Skip to content

Commit 546bf74

Browse files
SimpleHomelabSimpleHomelab
committed
* Several updates 2024_01_22. See full commit log.
* Changed domain name variables to align with hostnames (and their prefixes/suffixes) I implemented in the previous commit - DOMAINNAME_CLOUD_SERVER is now DOMAINNAME_HS - DOMAINNAME_HOME_SYNOLOGY is now DOMAINNAME_DS918 - DOMAINNAME_SHB is now DOMAINNAME_WS * Replace Traefik/Cloudflare ACME validation from using Email and Global API Key to Scoped API Toekn (CF_DNS_API_TOKEN). Deleted unwated secrets. * Split middlewares.yml to individual middleware YML files - to align with Auto-Traefik. * Split middlewares-chains.yml to individual chain YML files - to align with Auto-Traefik. * Moved some of the media apps to Media Server docker stack (docker-compose-mds.yml) * Added more example file providers for various scenarios.
1 parent 3554676 commit 546bf74

File tree

126 files changed

+737
-449
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

126 files changed

+737
-449
lines changed

‎.gitignore

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,12 +79,21 @@ appdata/traefik2/rules/toml/*
7979
!appdata/traefik2/rules/ds918
8080
appdata/traefik2/rules/ds918/*
8181
!appdata/traefik2/rules/ds918/*.example
82+
!appdata/traefik2/rules/ds918/tls-opts.yml
83+
!appdata/traefik2/rules/ds918/middlewares-*.yml
84+
!appdata/traefik2/rules/ds918/chain-*.yml
8285
!appdata/traefik2/rules/hs
8386
appdata/traefik2/rules/hs/*
8487
!appdata/traefik2/rules/hs/*.example
8588
!appdata/traefik2/rules/hs/tls-opts.yml
86-
!appdata/traefik2/rules/hs/middlewares.yml
87-
!appdata/traefik2/rules/hs/middlewares-chains.yml
89+
!appdata/traefik2/rules/hs/middlewares-*.yml
90+
!appdata/traefik2/rules/hs/chain-*.yml
91+
!appdata/traefik2/rules/ws
92+
appdata/traefik2/rules/ws/*
93+
!appdata/traefik2/rules/ws/*.example
94+
!appdata/traefik2/rules/ws/tls-opts.yml
95+
!appdata/traefik2/rules/ws/middlewares-*.yml
96+
!appdata/traefik2/rules/ws/chain-*.yml
8897

8998
!appdata/authelia
9099
appdata/authelia/*

‎appdata/traefik2/rules/ds918/app-ds918-dsm-oauth.yml.example

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
http:
2+
routers:
3+
synology-rtr:
4+
rule: "Host(`dsm.{{env "DOMAINNAME_DS918"}}`)"
5+
entryPoints:
6+
- https
7+
middlewares:
8+
- chain-oauth
9+
service: synology-svc
10+
tls:
11+
certResolver: dns-cloudflare
12+
options: tls-opts@file
13+
services:
14+
synology-svc:
15+
loadBalancer:
16+
servers:
17+
- url: "http://192.168.1.254:5000"

‎appdata/traefik2/rules/ds918/app-ds918-video-oauth.yml.example

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
http:
2+
routers:
3+
synology-video-rtr:
4+
rule: "Host(`video.{{env "DOMAINNAME_DS918"}}`)"
5+
entryPoints:
6+
- https
7+
middlewares:
8+
- chain-oauth
9+
service: synology-video-svc
10+
tls:
11+
certResolver: dns-cloudflare
12+
options: tls-opts@file
13+
services:
14+
synology-video-svc:
15+
loadBalancer:
16+
servers:
17+
- url: "http://192.168.1.254:5003"

‎appdata/traefik2/rules/ds918/chain-basic-auth.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
http:
2+
middlewares:
3+
chain-basic-auth:
4+
chain:
5+
middlewares:
6+
- middlewares-rate-limit
7+
- middlewares-https-redirectscheme
8+
- middlewares-secure-headers
9+
- middlewares-basic-auth
10+
- middlewares-compress

