@simplehomelab/deployrr 6.0.0-rc3

package/apps/core/tinyauth/compose.yml

@@ -0,0 +1,47 @@
+services:
+  # TinyAuth - Self-Hosted Single Sign-On, 2-FA, and TOTP
+  # Version: v5 (upgraded from v4)
+  # Migration: https://tinyauth.app/docs/breaking-updates/4-to-5/
+  tinyauth:
+    container_name: tinyauth
+    image: ghcr.io/steveiliop56/tinyauth:${TINYAUTH_VERSION_PIN}
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+    profiles: ["core", "all"]
+    networks:
+      - default
+      - traefik_proxy
+    # ports:
+    #   - "$TINYAUTH_PORT:3000"
+    volumes:
+      - $DOCKERDIR/appdata/tinyauth/users_file:/tinyauth/users_file
+      - $DOCKERDIR/appdata/tinyauth/data:/data  # SQLite database for sessions
+    environment:
+      # v5: All env vars now use TINYAUTH_<SECTION>_<KEY> format
+      # v5: SECRET/SECRET_FILE removed — session key is auto-generated in SQLite DB
+      - TINYAUTH_APPURL=https://tinyauth.$DOMAINNAME_1
+      - TINYAUTH_AUTH_USERSFILE=/tinyauth/users_file
+      - TINYAUTH_LOG_LEVEL=info  # Valid: trace/debug/info/warn/error/fatal/panic
+      - TINYAUTH_AUTH_LOGINMAXRETRIES=3
+      - TINYAUTH_AUTH_LOGINTIMEOUT=300
+      # OAuth providers use TINYAUTH_OAUTH_PROVIDERS_[PROVIDER]_* format in v5
+      # Google and GitHub auto-fill URLs/scopes - only ID and secret needed
+      # See: https://tinyauth.app/docs/breaking-updates/4-to-5/
+      # Google OAuth (uncomment to enable)
+      # - TINYAUTH_OAUTH_PROVIDERS_GOOGLE_CLIENTID=$GOOGLE_CLIENT_ID
+      # - TINYAUTH_OAUTH_PROVIDERS_GOOGLE_CLIENTSECRET=$GOOGLE_CLIENT_SECRET
+      # GitHub OAuth (uncomment to enable)
+      # - TINYAUTH_OAUTH_PROVIDERS_GITHUB_CLIENTID=$GITHUB_CLIENT_ID
+      # - TINYAUTH_OAUTH_PROVIDERS_GITHUB_CLIENTSECRET=$GITHUB_CLIENT_SECRET
+    labels:
+      - "traefik.enable=true"
+      ## HTTP Routers
+      - "traefik.http.routers.tinyauth-rtr.entrypoints=websecure-internal,websecure-external"
+      - "traefik.http.routers.tinyauth-rtr.rule=Host(`tinyauth.$DOMAINNAME_1`)"
+      ## Middlewares
+      - "traefik.http.routers.tinyauth-rtr.middlewares=chain-no-auth@file"
+      ## HTTP Services
+      - "traefik.http.routers.tinyauth-rtr.service=tinyauth-svc"
+      - "traefik.http.services.tinyauth-svc.loadbalancer.server.port=3000"
+    # DOCKER-LABELS-PLACEHOLDER

package/apps/core/tinyauth/files/chain-tinyauth.yml

@@ -0,0 +1,8 @@
+http:
+  middlewares:
+    chain-tinyauth:
+      chain:
+        middlewares:
+          - middlewares-rate-limit
+          - middlewares-secure-headers
+          - middlewares-tinyauth

package/apps/core/tinyauth/files/middlewares-tinyauth.yml

@@ -0,0 +1,10 @@
+http:
+  middlewares:
+    middlewares-tinyauth:
+      forwardAuth:
+        address: "http://tinyauth:3000/api/auth/traefik"
+        trustForwardHeader: true
+        authResponseHeaders:
+          - "Remote-User"
+          - "Remote-Groups"
+          - "Remote-Email"

