kacperor
afaafe8910
- traefik:v3.7.11 (najnowszy stabilny tag, sprawdzony w Docker Hub) - DNS-01 challenge, provider ovh, endpoint ovh-ca (region panelu) - dashboard tylko na 127.0.0.1:8080, dostęp przez tunel SSH - docker.sock zamontowany read-only - .env z kluczami API OVH poza repo (chmod 600), .env.example w repo - zweryfikowane: redirect 80->443, dashboard 200 lokalnie, czyste logi
44 lines
1.5 KiB
YAML
44 lines
1.5 KiB
YAML
services:
|
|
traefik:
|
|
image: traefik:v3.7.11
|
|
container_name: traefik
|
|
restart: unless-stopped
|
|
command:
|
|
- --providers.docker=true
|
|
- --providers.docker.exposedByDefault=false
|
|
- --providers.docker.network=edge
|
|
- --entrypoints.web.address=:80
|
|
- --entrypoints.web.http.redirections.entrypoint.to=websecure
|
|
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
|
- --entrypoints.websecure.address=:443
|
|
- --entrypoints.traefik.address=:8080
|
|
- --api.dashboard=true
|
|
- --certificatesresolvers.ovh.acme.dnschallenge=true
|
|
- --certificatesresolvers.ovh.acme.dnschallenge.provider=ovh
|
|
- --certificatesresolvers.ovh.acme.email=k.kruszka@hotmail.com
|
|
- --certificatesresolvers.ovh.acme.storage=/letsencrypt/acme.json
|
|
- --log.level=INFO
|
|
environment:
|
|
- OVH_ENDPOINT=ovh-ca
|
|
- OVH_APPLICATION_KEY=${OVH_APPLICATION_KEY}
|
|
- OVH_APPLICATION_SECRET=${OVH_APPLICATION_SECRET}
|
|
- OVH_CONSUMER_KEY=${OVH_CONSUMER_KEY}
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
- "127.0.0.1:8080:8080" # dashboard, wyłącznie przez tunel SSH
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- ./letsencrypt:/letsencrypt
|
|
networks:
|
|
- edge
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.dashboard.rule=Host(`traefik.dfkk.cloud`)
|
|
- traefik.http.routers.dashboard.entrypoints=traefik
|
|
- traefik.http.routers.dashboard.service=api@internal
|
|
|
|
networks:
|
|
edge:
|
|
external: true
|