Created
September 15, 2023 10:57
-
-
Save MeenachiSundaram/38e21818fe07dd6461eb09c5be64d5a8 to your computer and use it in GitHub Desktop.
traefik issue
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| version: "3.9" | |
| ########################### NETWORKS | |
| # You may customize the network subnet (192.168.90.0/24) below as you please. | |
| # Docker Compose version 3.5 or higher required to define networks this way. | |
| networks: | |
| default: | |
| driver: bridge | |
| t2_proxy: | |
| name: t2_proxy | |
| driver: bridge | |
| ipam: | |
| config: | |
| - subnet: 192.168.90.0/24 | |
| socket_proxy: | |
| name: socket_proxy | |
| driver: bridge | |
| ipam: | |
| config: | |
| - subnet: 192.168.91.0/24 | |
| ########################### SECRETS | |
| secrets: | |
| htpasswd: | |
| file: $DOCKERDIR/secrets/htpasswd | |
| cf_email: | |
| file: $DOCKERDIR/secrets/cf_email | |
| cf_api_key: | |
| file: $DOCKERDIR/secrets/cf_api_key | |
| # cf_token: | |
| # file: $DOCKERDIR/secrets/cf_token | |
| traefik_forward_auth: | |
| file: $DOCKERDIR/secrets/traefik_forward_auth | |
| mysql_root_password: | |
| file: $SECRETSDIR/mysql_root_password | |
| mysql_user_password: | |
| file: $SECRETSDIR/mysql_user_password | |
| # authelia_jwt_secret: | |
| # file: $SECRETSDIR/authelia_jwt_secret | |
| # authelia_session_secret: | |
| # file: $SECRETSDIR/authelia_session_secret | |
| # authelia_storage_mysql_password: | |
| # file: $SECRETSDIR/authelia_storage_mysql_password | |
| # authelia_notifier_smtp_password: | |
| # file: $SECRETSDIR/authelia_notifier_smtp_password | |
| # authelia_duo_api_secret_key: | |
| # file: $SECRETSDIR/authelia_duo_api_secret_key | |
| ########################### EXTENSION FIELDS | |
| # Helps eliminate repetition of sections | |
| # More Info on how to use this: https://github.com/htpcBeginner/docker-traefik/pull/228 | |
| # Common environment values | |
| x-environment: &default-tz-puid-pgid | |
| TZ: $TZ | |
| PUID: $PUID | |
| PGID: $PGID | |
| # Keys common to some of the core services that we always to automatically restart on failure | |
| x-common-keys-core: &common-keys-core | |
| networks: | |
| - t2_proxy | |
| security_opt: | |
| - no-new-privileges:true | |
| restart: always | |
| # Keys common to some of the dependent services/apps | |
| x-common-keys-apps: &common-keys-apps | |
| networks: | |
| - t2_proxy | |
| security_opt: | |
| - no-new-privileges:true | |
| restart: unless-stopped | |
| # Keys common to some of the services in media-services.txt | |
| x-common-keys-media: &common-keys-media | |
| networks: | |
| - t2_proxy | |
| security_opt: | |
| - no-new-privileges:true | |
| restart: "no" | |
| ########################### SERVICES | |
| services: | |
| ############################# FRONTENDS | |
| # Traefik 2 - Reverse Proxy | |
| # Touch (create empty files) traefik.log and acme/acme.json. Set acme.json permissions to 600. | |
| # touch $DOCKERDIR/appdata/traefik2/acme/acme.json | |
| # chmod 600 $DOCKERDIR/appdata/traefik2/acme/acme.json | |
| # touch $DOCKERDIR/logs/web/traefik/traefik.log | |
| # touch $DOCKERDIR/logs/web/traefik/access.log | |
| traefik: | |
| <<: *common-keys-core # See EXTENSION FIELDS at the top | |
| container_name: traefik | |
| image: traefik:2.9 | |
| command: # CLI arguments | |
| - --global.checkNewVersion=true | |
| - --global.sendAnonymousUsage=true | |
| - --entryPoints.http.address=:80 | |
| - --entryPoints.https.address=:443 | |
| # Allow these IPs to set the X-Forwarded-* headers - Cloudflare IPs: https://www.cloudflare.com/ips/ | |
| - --entrypoints.https.forwardedHeaders.trustedIPs=$CLOUDFLARE_IPS,$LOCAL_IPS | |
| - --entryPoints.traefik.address=:8090 | |
| - --api=true | |
| # - --api.insecure=true | |
| - --api.dashboard=true | |
| # - --serversTransport.insecureSkipVerify=true | |
| - --log=true | |
| - --log.filePath=/logs/traefik.log | |
| - --log.level=WARN # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC | |
| - --accessLog=true | |