‎appdata/traefik2/rules/ds918/chain-no-auth.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
http:
2+
middlewares:
3+
chain-no-auth:
4+
chain:
5+
middlewares:
6+
- middlewares-rate-limit
7+
- middlewares-https-redirectscheme
8+
- middlewares-secure-headers
9+
- middlewares-compress

‎appdata/traefik2/rules/ds918/chain-oauth-external.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
http:
2+
middlewares:
3+
chain-oauth-external:
4+
chain:
5+
middlewares:
6+
- middlewares-rate-limit
7+
- middlewares-https-redirectscheme
8+
- middlewares-secure-headers
9+
- middlewares-oauth-external
10+
- middlewares-compress
11+

‎appdata/traefik2/rules/ds918/chain-oauth.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
http:
2+
middlewares:
3+
chain-oauth:
4+
chain:
5+
middlewares:
6+
- middlewares-rate-limit
7+
- middlewares-https-redirectscheme
8+
- middlewares-secure-headers
9+
- middlewares-oauth
10+
- middlewares-compress

‎appdata/traefik2/rules/ds918/middlewares-basic-auth.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
http:
2+
middlewares:
3+
middlewares-basic-auth:
4+
basicAuth:
5+
# users:
6+
# - "user:$apsdfswWvC/6.$E3FtsfTntPC0wVJ7IUVtX1"
7+
usersFile: "/run/secrets/htpasswd" #be sure to mount the volume through docker-compose.yml
8+
realm: "Traefik 2 Basic Auth"

‎appdata/traefik2/rules/ds918/middlewares-buffering.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
http:
2+
middlewares:
3+
middlewares-buffering:
4+
buffering:
5+
maxResponseBodyBytes: 2000000
6+
maxRequestBodyBytes: 10485760
7+
memRequestBodyBytes: 2097152
8+
memResponseBodyBytes: 2097152
9+
retryExpression: "IsNetworkError() && Attempts() <= 2"

‎appdata/traefik2/rules/ds918/middlewares-compress.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
http:
2+
middlewares:
3+
middlewares-compress:
4+
compress: {}

‎appdata/traefik2/rules/ds918/middlewares-https-redirectscheme.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
http:
2+
middlewares:
3+
middlewares-https-redirectscheme:
4+
redirectScheme:
5+
scheme: https
6+
permanent: true

‎appdata/traefik2/rules/ds918/middlewares-oauth-external.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
http:
2+
middlewares:
3+
middlewares-oauth-external:
4+
forwardAuth:
5+
address: "https://oauth.{{env "DOMAINNAME_DS918"}}"
6+
trustForwardHeader: true
7+
authResponseHeaders:
8+
- "X-Forwarded-User"

‎appdata/traefik2/rules/ds918/middlewares-oauth.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
http:
2+
middlewares:
3+
middlewares-oauth:
4+
forwardAuth:
5+
address: "http://oauth:4181" # Make sure you have the OAuth service in docker-compose.yml
6+
trustForwardHeader: true
7+
authResponseHeaders:
8+
- "X-Forwarded-User"

‎appdata/traefik2/rules/ds918/middlewares-rate-limit.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
http:
2+
middlewares:
3+
middlewares-rate-limit:
4+
rateLimit:
5+
average: 100
6+
burst: 50

‎appdata/traefik2/rules/ws/middlewares.yml.example renamed to ‎appdata/traefik2/rules/ds918/middlewares-secure-headers.yml

