anpassen an teqqy
This commit is contained in:
parent
0674d0f6e4
commit
1eff5b733c
|
|
@ -0,0 +1,2 @@
|
|||
name: Traefik
|
||||
description: Traefik is a reverse proxy for config as code deployment
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
# Traefik
|
||||
|
||||
Traefik ist ein reverse proxy mit der Möglichkeit via Let's encrypt Zertifikate zu erstellen und automatisch zu verlängern. Traefik hat den Vorteil, dass es komplett via Docker steuerbar ist und somit keine weiteren Einstellungen notwendig sind.
|
||||
|
||||
# WICHTIG!
|
||||
Die Konfiguration für Traefik zieht die Sicherheitsanforderungen ziemlich an. Hiermit eine ein Rating von A+ beim [SSLLabs Test](https://www.ssllabs.com/ssltest) erreicht.
|
||||
|
||||
Es werden nur aktuelle Browser unterstützt! Sollte das nicht gewollt sein, muss die
|
||||
providers.yml Datei angepasst werden.
|
||||
|
||||
# Vorbereitung
|
||||
Um Traefik mit meinen Dateien nutzen zu können muss folgendes durchgeführt werden
|
||||
|
||||
## Netzwerk anlegen
|
||||
```bash
|
||||
docker network create traefik_proxy
|
||||
```
|
||||
|
||||
## ACME Verzeichnis
|
||||
Traefik speichert alle notwendigen Informationen zu den Zertifikaten als JSON im ACME Verzeichnis. Dieses Verzeichnis benötigt besondere Rechte.
|
||||
|
||||
```bash
|
||||
cd config/ACME
|
||||
chmod 600 acme.json
|
||||
```
|
||||
|
||||
# Dashboard
|
||||
Um das Dashboard nutzen zu können muss die Sektion "label" in der Docker-Compose Datei auskommentiert werden. Es ist darauf zu achten, dass die Einrückungen stimmen; dazu kann sich an den anderen Sektionen orientiert werden. Anschließend muss man noch Benutzer
|
||||
und Passwort für das Dashboard erstellen. Hierzu ist ````apache2-utils```` erforderlich.
|
||||
````bash
|
||||
sudo apt install apache2-utils -y
|
||||
````
|
||||
|
||||
Nun erstellen wir mit folgendem Befehl die Benutzer/Passwort Kombination (die spitzen Klammern <> sind ebenfalls zu ersetzen):
|
||||
|
||||
````bash
|
||||
echo $(htpasswd -nbB <USER> "<PASS>") | sed -e s/\\$/\\$\\$/g
|
||||
````
|
||||
Nachdem der Befehl ausgeführt wurde, gibt die Konsole eine Zeile mit dem generierten Benutzernamen:Passphrase aus. Diese Zeile ist zu kopieren und in die docker-compose.yaml bei folgendem Label einzutragen:
|
||||
|
||||
````bash
|
||||
- "traefik.http.middlewares.api-auth.basicauth.users=user:generatedPass"
|
||||
````
|
||||
|
||||
Des Weiteren ist die Domain anzupassen:
|
||||
|
||||
````bash
|
||||
- "traefik.http.routers.api.rule=Host(`traefik.example.com`) && PathPrefix(`/dashboard`)"
|
||||
````
|
||||
|
||||
Anschließend kann der Container gestartet werden. Das Dashboard ist unter der gewählten URL und Port und dem Unterverzeichnis "/dashboard" erreichbar. Abgeleitet aus dem aktuellen Beispiel:
|
||||
https://traefik.example.com:8180/dashboard
|
||||
|
|
@ -0,0 +1,67 @@
|
|||
---
|
||||
tls:
|
||||
options:
|
||||
default:
|
||||
minVersion: VersionTLS12
|
||||
sniStrict: true
|
||||
cipherSuites:
|
||||
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|
||||
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
|
||||
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||
curvePreferences:
|
||||
- CurveP521
|
||||
- CurveP384
|
||||
mintls13:
|
||||
minVersion: VersionTLS13
|
||||
|
||||
http:
|
||||
middlewares:
|
||||
secHeaders:
|
||||
headers:
|
||||
browserXssFilter: true
|
||||
contentTypeNosniff: true
|
||||
frameDeny: true
|
||||
sslRedirect: true
|
||||
# HSTS Configuration
|
||||
stsIncludeSubdomains: true
|
||||
stsPreload: true
|
||||
stsSeconds: 31536000
|
||||
customRequestHeaders:
|
||||
X-Frame-Options: "SAMEORIGIN"
|
||||
customFrameOptionsValue: "SAMEORIGIN"
|
||||
|
||||
# Beispiel für externe Dienste
|
||||
routers:
|
||||
utk: # Tausche den Namen gegen etwas sprechendes aus
|
||||
entryPoints:
|
||||
- websecure
|
||||
rule: "Host(`utk.czechman.dynvpn.de`)"
|
||||
service: "utk" # Den Namen am besten ähnlich zu dem oben setzen
|
||||
tls:
|
||||
certresolver: default
|
||||
|
||||
services:
|
||||
utk: # Ich verwende hier den gleiche Namen wie bei routers
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://192.168.2.2" # Auf die richtige URL anpassen.
|
||||
- port: "9001"
|
||||
|
||||
# Beispiel für externe Dienste
|
||||
# routers:
|
||||
# router-1: # Tausche den Namen gegen etwas sprechendes aus
|
||||
# entryPoints:
|
||||
# - websecure
|
||||
# rule: "Host(`example.com`)"
|
||||
# service: "service-1" # Den Namen am besten ähnlich zu dem oben setzen
|
||||
# tls:
|
||||
# certresolver: default
|
||||
|
||||
# services:
|
||||
# service-1: # Ich verwende hier den gleiche Namen wie bei routers
|
||||
# loadBalancer:
|
||||
# servers:
|
||||
# - url: "http://127.0.0.1" # Auf die richtige URL anpassen.
|
||||
|
|
@ -1,289 +1,32 @@
|
|||
################################################################
|
||||
#
|
||||
# Configuration sample for Traefik v2.
|
||||
#
|
||||
# For Traefik v1: https://github.com/traefik/traefik/blob/v1.7/traefik.sample.toml
|
||||
#
|
||||
################################################################
|
||||
[log]
|
||||
level = "ERROR"
|
||||
|
||||
################################################################
|
||||
# Global configuration
|
||||
################################################################
|
||||
[global]
|
||||
checkNewVersion = true
|
||||
sendAnonymousUsage = false
|
||||
[providers]
|
||||
[providers.docker]
|
||||
exposedByDefault = false
|
||||
endpoint = "unix:///var/run/docker.sock"
|
||||
network = "traefik_proxy"
|
||||
[providers.file]
|
||||
filename = "/etc/traefik/dynamic.yml"
|
||||
|
||||
################################################################
|
||||
# Entrypoints configuration
|
||||
################################################################
|
||||
[api]
|
||||
dashboard = true
|
||||
|
||||
# https://doc.traefik.io/traefik/routing/entrypoints/#redirection
|
||||
[entryPoints.web]
|
||||
address = ":80"
|
||||
|
||||
# Entrypoints definition
|
||||
#
|
||||
# Optional
|
||||
# Default:
|
||||
[entryPoints]
|
||||
[entryPoints.web]
|
||||
address = ":80"
|
||||
[entryPoints.web.http]
|
||||
[entryPoints.web.http.redirections]
|
||||
[entryPoints.web.http.redirections.entryPoint]
|
||||
to = "websecure"
|
||||
scheme = "https"
|
||||
|
||||
[entryPoints.websecure]
|
||||
address = ":443"
|
||||
|
||||
[entryPoints.websecure.http.tls]
|
||||
certResolver = "myresolver"
|
||||
|
||||
## Dynamic configuration
|
||||
[https.routers]
|
||||
[https.routers.docker]
|
||||
# rule = "Host(`czechman.dynvpn.de`) && Path(`/`)"
|
||||
[https.routers.docker.tls]
|
||||
certResolver = "myresolver"
|
||||
[[https.routers.docker.tls.domains]]
|
||||
main = "cz.mcseeno.de"
|
||||
# main = "czechman.dynvpn.de"
|
||||
# sans = ["*.czechman.dynvpn.de"]
|
||||
|
||||
|
||||
################################################################
|
||||
# Traefik logs configuration
|
||||
################################################################
|
||||
|
||||
# Traefik logs
|
||||
# Enabled by default and log to stdout
|
||||
#
|
||||
# Optional
|
||||
#
|
||||
[log]
|
||||
|
||||
# Log level
|
||||
#
|
||||
# Optional
|
||||
# Default: "ERROR"
|
||||
#
|
||||
level = "DEBUG"
|
||||
|
||||
# Sets the filepath for the traefik log. If not specified, stdout will be used.
|
||||
# Intermediate directories are created if necessary.
|
||||
#
|
||||
# Optional
|
||||
# Default: os.Stdout
|
||||
#
|
||||
# filePath = "log/traefik.log"
|
||||
|
||||
# Format is either "json" or "common".
|
||||
#
|
||||
# Optional
|
||||
# Default: "common"
|
||||
#
|
||||
# format = "json"
|
||||
|
||||
################################################################
|
||||
# Access logs configuration
|
||||
################################################################
|
||||
|
||||
# Enable access logs
|
||||
# By default it will write to stdout and produce logs in the textual
|
||||
# Common Log Format (CLF), extended with additional fields.
|
||||
#
|
||||
# Optional
|
||||
#
|
||||
# [accessLog]
|
||||
|
||||
# Sets the file path for the access log. If not specified, stdout will be used.
|
||||
# Intermediate directories are created if necessary.
|
||||
#
|
||||
# Optional
|
||||
# Default: os.Stdout
|
||||
#
|
||||
# filePath = "/path/to/log/log.txt"
|
||||
|
||||
# Format is either "json" or "common".
|
||||
#
|
||||
# Optional
|
||||
# Default: "common"
|
||||
#
|
||||
# format = "json"
|
||||
|
||||
################################################################
|
||||
# API and dashboard configuration
|
||||
################################################################
|
||||
|
||||
# Enable API and dashboard
|
||||
[api]
|
||||
|
||||
# Enable the API in insecure mode
|
||||
#
|
||||
# Optional
|
||||
# Default: false
|
||||
#
|
||||
insecure = true
|
||||
|
||||
# Enabled Dashboard
|
||||
#
|
||||
# Optional
|
||||
# Default: true
|
||||
#
|
||||
# dashboard = false
|
||||
|
||||
################################################################
|
||||
# Ping configuration
|
||||
################################################################
|
||||
|
||||
# Enable ping
|
||||
[ping]
|
||||
|
||||
# Name of the related entry point
|
||||
#
|
||||
# Optional
|
||||
# Default: "traefik"
|
||||
#
|
||||
# entryPoint = "traefik"
|
||||
|
||||
################################################################
|
||||
# Docker configuration backend
|
||||
################################################################
|
||||
|
||||
# Enable Docker configuration backend
|
||||
[providers]
|
||||
[providers.docker]
|
||||
|
||||
# Docker server endpoint. Can be a tcp or a unix socket endpoint.
|
||||
#
|
||||
# Required
|
||||
# Default: "unix:///var/run/docker.sock"
|
||||
#
|
||||
# endpoint = "tcp://10.10.10.10:2375"
|
||||
endpoint = "unix:///var/run/docker.sock"
|
||||
|
||||
# Default host rule.
|
||||
#
|
||||
# Optional
|
||||
# Default: "Host(`{{ normalize .Name }}`)"
|
||||
#
|
||||
# defaultRule = "Host(`{{ normalize .Name }}.docker.localhost`)"
|
||||
|
||||
# Expose containers by default in traefik
|
||||
#
|
||||
# Optional
|
||||
# Default: true
|
||||
#
|
||||
watch = true
|
||||
exposedByDefault = false
|
||||
network = "traefik"
|
||||
[providers.file]
|
||||
directory = "/etc/traefik/fileconf/"
|
||||
watch = true
|
||||
|
||||
# Enable ACME (Let's Encrypt): automatic SSL.
|
||||
[certificatesResolvers.myresolver.acme]
|
||||
|
||||
# Email address used for registration.
|
||||
#
|
||||
# Required
|
||||
#
|
||||
email = "ddns@mcseeno.de"
|
||||
|
||||
# File or key used for certificates storage.
|
||||
#
|
||||
# Required
|
||||
#
|
||||
storage = "acme.json"
