx_network
- photoprism_network
- podgrab_network
- portainer_network
- prometheus_network
- qbittorrent_network
- syncthing_network
- wikijs_network
- wikijs_study_instance_network
- wireguard_network
restart: unless-stopped
labels:
- "traefik.enable=true"
- "traefik.http.routers.domain.entrypoints=websecure"
- "traefik.http.routers.domain.entrypoints=pukekos"
- "traefik.http.routers.domain.rule=Host(`pukeko.xyz`)"
- "traefik.http.routers.domain.tls.certresolver=pukekoresolver"
- "traefik.http.routers.domain.tls.certresolver=takaheresolver"
- "traefik.http.routers.domain.middlewares=domain"
- 'traefik.http.middlewares.domain.redirectregex.regex=^https://pukeko.xyz/(.*)'
- 'traefik.http.middlewares.domain.redirectregex.replacement=https://dash.pukeko.xyz/$${1}'
- "traefik.http.middlewares.domain.redirectregex.permanent=true"
- "traefik.tls.stores.default.defaultgeneratedcert.resolver=takaheresolver"
- "traefik.tls.stores.default.defaultgeneratedcert.domain.main=pukeko.xyz"
# user: 1001:1001
homer:
image: b4bz/homer
@@ -78,10 +72,10 @@ services:
restart: unless-stopped
labels:
- "traefik.enable=true"
- "traefik.http.routers.homer.entrypoints=websecure"
- "traefik.http.routers.homer.entrypoints=pukekos"
- "traefik.http.routers.homer.rule=Host(`dash.pukeko.xyz`)"
- "traefik.http.routers.homer.service=homer-traefik@docker"
- "traefik.http.routers.homer.tls.certresolver=pukekoresolver"
- "traefik.http.routers.homer.tls.certresolver=takaheresolver"
- "traefik.http.routers.homer.middlewares=authelia@docker"
networks:
- internal
@@ -90,7 +84,7 @@ services:
container_name: authelia
environment:
- TZ=Asia/Jerusalem
- AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE=/run/secrets/private_key
# - AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE=/run/secrets/private_key
volumes:
- ./authelia:/config
restart: unless-stopped
@@ -100,10 +94,10 @@ services:
labels:
- 'traefik.enable=true'
- 'traefik.http.routers.authelia.rule=Host(`auth.pukeko.xyz`)'
- 'traefik.http.routers.authelia.entrypoints=websecure'
- 'traefik.http.routers.authelia.entrypoints=pukekos'
- "traefik.http.routers.authelia.service=authelia-traefik@docker"
- 'traefik.http.routers.authelia.tls=true'
- "traefik.http.routers.authelia.tls.certresolver=pukekoresolver"
- "traefik.http.routers.authelia.tls.certresolver=takaheresolver"
- 'traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.pukeko.xyz/'
- 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true'
- 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email'
@@ -114,8 +108,6 @@ services:
- internal
expose:
- 9091
environment:
- TZ=Asia/Jerusalem
redis:
image: redis:alpine
container_name: authelia_redis
@@ -126,9 +118,6 @@ services:
expose:
- 6379
restart: unless-stopped
environment:
- TZ=Asia/Jerusalem
- AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE=/run/secrets/private_key
secrets:
hmac:
file: ./authelia/secrets/hmac
@@ -143,26 +132,14 @@ networks:
external: true
filebrowser_network:
external: true
fotoprism_network:
external: true
freshrss_network:
external: true
gitea_network:
external: true
gitea_public_instance_network:
external: true
grocy_network:
external: true
homer_study_network:
external: true
jekyll_network:
external: true
#jekyll_network:
# external: true
jellyfin_network:
external: true
joplin_network:
external: true
paperless-ngx_network:
external: true
photoprism_network:
external: true
podgrab_network:
@@ -179,6 +156,8 @@ networks:
external: true
wikijs_study_instance_network:
external: true
wireguard_network:
external: true
qbittorrent_network:
external: true
syncthing_network: