11notes/traefik repository overview

name: "reverse-proxy"

x-lockdown: &lockdown
  # prevents write access to the image itself
  read_only: true
  # prevents any process within the container to gain more privileges
  security_opt:
    - "no-new-privileges=true"

services:
  socket-proxy:
    # for more information about this image checkout:
    # https://github.com/11notes/docker-socket-proxy
    image: "11notes/socket-proxy:2.1.6"
    <<: *lockdown
    user: "0:0"
    environment:
      TZ: "Europe/Zurich"
    volumes:
      - "/run/docker.sock:/run/docker.sock:ro" 
      - "socket-proxy.run:/run/proxy"
    restart: "always"

  traefik:
    depends_on:
      socket-proxy:
        condition: "service_healthy"
        restart: true
    image: "11notes/traefik:3.7.13"
    <<: *lockdown
    labels:
      - "traefik.enable=true"

      # default errors middleware
      - "traefik.http.middlewares.default-errors.errors.status=402-599"
      - "traefik.http.middlewares.default-errors.errors.query=/{status}"
      - "traefik.http.middlewares.default-errors.errors.service=default-errors"

      # default ratelimit
      - "traefik.http.middlewares.default-ratelimit.ratelimit.average=100"
      - "traefik.http.middlewares.default-ratelimit.ratelimit.burst=120"
      - "traefik.http.middlewares.default-ratelimit.ratelimit.period=1s"

      # default CSP
      - "traefik.http.middlewares.default-csp.headers.contentSecurityPolicy=default-src 'self' blob: data: 'unsafe-inline'"

      # default allowlist
      - "traefik.http.middlewares.default-ipallowlist-RFC1918.ipallowlist.sourcerange=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"

      # example on how to secure the traefik dashboard and api
      - "traefik.http.routers.dashboard.rule=Host(`${FQDN_TRAEFIK}`)"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=dashboard-auth"
      - "traefik.http.routers.dashboard.entrypoints=https"
      # admin / traefik, please change!
      - "traefik.http.middlewares.dashboard-auth.basicauth.users=admin:$2a$12$ktgZsFQZ0S1FeQbI1JjS9u36fAJMHDQaY6LNi9EkEp8sKtP5BK43C"

      # default catch-all router
      - "traefik.http.routers.default.rule=HostRegexp(`.+`)"
      - "traefik.http.routers.default.priority=1"
      - "traefik.http.routers.default.entrypoints=https"
      - "traefik.http.routers.default.service=default-errors"

