50 lines
2.1 KiB
YAML
50 lines
2.1 KiB
YAML
services:
|
|
traefik:
|
|
image: traefik:latest # or pin a specific v3.x version
|
|
container_name: traefik
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
env_file:
|
|
- .env # should define TRAEFIK_DASHBOARD_CREDENTIALS
|
|
networks:
|
|
- proxy
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
environment:
|
|
- TRAEFIK_DASHBOARD_CREDENTIALS=${TRAEFIK_DASHBOARD_CREDENTIALS}
|
|
volumes:
|
|
- /etc/localtime:/etc/localtime:ro
|
|
- ${XDG_RUNTIME_DIR}/podman/podman.sock:/var/run/docker.sock:Z
|
|
# Static (static) config
|
|
- ./config/traefik.yaml:/traefik.yaml:ro,Z
|
|
# Dynamic (file provider) config
|
|
- ./config/config.yaml:/config.yaml:ro,Z
|
|
# Your self-signed wildcard cert
|
|
- ./certs/wildcard.192.168.205.130.nip.io.crt:/certs/wildcard.192.168.205.130.nip.io.crt:ro
|
|
- ./certs/wildcard.192.168.205.130.nip.io.key:/certs/wildcard.192.168.205.130.nip.io.key:ro
|
|
# Logs
|
|
- ./logs:/var/log/traefik:Z
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.traefik.entrypoints=http" # expose dashboard on HTTP :contentReference[oaicite:2]{index=2}
|
|
- "traefik.http.routers.traefik.rule=Host(`traefik.192.168.205.130.nip.io`)"
|
|
- "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_DASHBOARD_CREDENTIALS}"
|
|
# Redirect HTTP → HTTPS
|
|
- "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
|
|
- "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
|
|
# Secure (HTTPS) dashboard
|
|
- "traefik.http.routers.traefik-secure.entrypoints=https"
|
|
- "traefik.http.routers.traefik-secure.rule=Host(`traefik.192.168.205.130.nip.io`)"
|
|
- "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
|
|
- "traefik.http.routers.traefik-secure.tls=true"
|
|
- "traefik.http.routers.traefik-secure.tls.domains[0].main=192.168.205.130.nip.io"
|
|
- "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.192.168.205.130.nip.io"
|
|
- "traefik.http.routers.traefik-secure.service=api@internal"
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|
|
|