Eduardo David Paredes Vara
84 lines
2.8 KiB
YAML
84 lines
2.8 KiB
YAML
services:
|
|
traefik:
|
|
image: ${TRAEFIK_IMAGE}
|
|
container_name: traefik
|
|
restart: unless-stopped
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
|
|
command:
|
|
- "--ping=true"
|
|
|
|
# Logs
|
|
- "--log.level=${TRAEFIK_LOG_LEVEL}"
|
|
- "--accesslog=true"
|
|
- "--accesslog.filepath=/var/log/traefik/access.log"
|
|
- "--accesslog.format=json"
|
|
|
|
# Dashboard
|
|
- "--api.dashboard=true"
|
|
- "--api.insecure=false"
|
|
|
|
# Entrypoints
|
|
- "--entrypoints.web.address=:80"
|
|
- "--entrypoints.websecure.address=:443"
|
|
|
|
# Redirección HTTP -> HTTPS
|
|
- "--entrypoints.web.http.redirections.entrypoint.to=websecure"
|
|
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
|
|
|
|
# Proveedor Docker
|
|
- "--providers.docker=true"
|
|
- "--providers.docker.exposedbydefault=false"
|
|
- "--providers.docker.network=${TRAEFIK_DOCKER_NETWORK}"
|
|
|
|
# Permite backend HTTPS con certificado interno/sin SAN de IP
|
|
- "--serverstransport.insecureskipverify=true"
|
|
|
|
# Proveedor de ficheros dinámicos
|
|
- "--providers.file.directory=/dynamic"
|
|
- "--providers.file.watch=true"
|
|
|
|
# Cloudflare forwardedHeaders desactivado intencionalmente:
|
|
# con CGNAT el bouncer de CrowdSec vería la IP real del usuario y la banearía
|
|
# aunque el tráfico llegue por el tunnel. El bouncer ve la IP del contenedor
|
|
# cloudflared (red Docker privada, en allowlist) y nunca bloquea tráfico CF.
|
|
|
|
# Plugin CrowdSec Bouncer (middleware de seguridad L7)
|
|
- "--experimental.plugins.crowdsec-bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
|
- "--experimental.plugins.crowdsec-bouncer.version=v1.6.0"
|
|
|
|
# Plugin Sablier (scale-to-zero on demand)
|
|
- "--experimental.plugins.sablier.modulename=github.com/acouvreur/sablier"
|
|
- "--experimental.plugins.sablier.version=v1.8.0"
|
|
|
|
# ACME / Let's Encrypt (resolver "letsencrypt")
|
|
- "--certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL}"
|
|
- "--certificatesresolvers.letsencrypt.acme.storage=${TRAEFIK_ACME_STORAGE}"
|
|
- "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
|
|
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
|
|
|
|
ports:
|
|
- "${TRAEFIK_HTTP_PORT}:80"
|
|
- "${TRAEFIK_HTTPS_PORT}:443"
|
|
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro,Z
|
|
- ${TRAEFIK_DYNAMIC_DIR}:/dynamic:Z
|
|
- ${TRAEFIK_LETSENCRYPT_DIR}:/letsencrypt:Z
|
|
- ${TRAEFIK_LOG_DIR}:/var/log/traefik:Z
|
|
- /opt/traefik/plugins-storage:/plugins-storage:Z
|
|
|
|
networks:
|
|
- proxy
|
|
|
|
healthcheck:
|
|
test: ["CMD", "traefik", "healthcheck", "--ping"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|