pluto
b9be45dc71
Complete IaC covering: - 14 roles: common, docker, traefik, vaultwarden, monitoring, media, matrix, home_assistant, frigate, adguard, gitea, semaphore, openclaw, security, backup - Inventory for all hosts (Peggy, Bart, Yoda, NAS, Firewalla) - Stack playbooks: core-infrastructure, monitoring, media, communication, automation, smarthome, security-hardening - Maintenance playbooks: update-containers, backup, health-check - Production Docker Compose templates with Traefik labels - Security hardening (sysctl, auditd, UFW, fail2ban) - Automated backups with retention policy
47 lines
1.8 KiB
Django/Jinja
47 lines
1.8 KiB
Django/Jinja
services:
|
|
traefik:
|
|
image: {{ traefik_image }}
|
|
container_name: traefik
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
environment:
|
|
CF_DNS_API_TOKEN: {{ cloudflare_api_token }}
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- {{ traefik_data_dir }}/acme/acme.json:/acme.json
|
|
- {{ traefik_data_dir }}/dynamic:/dynamic
|
|
command:
|
|
- --api.dashboard={{ traefik_dashboard_enabled | lower }}
|
|
- --log.level={{ traefik_log_level }}
|
|
- --providers.docker=true
|
|
- --providers.docker.exposedbydefault=false
|
|
- --providers.docker.network={{ docker_network_name }}
|
|
- --providers.file.directory=/dynamic
|
|
- --providers.file.watch=true
|
|
- --entrypoints.web.address=:80
|
|
- --entrypoints.web.http.redirections.entrypoint.to=websecure
|
|
- --entrypoints.websecure.address=:443
|
|
- --certificatesresolvers.cloudflare.acme.dnschallenge=true
|
|
- --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
|
|
- --certificatesresolvers.cloudflare.acme.email={{ traefik_acme_email }}
|
|
- --certificatesresolvers.cloudflare.acme.storage=/acme.json
|
|
- --certificatesresolvers.cloudflare.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53
|
|
labels:
|
|
traefik.enable: "true"
|
|
traefik.http.routers.traefik.rule: "Host(`{{ traefik_dashboard_host }}`)"
|
|
traefik.http.routers.traefik.entrypoints: websecure
|
|
traefik.http.routers.traefik.tls.certresolver: cloudflare
|
|
traefik.http.routers.traefik.tls.domains[0].main: "{{ domain }}"
|
|
traefik.http.routers.traefik.tls.domains[0].sans: "*.{{ domain }}"
|
|
traefik.http.routers.traefik.service: api@internal
|
|
networks:
|
|
- {{ docker_network_name }}
|
|
|
|
networks:
|
|
{{ docker_network_name }}:
|
|
external: true
|