|
||||
|
||||
# CA server to use.
|
||||
# Uncomment the line to use Let's Encrypt's staging server,
|
||||
# leave commented to go to prod.
|
||||
#
|
||||
# Optional
|
||||
# Default: "https://acme-v02.api.letsencrypt.org/directory"
|
||||
#
|
||||
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
|
||||
|
||||
# The certificates' duration in hours.
|
||||
# It defaults to 2160 (90 days) to follow Let's Encrypt certificates' duration.
|
||||
#
|
||||
# Optional
|
||||
# Default: 2160
|
||||
#
|
||||
# certificatesDuration=2160
|
||||
|
||||
# Preferred chain to use.
|
||||
#
|
||||
# If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name.
|
||||
# If no match, the default offered chain will be used.
|
||||
#
|
||||
# Optional
|
||||
# Default: ""
|
||||
#
|
||||
# preferredChain = "ISRG Root X1"
|
||||
|
||||
# KeyType to use.
|
||||
#
|
||||
# Optional
|
||||
# Default: "RSA4096"
|
||||
#
|
||||
# Available values : "EC256", "EC384", "RSA2048", "RSA4096", "RSA8192"
|
||||
#
|
||||
# keyType = "RSA4096"
|
||||
|
||||
# Use a TLS-ALPN-01 ACME challenge.
|
||||
#
|
||||
# Optional (but recommended)
|
||||
#
|
||||
[certificatesResolvers.myresolver.acme.tlsChallenge]
|
||||
|
||||
# Use a HTTP-01 ACME challenge.
|
||||
#
|
||||
# Optional
|
||||
#
|
||||
[certificatesResolvers.myresolver.acme.httpChallenge]
|
||||
|
||||
# EntryPoint to use for the HTTP-01 challenges.
|
||||
#
|
||||
# Required
|
||||
#
|
||||
entrypoint = "web"
|
||||
|
||||
# Use a DNS-01 ACME challenge rather than HTTP-01 challenge.
|
||||
# Note: mandatory for wildcard certificate generation.
|
||||
#
|
||||
# Optional
|
||||
#
|
||||
# [certificatesResolvers.myresolver.acme.dnsChallenge]
|
||||
|
||||
# DNS provider used.
|
||||
#
|
||||
# Required
|
||||
#
|
||||
# provider = "digitalocean"
|
||||
|
||||
# By default, the provider will verify the TXT DNS challenge record before letting ACME verify.
|
||||
# If delayBeforeCheck is greater than zero, this check is delayed for the configured duration in seconds.
|
||||
# Useful if internal networks block external DNS queries.
|
||||
#
|
||||
# Optional
|
||||
# Default: 0
|
||||
#
|
||||
# delayBeforeCheck = 0
|
||||
|
||||
# Use following DNS servers to resolve the FQDN authority.
|
||||
#
|
||||
# Optional
|
||||
# Default: empty
|
||||
#
|
||||
# resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
|
||||
|
||||
# Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready.
|
||||
#
|
||||
# NOT RECOMMENDED:
|
||||
# Increase the risk of reaching Let's Encrypt's rate limits.
|
||||
#
|
||||
# Optional
|
||||
# Default: false
|
||||
#
|
||||
# disablePropagationCheck = true
|
||||
|
||||
[entryPoints.websecure]
|
||||
address = ":443"
|
||||
|
||||
[certificatesResolvers]
|
||||
[certificatesResolvers.default.acme]
|
||||
email = "ddns@mcseeno.de" #Email Adresse hier anpassen
|
||||
storage = "/etc/traefik/ACME/acme.json"
|
||||
[certificatesResolvers.default.acme.tlsChallenge]
|
||||
|
|
|
|||
|
|
@ -0,0 +1,289 @@
|
|||
################################################################
|
||||
#
|
||||
# Configuration sample for Traefik v2.
|
||||
#
|
||||
# For Traefik v1: https://github.com/traefik/traefik/blob/v1.7/traefik.sample.toml
|
||||
#
|
||||
################################################################
|
||||
|
||||
################################################################
|
||||
# Global configuration
|
||||
################################################################
|
||||
[global]
|
||||
checkNewVersion = true
|
||||
sendAnonymousUsage = false
|
||||
|
||||
################################################################
|
||||
# Entrypoints configuration
|
||||
################################################################
|
||||
|
||||
# Entrypoints definition
|
||||
#
|
||||
# Optional
|
||||
# Default:
|
||||
[entryPoints]
|
||||
[entryPoints.web]
|
||||
address = ":80"
|
||||
[entryPoints.web.http]
|
||||
[entryPoints.web.http.redirections]
|
||||
[entryPoints.web.http.redirections.entryPoint]
|
||||
to = "websecure"
|
||||
scheme = "https"
|
||||
|
||||
[entryPoints.websecure]
|
||||
address = ":443"
|
||||
|
||||
[entryPoints.websecure.http.tls]
|
||||
certResolver = "myresolver"
|
||||
|
||||
## Dynamic configuration
|
||||
[https.routers]
|
||||
[https.routers.docker]
|
||||
# rule = "Host(`czechman.dynvpn.de`) && Path(`/`)"
|
||||
[https.routers.docker.tls]
|
||||
certResolver = "myresolver"
|
||||
[[https.routers.docker.tls.domains]]
|
||||
main = "cz.mcseeno.de"
|
||||
# main = "czechman.dynvpn.de"
|
||||
# sans = ["*.czechman.dynvpn.de"]
|
||||
|
||||
|
||||
################################################################
|
||||
# Traefik logs configuration
|
||||
################################################################
|
||||
|
||||
# Traefik logs
|
||||
# Enabled by default and log to stdout
|
||||
#
|
||||
# Optional
|
||||
#
|
||||
[log]
|
||||
|
||||
# Log level
|
||||
#
|
||||
# Optional
|
||||
# Default: "ERROR"
|
||||
#
|
||||
level = "DEBUG"
