@simplehomelab/deployrr 6.0.0-rc3

package/apps/core/traefik/files/traefik.yml

@@ -0,0 +1,123 @@
+global:
+  checkNewVersion: true
+  sendAnonymousUsage: false
+
+serversTransport:
+  insecureSkipVerify: true
+
+entryPoints:
+  # HTTP Endpoint
+  web:
+    address: ":80"
+    forwardedHeaders:
+      trustedIPs: &trustedIps
+        # Allow these IPs to set the X-Forwarded-* headers - Cloudflare IPs: https://www.cloudflare.com/ips/
+        - 173.245.48.0/20
+        - 103.21.244.0/22
+        - 103.22.200.0/22
+        - 103.31.4.0/22
+        - 141.101.64.0/18
+        - 108.162.192.0/18
+        - 190.93.240.0/20
+        - 188.114.96.0/20
+        - 197.234.240.0/22
+        - 198.41.128.0/17
+        - 162.158.0.0/15
+        - 104.16.0.0/13
+        - 104.24.0.0/14
+        - 172.64.0.0/13
+        - 131.0.72.0/22
+        - 2400:cb00::/32
+        - 2606:4700::/32
+        - 2803:f800::/32
+        - 2405:b500::/32
+        - 2405:8100::/32
+        - 2a06:98c0::/29
+        - 2c0f:f248::/32
+        # Local IPs
+        - 127.0.0.1/32
+        - 10.0.0.0/8
+        - 192.168.0.0/16
+        - 172.16.0.0/12
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+          permanent: true
+
+  # HTTPS endpoint, with domain wildcard
+  websecure:
+    address: ":443"
+    forwardedHeaders:
+      # Reuse list of Cloudflare Trusted IP's above for HTTPS requests
+      trustedIPs: *trustedIps
+    http:
+      tls:
+        # TLS Options File inside rules folder
+        options: tls-opts@file
+        # Add letsencrypt as default certresolver for all services. 
+        # Also enables TLS (see below) and no need to specify on individual services
+        certResolver: letsencrypt
+        domains:
+          - main: {{env "DOMAINNAME"}}
+            sans:
+              - '*.{{env "DOMAINNAME"}}'
+  # traefik:
+  #   address: :8080
+
+# Enable Traefik Dashboard
+api:
+  dashboard: true
+  insecure: true
+
+# Log level 
+# (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
+log:
+  level: DEBUG
+  filePath: /logs/traefik.log
+accessLog:
+  filePath: /logs/access.log
+  bufferingSize: 100
+  filters:
+    statusCodes: 
+      - "204-299"
+      - "400-499"
+      - "500-599"
+    retryAttempts: true
+    minDuration: "10ms"
+
+providers:
+  providersThrottleDuration: 2s
+  docker:
+    watch: true 
+    # Use Docker Socket Proxy instead for improved security
+    # endpoint: "unix:///var/run/docker.sock" 
+    endpoint: "tcp://socket-proxy:2375"
+    exposedByDefault: false
+    network: traefik_proxy
+    swarmMode: false
+  # File provider for connecting things that are outside of docker / defining middleware
+  file:
+    # Only works on top level files in the rules folder
+    watch: true
+    # Load dynamic configuration from one or more .toml or .yml files in a directory
+    directory: /rules
+
+# Use letsencrypt to generate ssl serficiates
+certificatesResolvers:
+  # previously dns-cloudflare
+  letsencrypt:
+    acme:
+      # LetsEncrypt Staging Server - uncomment when testing
+      # caServer: https://acme-staging-v02.api.letsencrypt.org/directory
+      email: {{env "CLOUDFLARE_EMAIL"}}
+      storage: /acme.json
+      dnsChallenge:
+        provider: cloudflare
+        # Used to make sure the dns challenge is propagated to the rights dns servers
+        resolvers:
+          - "1.1.1.1:53"
+          - "1.0.0.1:53"
+        # To delay DNS check and reduce LE hitrate
+        delayBeforeCheck: 90 

package/apps/core/traefik/files/traefik_global_secrets_template.yml

@@ -0,0 +1,4 @@
+  SECRET-NAME-PLACEHOLDER:
+    file: $DOCKERDIR/secrets/SECRET-NAME-PLACEHOLDER
+  # SECRETS-PLACEHOLDER-DO-NOT-DELETE
+  

package/apps/core/traefik/files/traefik_proxy_network.yml

@@ -0,0 +1,8 @@
+  traefik_proxy:
+    name: traefik_proxy
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 192.168.90.0/24
+  # NETWORKS-PLACEHOLDER-DO-NOT-DELETE
+  

package/apps/core/traefik/manifest.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "../../../manifest-schema.json",
+  "version": "1.1",
+  "app": {
+    "sname": "traefik",
+    "pname": "Traefik",
+    "descriptionShort": "Reverse Proxy with SSL",
+    "icon": "sh-traefik",
+    "category": "core"
+  },
+  "deployment": {
+    "type": "custom",
+    "compose": "compose.yml",
+    "webui": true,
+    "port": 8080,
+    "protocol": "http"
+  },
+  "requirements": {
+    "prerequisites": [
+      "prerequisites",
+      "hybrid_mode",
+      "socket_proxy_running"
+    ],
+    "apps": [
+      "socket-proxy"
+    ]
+  },
+  "dashboard": {
+    "enabled": true,
+    "location": "local",
+    "showStats": true,
+    "portVariable": "TRAEFIK_PORT"
+  },
+  "traefik": {
+    "supported": true,
+    "subdomain": "traefik"
+  },
+  "env": {
+    "variables": [
+      {
+        "name": "TRAEFIK_PORT",
+        "type": "port",
+        "default": "8080",
+        "prompt": false,
+        "required": true,
+        "validation": {
+          "minPort": 1024,
+          "maxPort": 65535
+        }
+      }
+    ]
+  },
+  "firewall": {
+    "rules": [
+      "allow 80/tcp",
+      "allow 81/tcp",
+      "allow 443/tcp",
+      "allow 443/udp",
+      "allow 444/tcp",
+      "allow 444/udp"
+    ]
+  },
+  "status": {
+    "file": "04_traefik_preparation_status",
+    "stagingFile": "04_traefik_staging_status",
+    "productionFile": "04_traefik_production_status",
+    "successMessage": "Traefik Setup Completed",
+    "telemetryAction": "traefik"
+  }
+}