package/apps/core/tinyauth/manifest.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "../../../manifest-schema.json",
+  "version": "1.1",
+
+  "app": {
+    "sname": "tinyauth",
+    "pname": "TinyAuth",
+    "descriptionShort": "Self-Hosted Single Sign-On, 2-FA",
+    "icon": "sh-tinyauth",
+    "category": "core"
+  },
+
+  "deployment": {
+    "type": "standard",
+    "compose": "compose.yml",
+    "webui": true,
+    "port": 3000,
+    "protocol": "https"
+  },
+
+  "requirements": {
+    "prerequisites": ["prerequisites", "socket_proxy_running", "traefik_production", "traefik_running", "hybrid_mode"],
+    "apps": ["socket-proxy", "traefik"]
+  },
+
+  "files": [
+    {
+      "source": "files/middlewares-tinyauth.yml",
+      "destination": "$DOCKER_FOLDER/appdata/traefik3/rules/$HOSTNAME/middlewares-tinyauth.yml",
+      "backup": false
+    },
+    {
+      "source": "files/chain-tinyauth.yml",
+      "destination": "$DOCKER_FOLDER/appdata/traefik3/rules/$HOSTNAME/chain-tinyauth.yml",
+      "backup": false
+    }
+  ],
+
+  "traefik": {
+    "supported": true,
+    "subdomain": "tinyauth",
+    "chain": "chain-no-auth",
+    "middlewares": ["middlewares-tinyauth.yml", "chain-tinyauth.yml"]
+  },
+
+  "dashboard": {
+    "enabled": true,
+    "location": "other",
+    "showStats": true,
+    "portVariable": null
+  },
+
+  "env": {
+    "variables": [
+      {
+        "name": "TINYAUTH_VERSION_PIN",
+        "type": "string",
+        "default": "v5",
+        "prompt": false,
+        "required": true
+      }
+    ]
+  },
+
+  "status": {
+    "file": "05_tinyauth_status",
+    "successMessage": "TinyAuth Setup Completed",
+    "telemetryAction": "tinyauth"
+  }
+}

package/apps/core/traefik/compose.yml

@@ -0,0 +1,106 @@
+services:
+  # Traefik 3 - Reverse Proxy
+  traefik:
+    container_name: traefik
+    image: traefik:${TRAEFIK_VERSION_PIN}
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+    profiles: ["core", "all"]
+    depends_on:
+      - socket-proxy
+    networks:
+      traefik_proxy:
+        ipv4_address: 192.168.90.254 # You can specify a static IP
+      socket_proxy:
+    command: # CLI arguments
+      - --global.checkNewVersion=true
+      - --global.sendAnonymousUsage=false
+      - --entrypoints.web-external.address=:81
+      - --entrypoints.web-internal.address=:80
+      - --entrypoints.websecure-external.address=:444
+      - --entrypoints.websecure-internal.address=:443
+      - --entrypoints.traefik.address=:8080
+      - --entrypoints.websecure-external.http3=true
+      - --entrypoints.websecure-internal.http3=true
+      - --entrypoints.web-external.http.redirections.entrypoint.to=websecure-external
+      - --entrypoints.web-external.http.redirections.entrypoint.scheme=https
+      - --entrypoints.web-external.http.redirections.entrypoint.permanent=true
+      - --entrypoints.web-internal.http.redirections.entrypoint.to=websecure-internal
+      - --entrypoints.web-internal.http.redirections.entrypoint.scheme=https
+      - --entrypoints.web-internal.http.redirections.entrypoint.permanent=true
+      - --api=true
+      - --api.dashboard=true
+      - --api.insecure=true
+      # - --serversTransport.insecureSkipVerify=true
+      # Allow these IPs to set the X-Forwarded-* headers - Cloudflare IPs: https://www.cloudflare.com/ips/
+      - --entrypoints.websecure-external.forwardedHeaders.trustedIPs=$CLOUDFLARE_IPS,$LOCAL_IPS
+      - --entrypoints.websecure-internal.forwardedHeaders.trustedIPs=$CLOUDFLARE_IPS,$LOCAL_IPS
+      - --log=true
+      - --log.filePath=/logs/traefik.log
+      - --log.level=DEBUG # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
+      - --accessLog=true
+      - --accessLog.filePath=/logs/access.log
+      - --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines
+      - --accessLog.filters.statusCodes=204-299,400-499,500-599
+      - --providers.docker=true
+      # - --providers.docker.endpoint=unix:///var/run/docker.sock # Disable for Socket Proxy. Enable otherwise.
+      - --providers.docker.endpoint=tcp://socket-proxy:2375 # Enable for Socket Proxy. Disable otherwise.
+      - --providers.docker.exposedByDefault=false
+      - --providers.docker.network=traefik_proxy 
+      # - --providers.docker.swarmMode=false # Traefik v2 Swarm
+      # - --providers.swarm.endpoint=tcp://127.0.0.1:2377 # Traefik v3 Swarm
+      - --entrypoints.websecure-external.http.tls=true
+      - --entrypoints.websecure-external.http.tls.options=tls-opts@file
+      - --entrypoints.websecure-internal.http.tls=true
+      - --entrypoints.websecure-internal.http.tls.options=tls-opts@file
+      # Add dns-cloudflare as default certresolver for all services. Also enables TLS and no need to specify on individual services
+      - --entrypoints.websecure-external.http.tls.certresolver=dns-cloudflare
+      - --entrypoints.websecure-internal.http.tls.certresolver=dns-cloudflare
+      # - DOMAINS-PLACEHOLDER-DO-NOT-DELETE
+      - --entrypoints.websecure-external.http.tls.domains[0].main=$DOMAINNAME_1
+      - --entrypoints.websecure-external.http.tls.domains[0].sans=*.$DOMAINNAME_1
+      - --entrypoints.websecure-internal.http.tls.domains[0].main=$DOMAINNAME_1
+      - --entrypoints.websecure-internal.http.tls.domains[0].sans=*.$DOMAINNAME_1
+      - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory
+      - --providers.file.watch=true # Only works on top level files in the rules folder
+      - --certificatesResolvers.dns-cloudflare.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory # LetsEncrypt Staging Server - uncomment when testing
+      - --certificatesResolvers.dns-cloudflare.acme.storage=/acme.json
+      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.provider=cloudflare
+      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53
+      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.propagation.delaybeforechecks=120 # To delay DNS check and reduce LE hitrate
+      #- --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.propagation.disablechecks=true # Not recommended
+      # - METRICS-PLACEHOLDER-DO-NOT-DELETE
+      # - PLUGINS-PLACEHOLDER-DO-NOT-DELETE
+    ports:
+      - "80:80"
+      - "81:81"
+      - "443:443"
+      - "443:443/udp" # For HTTP/3(QUIC)
+      - "444:444"
+      - "444:444/udp" # For HTTP/3(QUIC)
+      - "$TRAEFIK_PORT:8080"
+    volumes:
+      - $DOCKERDIR/appdata/traefik3/rules/$HOSTNAME:/rules 
+      # - /var/run/docker.sock:/var/run/docker.sock:ro # Use Docker Socket Proxy instead for improved security
+      - $DOCKERDIR/appdata/traefik3/acme/acme.json:/acme.json 
+      - $DOCKERDIR/logs/$HOSTNAME/traefik:/logs
+    environment:
+      - TZ=$TZ
+      - CF_DNS_API_TOKEN_FILE=/run/secrets/cf_dns_api_token    
+      - HTPASSWD_FILE=/run/secrets/basic_auth_credentials # HTTP Basic Auth Credentials
+      - DOMAINNAME_1 # Passing the domain name to traefik container to be able to use the variable in rules. 
+      # - TRAEFIK_AUTH_BYPASS_KEY
+    secrets:
+      - cf_dns_api_token
+      - basic_auth_credentials
+    labels:
+      - "traefik.enable=true"
+      # HTTP Routers
+      - "traefik.http.routers.traefik-rtr.entrypoints=websecure-internal,websecure-external"
+      - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME_1`)"
+      # Services - API
+      - "traefik.http.routers.traefik-rtr.service=api@internal"
+      # Middlewares
+      - "traefik.http.routers.traefik-rtr.middlewares=chain-basic-auth@file" # For Basic HTTP Authentication
+    # DOCKER-LABELS-PLACEHOLDER