|
||||
|
||||
# Sets the filepath for the traefik log. If not specified, stdout will be used.
|
||||
# Intermediate directories are created if necessary.
|
||||
#
|
||||
# Optional
|
||||
# Default: os.Stdout
|
||||
#
|
||||
# filePath = "log/traefik.log"
|
||||
|
||||
# Format is either "json" or "common".
|
||||
#
|
||||
# Optional
|
||||
# Default: "common"
|
||||
#
|
||||
# format = "json"
|
||||
|
||||
################################################################
|
||||
# Access logs configuration
|
||||
################################################################
|
||||
|
||||
# Enable access logs
|
||||
# By default it will write to stdout and produce logs in the textual
|
||||
# Common Log Format (CLF), extended with additional fields.
|
||||
#
|
||||
# Optional
|
||||
#
|
||||
# [accessLog]
|
||||
|
||||
# Sets the file path for the access log. If not specified, stdout will be used.
|
||||
# Intermediate directories are created if necessary.
|
||||
#
|
||||
# Optional
|
||||
# Default: os.Stdout
|
||||
#
|
||||
# filePath = "/path/to/log/log.txt"
|
||||
|
||||
# Format is either "json" or "common".
|
||||
#
|
||||
# Optional
|
||||
# Default: "common"
|
||||
#
|
||||
# format = "json"
|
||||
|
||||
################################################################
|
||||
# API and dashboard configuration
|
||||
################################################################
|
||||
|
||||
# Enable API and dashboard
|
||||
[api]
|
||||
|
||||
# Enable the API in insecure mode
|
||||
#
|
||||
# Optional
|
||||
# Default: false
|
||||
#
|
||||
insecure = true
|
||||
|
||||
# Enabled Dashboard
|
||||
#
|
||||
# Optional
|
||||
# Default: true
|
||||
#
|
||||
# dashboard = false
|
||||
|
||||
################################################################
|
||||
# Ping configuration
|
||||
################################################################
|
||||
|
||||
# Enable ping
|
||||
[ping]
|
||||
|
||||
# Name of the related entry point
|
||||
#
|
||||
# Optional
|
||||
# Default: "traefik"
|
||||
#
|
||||
# entryPoint = "traefik"
|
||||
|
||||
################################################################
|
||||
# Docker configuration backend
|
||||
################################################################
|
||||
|
||||
# Enable Docker configuration backend
|
||||
[providers]
|
||||
[providers.docker]
|
||||
|
||||
# Docker server endpoint. Can be a tcp or a unix socket endpoint.
|
||||
#
|
||||
# Required
|
||||
# Default: "unix:///var/run/docker.sock"
|
||||
#
|
||||
# endpoint = "tcp://10.10.10.10:2375"
|
||||
endpoint = "unix:///var/run/docker.sock"
|
||||
|
||||
# Default host rule.
|
||||
#
|
||||
# Optional
|
||||
# Default: "Host(`{{ normalize .Name }}`)"
|
||||
#
|
||||
# defaultRule = "Host(`{{ normalize .Name }}.docker.localhost`)"
|
||||
|
||||
# Expose containers by default in traefik
|
||||
#
|
||||
# Optional
|
||||
# Default: true
|
||||
#
|
||||
watch = true
|
||||
exposedByDefault = false
|
||||
network = "traefik"
|
||||
[providers.file]
|
||||
directory = "/etc/traefik/fileconf/"
|
||||
watch = true
|
||||
|
||||
# Enable ACME (Let's Encrypt): automatic SSL.
|
||||
[certificatesResolvers.myresolver.acme]