Lines changed: 4 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,5 @@
11
http:
22
middlewares:
3-
middlewares-basic-auth:
4-
basicAuth:
5-
# users:
6-
# - "user:$apsdfswWvC/6.$E3FtsfTntPC0wVJ7IUVtX1"
7-
usersFile: "/run/secrets/htpasswd" #be sure to mount the volume through docker-compose.yml
8-
realm: "Traefik 2 Basic Auth"
9-
10-
middlewares-rate-limit:
11-
rateLimit:
12-
average: 100
13-
burst: 50
14-
15-
middlewares-https-redirectscheme:
16-
redirectScheme:
17-
scheme: https
18-
permanent: true
19-
203
middlewares-secure-headers:
214
headers:
225
accessControlAllowMethods:
@@ -32,50 +15,20 @@ http:
3215
stsPreload: true
3316
forceSTSHeader: true
3417
# frameDeny: true #overwritten by customFrameOptionsValue
35-
customFrameOptionsValue: "allow-from https:{{env "DOMAINNAME_SHB"}}" #CSP takes care of this but may be needed for organizr.
18+
customFrameOptionsValue: "allow-from https:{{env "DOMAINNAME_DS918"}}" #CSP takes care of this but may be needed for organizr.
3619
contentTypeNosniff: true
3720
browserXssFilter: true
3821
# sslForceHost: true # add sslHost to all of the services
39-
# sslHost: "{{env "DOMAINNAME_SHB"}}"
22+
# sslHost: "{{env "DOMAINNAME_DS918"}}"
4023
referrerPolicy: "same-origin"
4124
# Setting contentSecurityPolicy is more secure but it can break things. Proper auth will reduce the risk.
4225
# the below line also breaks some apps due to 'none' - sonarr, radarr, etc.
43-
# contentSecurityPolicy: "frame-ancestors '*.{{env "DOMAINNAME_SHB"}}:*';object-src 'none';script-src 'none';"
26+
# contentSecurityPolicy: "frame-ancestors '*.{{env "DOMAINNAME_DS918"}}:*';object-src 'none';script-src 'none';"
4427
# Line below, featurePolicy, was deprecated in v2.5.x in favor permissionPolicy
4528
# featurePolicy: "camera 'none'; geolocation 'none'; microphone 'none'; payment 'none'; usb 'none'; vr 'none';"
4629
permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), vr=()"
4730
customResponseHeaders:
4831
X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex,"
4932
server: ""
5033
# https://community.traefik.io/t/how-to-make-websockets-work-with-traefik-2-0-setting-up-rancher/1732
51-
# X-Forwarded-Proto: "https"
52-
53-
middlewares-secure-headers-wp:
54-
headers:
55-
hostsProxyHeaders:
56-
- "X-Forwarded-Host"
57-
stsSeconds: 31536000
58-
stsIncludeSubdomains: true
59-
stsPreload: true
60-
frameDeny: true
61-
contentTypeNosniff: true
62-
browserXssFilter: true
63-
64-
middlewares-oauth:
65-
forwardAuth:
66-
address: "http://oauth:4181" # Make sure you have the OAuth service in docker-compose.yml
67-
trustForwardHeader: true
68-
authResponseHeaders:
69-
- "X-Forwarded-User"
70-
71-
middlewares-authelia:
72-
forwardAuth:
73-
address: "http://authelia:9091/api/verify?rd=https://authelia.{{env "DOMAINNAME_SHB"}}"
74-
trustForwardHeader: true
75-
authResponseHeaders:
76-
- "Remote-User"
77-
- "Remote-Groups"
78-
79-
middlewares-compress:
80-
compress: {}
81-
34+
# X-Forwarded-Proto: "https"

‎appdata/traefik2/rules/ds918/tls-opts.yml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
tls:
2+
options:
3+
tls-opts:
4+
minVersion: VersionTLS12
5+
cipherSuites:
6+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
7+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
8+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
9+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
10+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
11+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
12+
- TLS_AES_128_GCM_SHA256
13+
- TLS_AES_256_GCM_SHA384
14+
- TLS_CHACHA20_POLY1305_SHA256
15+
- TLS_FALLBACK_SCSV # Client is doing version fallback. See RFC 7507
16+
curvePreferences:
17+
- CurveP521
18+
- CurveP384
19+
sniStrict: true