package/apps/core/traefik/files/app-http-bypass-template.yml

@@ -0,0 +1,31 @@
+http:
+  routers:
+    APPNAME-PLACEHOLDER-rtr:
+      rule: "Host(`APP-SUBDOMAIN-PLACEHOLDER.{{env "DOMAINNAME_1"}}`)" 
+      priority: 99
+      entryPoints:
+        # - websecure-external
+        # - websecure-internal
+      middlewares:
+        - CHAIN-PLACEHOLDER
+      service: APPNAME-PLACEHOLDER-svc
+      tls:
+        certResolver: dns-cloudflare
+        options: tls-opts@file
+    APPNAME-PLACEHOLDER-rtr-bypass:
+      rule: "Host(`APP-SUBDOMAIN-PLACEHOLDER.{{env "DOMAINNAME_1"}}`) && Header(`traefik-auth-bypass-key`, `{{env "TRAEFIK_AUTH_BYPASS_KEY"}}`)" 
+      priority: 100
+      entryPoints:
+        # - websecure
+        # - websecure-internal
+      middlewares:
+        - chain-no-auth
+      service: APPNAME-PLACEHOLDER-svc
+      tls:
+        certResolver: dns-cloudflare
+        options: tls-opts@file
+  services:
+    APPNAME-PLACEHOLDER-svc:
+      loadBalancer:
+        servers:
+          - url: "APP-URL-PLACEHOLDER" # http://IP-ADDRESS:PORT

package/apps/core/traefik/files/app-http-template.yml

@@ -0,0 +1,18 @@
+http:
+  routers:
+    APPNAME-PLACEHOLDER-rtr:
+      rule: "Host(`APP-SUBDOMAIN-PLACEHOLDER.{{env "DOMAINNAME_1"}}`)" 
+      entryPoints:
+        # - websecure-external
+        # - websecure-internal
+      middlewares:
+        - CHAIN-PLACEHOLDER
+      service: APPNAME-PLACEHOLDER-svc
+      tls:
+        certResolver: dns-cloudflare
+        options: tls-opts@file
+  services:
+    APPNAME-PLACEHOLDER-svc:
+      loadBalancer:
+        servers:
+          - url: "APP-URL-PLACEHOLDER" # http://IP-ADDRESS:PORT

package/apps/core/traefik/files/app-https-ssc-bypass-template.yml

@@ -0,0 +1,36 @@
+http:
+  routers:
+    APPNAME-PLACEHOLDER-rtr:
+      rule: "Host(`APP-SUBDOMAIN-PLACEHOLDER.{{env "DOMAINNAME_1"}}`)" 
+      priority: 99
+      entryPoints:
+        # - websecure-external
+        # - websecure-internal
+      middlewares:
+        - CHAIN-PLACEHOLDER
+      service: APPNAME-PLACEHOLDER-svc
+      tls:
+        certResolver: dns-cloudflare
+        options: tls-opts@file
+    APPNAME-PLACEHOLDER-rtr-bypass:
+      rule: "Host(`APP-SUBDOMAIN-PLACEHOLDER.{{env "DOMAINNAME_1"}}`) && Header(`traefik-auth-bypass-key`, `{{env "TRAEFIK_AUTH_BYPASS_KEY"}}`)" 
+      priority: 100
+      entryPoints:
+        # - websecure
+        # - websecure-internal
+      middlewares:
+        - chain-no-auth
+      service: APPNAME-PLACEHOLDER-svc
+      tls:
+        certResolver: dns-cloudflare
+        options: tls-opts@file
+  services:
+    APPNAME-PLACEHOLDER-svc:
+      loadBalancer:
+        passHostHeader: true
+        serversTransport: "APPNAME-PLACEHOLDER-st"
+        servers:
+          - url: "APP-URL-PLACEHOLDER" # http://IP-ADDRESS:PORT
+  serversTransports:
+    APPNAME-PLACEHOLDER-st:
+      insecureSkipVerify: true