|
||||
|
||||
# Email address used for registration.
|
||||
#
|
||||
# Required
|
||||
#
|
||||
email = "ddns@mcseeno.de"
|
||||
|
||||
# File or key used for certificates storage.
|
||||
#
|
||||
# Required
|
||||
#
|
||||
storage = "acme.json"
|
||||
|
||||
# CA server to use.
|
||||
# Uncomment the line to use Let's Encrypt's staging server,
|
||||
# leave commented to go to prod.
|
||||
#
|
||||
# Optional
|
||||
# Default: "https://acme-v02.api.letsencrypt.org/directory"
|
||||
#
|
||||
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
|
||||
|
||||
# The certificates' duration in hours.
|
||||
# It defaults to 2160 (90 days) to follow Let's Encrypt certificates' duration.
|
||||
#
|
||||
# Optional
|
||||
# Default: 2160
|
||||
#
|
||||
# certificatesDuration=2160
|
||||
|
||||
# Preferred chain to use.
|
||||
#
|
||||
# If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name.
|
||||
# If no match, the default offered chain will be used.
|
||||
#
|
||||
# Optional
|
||||
# Default: ""
|
||||
#
|
||||
# preferredChain = "ISRG Root X1"
|
||||
|
||||
# KeyType to use.
|
||||
#
|
||||
# Optional
|
||||
# Default: "RSA4096"
|
||||
#
|
||||
# Available values : "EC256", "EC384", "RSA2048", "RSA4096", "RSA8192"
|
||||
#
|
||||
# keyType = "RSA4096"
|
||||
|
||||
# Use a TLS-ALPN-01 ACME challenge.
|
||||
#
|
||||
# Optional (but recommended)
|
||||
#
|
||||
[certificatesResolvers.myresolver.acme.tlsChallenge]
|
||||
|
||||
# Use a HTTP-01 ACME challenge.
|
||||
#
|
||||
# Optional
|
||||
#
|
||||
[certificatesResolvers.myresolver.acme.httpChallenge]
|
||||
|
||||
# EntryPoint to use for the HTTP-01 challenges.
|
||||
#
|
||||
# Required
|
||||
#
|
||||
entrypoint = "web"
|
||||
|
||||
# Use a DNS-01 ACME challenge rather than HTTP-01 challenge.
|
||||
# Note: mandatory for wildcard certificate generation.
|
||||
#
|
||||
# Optional
|
||||
#
|
||||
# [certificatesResolvers.myresolver.acme.dnsChallenge]
|
||||
|
||||
# DNS provider used.
|
||||
#
|
||||
# Required
|
||||
#
|
||||
# provider = "digitalocean"
|
||||
|
||||
# By default, the provider will verify the TXT DNS challenge record before letting ACME verify.
|
||||
# If delayBeforeCheck is greater than zero, this check is delayed for the configured duration in seconds.
|
||||
# Useful if internal networks block external DNS queries.
|
||||
#
|
||||
# Optional
|
||||
# Default: 0
|
||||
#
|
||||
# delayBeforeCheck = 0
|
||||
|
||||
# Use following DNS servers to resolve the FQDN authority.
|
||||
#
|
||||
# Optional
|
||||
# Default: empty
|
||||
#
|
||||
# resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
|
||||
|
||||
# Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready.
|
||||
#
|
||||
# NOT RECOMMENDED:
|
||||
# Increase the risk of reaching Let's Encrypt's rate limits.
|
||||
#
|
||||
# Optional
|
||||
# Default: false
|
||||
#
|
||||
# disablePropagationCheck = true
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
---
|
||||
version: '3.7'
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: traefik:v2.9
|
||||
container_name: traefik
|
||||
volumes:
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- ./config:/etc/traefik
|
||||
# labels:
|
||||
# - "traefik.enable=true"
|
||||
# - "traefik.http.routers.traefik.rule=Host(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
|
||||
# - "traefik.http.routers.traefik.entrypoints=websecure"
|
||||
# - "traefik.http.routers.traefik.tls.certresolver=default"
|
||||
# - "traefik.http.routers.traefik.service=api@internal"
|
||||
# - "traefik.http.routers.traefik.middlewares=auth@docker"
|
||||
# - "traefik.http.middlewares.auth.basicauth.users=user:pass" # Siehe Anleitung
|
||||
networks:
|
||||
- traefik_proxy
|
||||
- default
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
restart: always
|
||||
|
||||
networks:
|
||||
traefik_proxy:
|
||||
external:
|
||||
name: traefik_proxy
|
||||
default:
|
||||
driver: bridge
|
||||
Loading…
Reference in New Issue