c3248fde1f
- New entrypoints: gitea-ssh/:2221, jarvis-ssh/:10171 - Expose both ports from the Traefik container - gitea.yml: TCP passthrough router -> 10.1.71.129:2221 - jarvis.yml: TCP passthrough router -> 10.1.71.131:22 - Both use HostSNI(*) — dedicated entrypoints, no TLS wrapping needed - UniFi to forward both ports to lightning-lane
86 lines
3.0 KiB
YAML
86 lines
3.0 KiB
YAML
---
|
|
services:
|
|
traefik:
|
|
image: docker.io/library/traefik:v3.6.8
|
|
container_name: traefik
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
command:
|
|
- "--global.checkNewVersion=false"
|
|
- "--global.sendAnonymousUsage=false"
|
|
- "--log.level=info"
|
|
- "--ping=true"
|
|
- "--ping.entryPoint=ping"
|
|
- "--api.dashboard=true"
|
|
- "--api.insecure=true"
|
|
# Entrypoints
|
|
- "--entrypoints.ping.address=:8082"
|
|
- "--entrypoints.web.address=:80"
|
|
- "--entrypoints.gitea-ssh.address=:2221"
|
|
- "--entrypoints.jarvis-ssh.address=:10171"
|
|
- "--entrypoints.web.http.redirections.entryPoint.to=websecure"
|
|
- "--entrypoints.web.http.redirections.entryPoint.scheme=https"
|
|
- "--entrypoints.web.http.encodedCharacters.allowEncodedSlash=true"
|
|
- "--entrypoints.websecure.address=:443"
|
|
- "--entrypoints.websecure.http.encodedCharacters.allowEncodedSlash=true"
|
|
- "--entrypoints.websecure.http.tls.certResolver=cloudflare"
|
|
- "--entrypoints.websecure.http.tls.domains[0].main=local.mk-labs.cloud"
|
|
- "--entrypoints.websecure.http.tls.domains[0].sans=*.local.mk-labs.cloud"
|
|
- "--entrypoints.websecure.http.tls.domains[1].main=mk-labs.cloud"
|
|
- "--entrypoints.websecure.http.tls.domains[1].sans=*.mk-labs.cloud"
|
|
# ACME / Cloudflare DNS-01
|
|
- "--certificatesresolvers.cloudflare.acme.email=ryan.blundon@protonmail.com"
|
|
- "--certificatesresolvers.cloudflare.acme.storage=/var/traefik/certs/acme.json"
|
|
- "--certificatesresolvers.cloudflare.acme.caServer=https://acme-v02.api.letsencrypt.org/directory"
|
|
- "--certificatesresolvers.cloudflare.acme.dnsChallenge.provider=cloudflare"
|
|
- "--certificatesresolvers.cloudflare.acme.dnsChallenge.resolvers=1.1.1.1:53,8.8.8.8:53"
|
|
# Providers
|
|
- "--providers.docker=true"
|
|
- "--providers.docker.exposedByDefault=false"
|
|
- "--providers.docker.network=proxy"
|
|
- "--providers.file.directory=/etc/traefik/dynamic"
|
|
- "--providers.file.watch=true"
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
- "8080:8080"
|
|
- "2221:2221"
|
|
- "10171:10171"
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- traefik_certs:/var/traefik/certs/:rw
|
|
- ./dynamic:/etc/traefik/dynamic:ro
|
|
environment:
|
|
- TZ=America/Chicago
|
|
- CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8082/ping"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
networks:
|
|
- proxy
|
|
restart: unless-stopped
|
|
|
|
cloudflared:
|
|
image: docker.io/cloudflare/cloudflared:latest
|
|
container_name: cloudflared
|
|
restart: unless-stopped
|
|
command: tunnel --no-autoupdate run
|
|
environment:
|
|
- TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}
|
|
networks:
|
|
- proxy
|
|
depends_on:
|
|
traefik:
|
|
condition: service_healthy
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|
|
|
|
volumes:
|
|
traefik_certs:
|
|
driver: local
|