package/apps/core/traefik/files/app-https-ssc-template.yml

@@ -0,0 +1,23 @@
+http:
+  routers:
+    APPNAME-PLACEHOLDER-rtr:
+      rule: "Host(`APP-SUBDOMAIN-PLACEHOLDER.{{env "DOMAINNAME_1"}}`)" 
+      entryPoints:
+        # - websecure-external
+        # - websecure-internal
+      middlewares:
+        - CHAIN-PLACEHOLDER
+      service: APPNAME-PLACEHOLDER-svc
+      tls:
+        certResolver: dns-cloudflare
+        options: tls-opts@file
+  services:
+    APPNAME-PLACEHOLDER-svc:
+      loadBalancer:
+        passHostHeader: true
+        serversTransport: "APPNAME-PLACEHOLDER-st"
+        servers:
+          - url: "APP-URL-PLACEHOLDER"  # https://IP-ADDRESS:PORT
+  serversTransports:
+    APPNAME-PLACEHOLDER-st:
+      insecureSkipVerify: true

package/apps/core/traefik/files/chain-basic-auth.yml

@@ -0,0 +1,9 @@
+http:
+  middlewares:
+    chain-basic-auth:
+      chain:
+        middlewares:
+          - middlewares-rate-limit
+          - middlewares-secure-headers
+          - middlewares-basic-auth
+          # - middlewares-compress

package/apps/core/traefik/files/chain-nextcloud.yml

@@ -0,0 +1,8 @@
+http:
+  middlewares:
+    chain-nextcloud:
+      chain:
+        middlewares:
+          - middlewares-rate-limit
+          - nextcloud-middlewares-secure-headers
+          - nextcloud-redirect

package/apps/core/traefik/files/chain-no-auth.yml

@@ -0,0 +1,8 @@
+http:
+  middlewares:
+    chain-no-auth:
+      chain:
+        middlewares:
+          - middlewares-rate-limit
+          - middlewares-secure-headers
+          # - middlewares-compress

package/apps/core/traefik/files/domain-passthrough-template.yml

@@ -0,0 +1,15 @@
+tcp:
+  routers:
+    HOST-PLACEHOLDER-rtr:
+      entryPoints:
+        - websecure-internal
+        - websecure-external
+      rule: "HostSNIRegexp(`DOMAINNAME-VARIABLE-PLACEHOLDER`) || HostSNIRegexp(`{subdomain:[a-z]+}.DOMAINNAME-VARIABLE-PLACEHOLDER`)"
+      service: HOST-PLACEHOLDER-svc
+      tls:
+        passthrough: true
+  services:
+    HOST-PLACEHOLDER-svc:
+      loadBalancer:
+        servers:
+          - address: "HOST-IP-PLACEHOLDER:443"

package/apps/core/traefik/files/labels-auth-bypass-template.yml

@@ -0,0 +1,6 @@
+      # Auth Bypass
+      - "traefik.http.routers.APAPPNAME-PLACEHOLDER-rtr-bypass.entrypoints=websecure"
+      - "traefik.http.routers.APAPPNAME-PLACEHOLDER-rtr-bypass.rule=Host(`APAPPNAME-PLACEHOLDER.$DOMAINNAME_1`) && Header(`traefik-auth-bypass-key`, `$TRAEFIK_AUTH_BYPASS_KEY`)" # Bypass Auth for LunaSea on iOS
+      - "traefik.http.routers.APAPPNAME-PLACEHOLDER-rtr-bypass.priority=100"
+      - "traefik.http.routers.APAPPNAME-PLACEHOLDER-rtr-bypass.middlewares=chain-no-auth@file"
+      - "traefik.http.routers.APAPPNAME-PLACEHOLDER-rtr-bypass.service=APAPPNAME-PLACEHOLDER-svc"

package/apps/core/traefik/files/labels-template.yml

@@ -0,0 +1,10 @@
+    labels:
+      - "traefik.enable=true"
+      ## HTTP Routers
+      - "traefik.http.routers.LABEL-SERVICE-NAME-PLACEHOLDER-rtr.entrypoints=ENTRYPOINT-PLACEHOLDER"
+      - "traefik.http.routers.LABEL-SERVICE-NAME-PLACEHOLDER-rtr.rule=Host(`SUBDOMAIN-PLACEHOLDER.$DOMAINNAME_1`)"
+      ## Middlewares
+      - "traefik.http.routers.LABEL-SERVICE-NAME-PLACEHOLDER-rtr.middlewares=CHAIN-PLACEHOLDER@file"
+      ## HTTP Services
+      - "traefik.http.routers.LABEL-SERVICE-NAME-PLACEHOLDER-rtr.service=LABEL-SERVICE-NAME-PLACEHOLDER-svc"
+      - "traefik.http.services.LABEL-SERVICE-NAME-PLACEHOLDER-svc.loadbalancer.server.port=LABEL-SERVICE-PORT-PLACEHOLDER"