| - --accessLog.filePath=/logs/access.log | |
| - --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines | |
| - --accessLog.filters.statusCodes=204-299,400-499,500-599 | |
| - --providers.docker=true | |
| # - --providers.docker.endpoint=unix:///var/run/docker.sock # Use Docker Socket Proxy instead for improved security | |
| - --providers.docker.endpoint=tcp://socket-proxy:2375 # Use this instead of the previous line if you have socket proxy. | |
| - --providers.docker.exposedByDefault=false | |
| - --entrypoints.https.http.tls.options=tls-opts@file | |
| # Add dns-cf as default certresolver for all services. Also enables TLS and no need to specify on individual services | |
| - --entrypoints.https.http.tls.certresolver=dns-cf | |
| - --entrypoints.https.http.tls.domains[0].main=$DOMAINNAME_TRAEFIK_PI | |
| - --entrypoints.https.http.tls.domains[0].sans=*.$DOMAINNAME_TRAEFIK_PI | |
| # - --entrypoints.https.http.tls.domains[1].main=$DOMAINNAME2 # Pulls main cert for second domain | |
| # - --entrypoints.https.http.tls.domains[1].sans=*.$DOMAINNAME2 # Pulls wildcard cert for second domain | |
| - --providers.docker.network=t2_proxy | |
| - --providers.docker.swarmMode=false | |
| - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory | |
| # - --providers.file.filename=/path/to/file # Load dynamic configuration from a file | |
| - --providers.file.watch=true # Only works on top level files in the rules folder | |
| # - --certificatesResolvers.dns-cf.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory # LetsEncrypt Staging Server - uncomment when testing | |
| - --certificatesResolvers.dns-cf.acme.email=$CLOUDFLARE_EMAIL | |
| - --certificatesResolvers.dns-cf.acme.storage=/acme.json | |
| - --certificatesResolvers.dns-cf.acme.dnsChallenge.provider=cloudflare | |
| # - --certificatesResolvers.dns-cf.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53 | |
| - --certificatesResolvers.dns-cf.acme.dnsChallenge.resolvers=sharon.ns.cloudflare.com:53,simon.ns.cloudflare.com:53 | |
| - --certificatesResolvers.dns-cf.acme.dnsChallenge.delayBeforeCheck=90 # To delay DNS check and reduce LE hitrate | |
| networks: | |
| t2_proxy: | |
| ipv4_address: 192.168.90.254 # You can specify a static IP | |
| socket_proxy: | |
| ports: | |
| - target: 80 | |
| published: 80 | |
| protocol: tcp | |
| mode: host | |
| - target: 443 | |
| published: 443 | |
| protocol: tcp | |
| mode: host | |
| # - target: 8090 # insecure api wont work | |
| # published: 8090 | |
| # protocol: tcp | |
| # mode: host | |
| volumes: | |
| - $DOCKERDIR/appdata/traefik2/rules/rpi3:/rules # file provider directory | |
| # - /var/run/docker.sock:/var/run/docker.sock:ro # If you use Docker Socket Proxy, comment this line out | |
| - $DOCKERDIR/appdata/traefik2/acme/acme.json:/acme.json # cert location - you must create this empty file and change permissions to 600 | |
| - $DOCKERDIR/logs/rpi3/traefik:/logs # for fail2ban or crowdsec | |
| - $DOCKERDIR/shared:/shared | |
| environment: | |
| - TZ=$TZ | |
| - CF_API_EMAIL_FILE=/run/secrets/cf_email | |
| - CF_API_KEY_FILE=/run/secrets/cf_api_key | |
| - HTPASSWD_FILE=/run/secrets/htpasswd # HTPASSWD_FILE can be whatever as it is not used/called anywhere. | |
| - DOMAINNAME_TRAEFIK_PI # Passing the domain name to the traefik container to be able to use the variable in rules. | |
| secrets: | |
| - cf_email | |
| - cf_api_key | |
| - htpasswd | |
| labels: | |
| - "traefik.enable=true" | |
| # HTTP-to-HTTPS Redirect | |
| - "traefik.http.routers.http-catchall.entrypoints=http" | |
| - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)" | |
| - "traefik.http.routers.http-catchall.middlewares=redirect-to-https" | |
| - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https" | |
| # HTTP Routers | |
| - "traefik.http.routers.traefik-rtr.entrypoints=https" | |
| - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME_TRAEFIK_PI`)" | |
| - "traefik.http.routers.traefik-rtr.tls=true" # Some people had 404s without this | |
| - "traefik.http.routers.traefik-rtr.tls.certresolver=dns-cf" # Comment out this line after first run of traefik to force the use of wildcard certs | |
| - "traefik.http.routers.traefik-rtr.tls.domains[0].main=$DOMAINNAME_TRAEFIK_PI" | |
| - "traefik.http.routers.traefik-rtr.tls.domains[0].sans=*.$DOMAINNAME_TRAEFIK_PI" | |
| # - "traefik.http.routers.traefik-rtr.tls.domains[1].main=$DOMAINNAME2" # Pulls main cert for second domain | |
| # - "traefik.http.routers.traefik-rtr.tls.domains[1].sans=*.$DOMAINNAME2" # Pulls wildcard cert for second domain | |
| ## Services - API | |
| - "traefik.http.routers.traefik-rtr.service=api@internal" | |
| ## Middlewares | |
| # - "traefik.http.routers.traefik-rtr.middlewares=middlewares-rate-limit@file,middlewares-https-redirectscheme@file,middlewares-secure-headers@file,middlewares-basic-auth@file,middlewares-compress@file" | |
| # - "traefik.http.routers.traefik-rtr.middlewares=chain-basic-auth@file" | |
| - "traefik.http.routers.traefik-rtr.middlewares=chain-oauth@file" | |
| depends_on: | |
| - socket-proxy | |
| # Docker Socket Proxy - Security Enchanced Proxy for Docker Socket | |
| socket-proxy: | |
| <<: *common-keys-core # See EXTENSION FIELDS at the top | |
| container_name: socket-proxy | |
| image: tecnativa/docker-socket-proxy | |
| networks: | |
| socket_proxy: | |
| ipv4_address: 192.168.91.254 # You can specify a static IP | |
| # privileged: true # true for VM. False for unprivileged LXC container. | |
| #ports: | |
| # - "127.0.0.1:2375:2375" # Port 2375 should only ever get exposed to the internal network. When possible use this line. | |
| # I use the next line instead, as I want portainer to manage multiple docker endpoints within my home network. | |
| # - "2375:2375" | |
| volumes: | |
| - "/var/run/docker.sock:/var/run/docker.sock" | |
| environment: | |
| - LOG_LEVEL=warning # debug,info,notice,warning,err,crit,alert,emerg | |
| ## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.). | |
| # 0 to revoke access. | |
| # 1 to grant access. | |
| ## Granted by Default | |
| - EVENTS=1 | |
| - PING=1 | |
| - VERSION=1 | |
| ## Revoked by Default | |
| # Security critical | |
| - AUTH=0 | |
| - SECRETS=0 | |
| - POST=1 # Watchtower | |
| # Not always needed | |
| - BUILD=0 | |
| - COMMIT=0 | |
| - CONFIGS=0 | |
| - CONTAINERS=1 # Traefik, portainer, etc. | |
| - DISTRIBUTION=0 | |
| - EXEC=1 | |
| - IMAGES=1 # Portainer | |
| - INFO=1 # Portainer | |
| - NETWORKS=1 # Portainer | |
| - NODES=0 | |
| - PLUGINS=0 | |
| - SERVICES=1 # Portainer | |
| - SESSION=0 | |
| - SWARM=0 | |
| - SYSTEM=0 | |
| - TASKS=1 # Portainer | |
| - VOLUMES=1 # Portainer | |
| # Google OAuth - Single Sign On using OAuth 2.0 | |
| oauth: | |
| <<: *common-keys-core # See EXTENSION FIELDS at the top | |
| container_name: oauth | |
| # image: thomseddon/traefik-forward-auth:latest | |
| image: oauth:latest | |
| # image: thomseddon/traefik-forward-auth:2-arm64 # Use this image with Raspberry Pi | |
| environment: | |
| - CONFIG=/config | |
| - COOKIE_DOMAIN=$DOMAINNAME_TRAEFIK_PI | |
| - INSECURE_COOKIE=false | |
| - AUTH_HOST=oauth.$DOMAINNAME_TRAEFIK_PI | |
| - URL_PATH=/_oauth | |
| - LOG_LEVEL=warn # debug, trace, warn, info | |
| - LOG_FORMAT=text | |
| - LIFETIME=86400 # 1 day | |
| - DEFAULT_ACTION=auth | |
| - DEFAULT_PROVIDER=google | |
| secrets: | |
| - source: traefik_forward_auth | |
| target: /config | |
| labels: | |
| - "traefik.enable=true" | |
| ## HTTP Routers | |
| - "traefik.http.routers.oauth-rtr.tls=true" | |
| - "traefik.http.routers.oauth-rtr.entrypoints=https" | |
| - "traefik.http.routers.oauth-rtr.rule=Host(`oauth.$DOMAINNAME_TRAEFIK_PI`)" | |
| ## Middlewares | |
| - "traefik.http.routers.oauth-rtr.middlewares=chain-oauth@file" | |
| ## HTTP Services | |
| - "traefik.http.routers.oauth-rtr.service=oauth-svc" | |
| - "traefik.http.services.oauth-svc.loadbalancer.server.port=4181" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
error in
traefik.log