      # default http to https redirection
      - "traefik.http.middlewares.default-http.redirectscheme.permanent=true"
      - "traefik.http.middlewares.default-http.redirectscheme.scheme=https"
      - "traefik.http.routers.default-http.priority=1"
      - "traefik.http.routers.default-http.rule=HostRegexp(`.+`)"
      - "traefik.http.routers.default-http.entrypoints=http"
      - "traefik.http.routers.default-http.middlewares=default-http"
      - "traefik.http.routers.default-http.service=default-http"
      - "traefik.http.services.default-http.loadbalancer.passhostheader=true"
    environment:
      TZ: "Europe/Zurich"
      PORKBUN_API_KEY: "${PORKBUN_API_KEY}"
      PORKBUN_SECRET_API_KEY: "${PORKBUN_SECRET_API_KEY}"
    command:
      # ping is needed for the health check to work!
      - "--ping=true"
      - "--ping.terminatingStatusCode=204"
      - "--global.checkNewVersion=false"
      - "--global.sendAnonymousUsage=false"
      - "--accesslog=true"
      - "--api.dashboard=true"
      # disable insecure api and dashboard access
      - "--api.insecure=false"
      - "--log.level=INFO"
      - "--log.format=json"
      - "--providers.docker.exposedByDefault=false"
      - "--providers.file.directory=/traefik/var"
      - "--entrypoints.http.address=:80"
      - "--entrypoints.http.http.middlewares=default-errors,default-ratelimit,default-ipallowlist-RFC1918,default-csp"
      - "--entrypoints.https.address=:443"
      - "--entrypoints.https.http.tls=true"
      - "--entrypoints.https.http.middlewares=default-errors,default-ratelimit,default-ipallowlist-RFC1918,default-csp"
      # disable upstream HTTPS certificate checks (https > https)
      - "--serversTransport.insecureSkipVerify=true"
      # plugins example
      - "--experimental.plugins.rewriteResponseHeaders.moduleName=github.com/jamesmcroft/traefik-plugin-rewrite-response-headers"
      - "--experimental.plugins.rewriteResponseHeaders.version=v1.1.2"
      - "--experimental.plugins.geoblock.moduleName=github.com/PascalMinder/geoblock"
      - "--experimental.plugins.geoblock.version=v0.3.3"
      # let's encrypt example for porkbun DNS challenge
      - "--certificatesResolvers.porkbun.acme.storage=/traefik/var/porkbun.json"
      - "--certificatesResolvers.porkbun.acme.dnsChallenge.provider=porkbun"
      - "--certificatesResolvers.porkbun.acme.dnsChallenge.delayBeforeCheck=30"
      - "--entrypoints.https.http.tls.certresolver=porkbun"
      - "--entrypoints.https.http.tls.domains[0].main=${DOMAIN0}"
      - "--entrypoints.https.http.tls.domains[0].sans=*.${DOMAIN0}"
      # enable metrics
      - "--entrypoints.metrics.address=:8899"
      - "--metrics.prometheus=true"
      - "--metrics.prometheus.entryPoint=metrics"
    ports:
      - "80:80/tcp"
      - "443:443/tcp"
    volumes:
      - "var:/traefik/var"
      - "plugins:/traefik/plugins"
      # access docker socket via proxy read-only
      - "socket-proxy.run:/var/run"
    networks:
      backend:
      frontend:
    sysctls:
      # allow rootless container to access ports < 1024
      net.ipv4.ip_unprivileged_port_start: 80
    restart: "always"

  errors:
    # this image can be used to display a simple error message since Traefik can’t serve content
    image: "11notes/traefik:errors"
    <<: *lockdown
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.default-errors.loadbalancer.server.port=3000"
    environment:
      TZ: "Europe/Zurich"
    networks:
      backend:
    restart: "always"

  prometheus:
    # for more information about this image checkout:
    # https://github.com/11notes/docker-prometheus
    depends_on:
      traefik:
        condition: "service_healthy"
        restart: true
    image: "11notes/prometheus:3.6.0"
    <<: *lockdown
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.prometheus.rule=Host(`${FQDN_PROMETHEUS}`)"
      - "traefik.http.routers.prometheus.entrypoints=https"
      - "traefik.http.routers.prometheus.service=prometheus"
      - "traefik.http.services.prometheus.loadbalancer.server.port=3000"
    environment:
      TZ: "Europe/Zurich"
      PROMETHEUS_CONFIG: |-
        global:
          scrape_interval: 15s

        scrape_configs:
          - job_name: "traefik"
            static_configs:
              - targets: ["traefik:8899"]
    volumes:
      - "prometheus.etc:/prometheus/etc"
      - "prometheus.var:/prometheus/var"
    networks:
      backend:
    restart: "always"

  # ╔═════════════════════════════════════════════════════╗
  # ║     DEMO CONTAINER - DO NOT USE IN PRODUCTION!      ║
  # ╚═════════════════════════════════════════════════════╝
  # used to create and endpoint with more infos about clients

  whoami:
    image: "traefik/whoami"
    <<: *lockdown
    command:
      - "--port=3000"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`${FQDN_WHOAMI}`)"
      - "traefik.http.routers.whoami.entrypoints=https"
      - "traefik.http.routers.whoami.service=whoami"
      - "traefik.http.services.whoami.loadbalancer.server.port=3000"
    networks:
      backend:
    restart: "always"

volumes:
  var:
  plugins:
  socket-proxy.run:
  prometheus.etc:
  prometheus.var:

networks:
  frontend:
  backend:
    internal: true

docker pull 11notes/traefik:3.7.13
docker pull ghcr.io/11notes/traefik:3.7.13
docker pull quay.io/11notes/traefik:3.7.13