package/apps/core/traefik/files/middlewares-basic-auth.yml

@@ -0,0 +1,9 @@
+http:
+  middlewares:
+    middlewares-basic-auth:
+      basicAuth:
+        # users:
+        #   - "user:$apsdfswWvC/6.$E3FtsfTntPC0wVJ7IUVtX1"
+        usersFile: "/run/secrets/basic_auth_credentials" 
+        realm: "Traefik Basic Auth"
+        headerField: "X-Forwarded-User"

package/apps/core/traefik/files/middlewares-buffering.yml

@@ -0,0 +1,9 @@
+http:
+  middlewares:
+    middlewares-buffering:
+      buffering:
+        maxResponseBodyBytes: 2000000
+        maxRequestBodyBytes: 10485760  
+        memRequestBodyBytes: 2097152  
+        memResponseBodyBytes: 2097152
+        retryExpression: "IsNetworkError() && Attempts() <= 2"

package/apps/core/traefik/files/middlewares-compress.yml

@@ -0,0 +1,4 @@
+http:
+  middlewares:
+    middlewares-compress:
+      compress: {}

package/apps/core/traefik/files/middlewares-crowdsec-bouncer.yml

@@ -0,0 +1,13 @@
+http:
+  middlewares:
+    middlewares-crowdsec-bouncer:
+      plugin:
+        crowdsec:
+          enabled: true
+          crowdsecLapiScheme: http
+          crowdsecLapiHost: crowdsec:8080
+          crowdsecLapiKeyFile: /run/secrets/crowdsec_bouncer_traefik_key
+          clientTrustedIPs:
+            - 10.0.0.0/8
+            - 172.16.0.0/12
+            - 192.168.0.0/16

package/apps/core/traefik/files/middlewares-nextcloud.yml

@@ -0,0 +1,35 @@
+http:
+  middlewares:
+    ### Let's give them a new name so it won't conflict with others
+    nextcloud-middlewares-secure-headers:
+      headers:
+        accessControlMaxAge: 100
+        sslRedirect: true
+        stsSeconds: 63072000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        forceSTSHeader: true
+    ### We will modify this value for Nextcloud to remove the X-Frame-Options error:
+        customFrameOptionsValue: "SAMEORIGIN" #CSP takes care of this but may be needed for organizr.
+        contentTypeNosniff: true
+        browserXssFilter: true
+        referrerPolicy: "no-referrer"
+    ### While CSP is a good security setting, Nextcloud's Apache server takes care of this for us!
+#       contentSecurityPolicy: "frame-ancestors '*.example.com:*';object-src 'none';script-src 'none';"
+        featurePolicy: "camera 'none'; geolocation 'none'; microphone 'none'; payment 'none'; usb 'none'; vr 'none';"
+        customResponseHeaders:
+    ### Change this to none to remove the Robots error:
+          X-Robots-Tag: "noindex, nofollow"
+          X-Content-Type-Options: "nosniff"
+          X-XSS-Protection: "1; mode=block"
+          X-Frame-Options: "SAMEORIGIN"
+          Referrer-Policy: "no-referrer"
+          server: ""
+
+### This section redirects requests for Nextcloud calendar and contacts service discovery
+### source: https://docs.nextcloud.com/server/21/admin_manual/issues/general_troubleshooting.html#service-discovery
+    nextcloud-redirect:
+      redirectRegex:
+        permanent: true
+        regex: "https://(.*)/.well-known/(card|cal)dav"
+        replacement: "https://${1}/remote.php/dav/"

package/apps/core/traefik/files/middlewares-rate-limit.yml

@@ -0,0 +1,6 @@
+http:
+  middlewares:
+    middlewares-rate-limit:
+      rateLimit:
+        average: 200
+        burst: 200