‎appdata/traefik2/rules/hs/app-adguard-home-authelia.yml.example

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
http:
22
routers:
33
adguard-rtr:
4-
rule: "Host(`ag.{{env "DOMAINNAME_CLOUD_SERVER"}}`)"
4+
rule: "Host(`ag.{{env "DOMAINNAME_HS"}}`)"
55
entryPoints:
66
- https
77
middlewares:
8-
- chain-oauth
8+
- chain-authelia
99
service: adguard-svc
1010
tls:
1111
certResolver: dns-cloudflare

‎appdata/traefik2/rules/hs/app-adguard-home-oauth.yml.example

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
http:
22
routers:
33
adguard-rtr:
4-
rule: "Host(`ag.{{env "DOMAINNAME_CLOUD_SERVER"}}`)"
4+
rule: "Host(`ag.{{env "DOMAINNAME_HS"}}`)"
55
entryPoints:
66
- https
77
middlewares:

‎appdata/traefik2/rules/hs/app-haos-no-auth.yml.example

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
http:
22
routers:
33
haos-rtr:
4-
rule: "Host(`haos.{{env "DOMAINNAME_CLOUD_SERVER"}}`)"
4+
rule: "Host(`haos.{{env "DOMAINNAME_HS"}}`)"
55
entryPoints:
66
- https
77
middlewares:

‎appdata/traefik2/rules/hs/app-hassos-no-auth.yml.example

Lines changed: 0 additions & 16 deletions
This file was deleted.

‎appdata/traefik2/rules/hs/app-pihole-oauth.yml.example

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
http:
22
routers:
33
pihole-rtr:
4-
rule: "Host(`pihole.{{env "DOMAINNAME_CLOUD_SERVER"}}`)"
4+
rule: "Host(`pihole.{{env "DOMAINNAME_HS"}}`)"
55
entryPoints:
66
- https
77
middlewares:

‎appdata/traefik2/rules/hs/app-plex-no-auth.yml.example

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
http:
2+
routers:
3+
splex-rtr:
4+
rule: "Host(`splex.{{env "DOMAINNAME_HS"}}`)"
5+
entryPoints:
6+
- https
7+
middlewares:
8+
- chain-oauth
9+
service: splex-svc
10+
tls:
11+
certResolver: dns-cloudflare
12+
options: tls-opts@file
13+
services:
14+
splex-svc:
15+
loadBalancer:
16+
servers:
17+
- url: "http://192.168.1.238:32400"

‎appdata/traefik2/rules/hs/app-proxmox-ve-oauth.yml.example

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
http:
2+
routers:
3+
proxmox-rtr:
4+
rule: "Host(`pve.{{env "DOMAINNAME_HS"}}`)"
5+
entryPoints:
6+
- https
7+
middlewares:
8+
- chain-oauth
9+
service: proxmox-svc
10+
tls:
11+
certResolver: dns-cloudflare
12+
options: tls-opts@file
13+
services:
14+
proxmox-svc:
15+
loadBalancer:
16+
passHostHeader: true
17+
serversTransport: "pve"
18+
servers:
19+
- url: "https://192.168.1.100:8006/"
20+
serversTransports:
21+
pve:
22+
insecureSkipVerify: true

‎appdata/traefik2/rules/hs/app-second-domain-passthrough.yml.example

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
tcp:
2+
routers:
3+
synology-traefik-rtr:
4+
entryPoints:
5+
- "https"
6+
rule: "HostSNIRegexp(`{{env "DOMAINNAME_DS918"}}`, `{subdomain:[a-z]+}.{{env "DOMAINNAME_DS918"}}`)"
7+
service: synology-traefik-svc
8+
tls:
9+
passthrough: true
10+
services:
11+
synology-traefik-svc:
12+
loadBalancer:
13+
servers:
14+
- address: "192.168.1.254:443"

0 commit comments

Comments
 (0)