package/apps/core/traefik/files/middlewares-secure-headers.yml

@@ -0,0 +1,26 @@
+http:
+  middlewares:
+    middlewares-secure-headers:
+      headers:
+        accessControlAllowMethods:
+          - GET
+          - OPTIONS
+          - PUT
+        accessControlMaxAge: 100
+        hostsProxyHeaders:
+          - "X-Forwarded-Host"
+        stsSeconds: 63072000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        forceSTSHeader: true # This is a good thing but it can be tricky. Enable after everything works.
+        # Comment out customFrameOptionsValue if you're using Jellyfin on LG WebOS
+        customFrameOptionsValue: SAMEORIGIN # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+        contentTypeNosniff: true
+        browserXssFilter: true
+        referrerPolicy: "same-origin"
+        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
+        customResponseHeaders:
+          X-Robots-Tag: "none,noindex,nofollow,noarchive,nosnippet,notranslate,noimageindex" # disable search engines from indexing home server
+          server: "" # hide server info from visitors
+        customRequestHeaders:
+          X-Forwarded-Proto: https

package/apps/core/traefik/files/t2_proxy_network.yml

@@ -0,0 +1,8 @@
+  t2_proxy:
+    name: t2_proxy
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 192.168.90.0/24
+  # NETWORKS-PLACEHOLDER-DO-NOT-DELETE
+  

package/apps/core/traefik/files/tls-opts.yml

@@ -0,0 +1,19 @@
+tls:
+  options:
+    tls-opts:
+      minVersion: VersionTLS12
+      cipherSuites:
+        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+        - TLS_AES_128_GCM_SHA256
+        - TLS_AES_256_GCM_SHA384
+        - TLS_CHACHA20_POLY1305_SHA256
+        - TLS_FALLBACK_SCSV # Client is doing version fallback. See RFC 7507
+      curvePreferences:
+        - CurveP521
+        - CurveP384
+      sniStrict: true

package/apps/core/traefik/files/traefik-static-config-example.yml

@@ -0,0 +1,97 @@
+    # Static configuration in YAML format
+    global:
+      checkNewVersion: true
+      sendAnonymousUsage: false
+
+    entryPoints:
+      web-external:
+        address: ":81"
+        http:
+          redirections:
+            entrypoint:
+              to: websecure-external
+              scheme: https
+              permanent: true
+      web-internal:
+        address: ":80"
+        http:
+          redirections:
+            entrypoint:
+              to: websecure-internal
+              scheme: https
+              permanent: true
+      websecure-external:
+        address: ":444"
+        http3: true
+        forwardedHeaders:
+          trustedIPs:
+            - "$CLOUDFLARE_IPS"
+            - "$LOCAL_IPS"
+        http:
+          tls:
+            options:
+              tls-opts:
+                minVersion: VersionTLS12
+            certResolver: dns-cloudflare
+            domains:
+              - main: "$DOMAINNAME_1"
+                sans:
+                  - "*.$DOMAINNAME_1"
+      websecure-internal:
+        address: ":443"
+        http3: true
+        forwardedHeaders:
+          trustedIPs:
+            - "$CLOUDFLARE_IPS"
+            - "$LOCAL_IPS"
+        http:
+          tls:
+            options:
+              tls-opts:
+                minVersion: VersionTLS12
+            certResolver: dns-cloudflare
+            domains:
+              - main: "$DOMAINNAME_1"
+                sans:
+                  - "*.$DOMAINNAME_1"
+      traefik:
+        address: ":8080"
+
+    api:
+      dashboard: true
+      insecure: true
+
+    log:
+      filePath: "/logs/traefik.log"
+      level: DEBUG
+
+    accessLog:
+      filePath: "/logs/access.log"
+      bufferingSize: 100
+      filters:
+        statusCodes:
+          - "204-299"
+          - "400-499"
+          - "500-599"
+
+    providers:
+      docker:
+        endpoint: "tcp://socket-proxy:2375"
+        exposedByDefault: false
+        network: traefik_proxy
+      file:
+        directory: "/rules"
+        watch: true
+
+    certificatesResolvers:
+      dns-cloudflare:
+        acme:
+          caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
+          storage: "/acme.json"
+          dnsChallenge:
+            provider: cloudflare
+            resolvers:
+              - "1.1.1.1:53"
+              - "1.0.0.1:53"
+            propagation:
+              delayBeforeCheck: 120