-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathcompose.yml
207 lines (200 loc) · 7.47 KB
/
compose.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
---
networks:
public_network:
name: public_network
redis_network:
name: redis_network
wireguard_network:
name: wireguard_network
driver: bridge
ipam:
config:
- subnet: 10.8.2.0/24
gateway: 10.8.2.1
ip_range: 10.8.2.0/24
volumes:
traefik_data:
name: traefik_data
wireguard_data:
name: wireguard_data
authelia_secrets:
name: authelia_secrets
services:
traefik:
image: traefik:latest
hostname: traefik
container_name: traefik
restart: on-failure:3
command:
- "--log.level=INFO"
- "--api.insecure=false"
- "--api.dashboard=false"
- "--providers.docker=true"
- "--providers.docker.exposedByDefault=false"
- "--global.sendAnonymousUsage=false"
- "--global.checkNewVersion=false"
# ---------------------------------- ACME --------------------------------------------
- "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.propagation.delayBeforeChecks=5"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.propagation.disableChecks=true"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=${MY_PROVIDER:?error}"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53"
- "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
# -------------------------------- ENTRYPOINT -----------------------------------------
- "--entrypoints.web.address=:80"
- "--entrypoints.web.http.redirections.entrypoint.to=websecure"
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
- "--entrypoints.websecure.address=:443"
#- "--entrypoints.websecure.http.tls=true"
#- "--entrypoints.websecure.http.tls.certResolver=letsencrypt"
# - "--entrypoints.websecure.http.tls.domains[0].main=${MY_DOMAIN}"
# - "--entrypoints.websecure.http.tls.domains[0].sans=*.${MY_DOMAIN}"
# -------------------------------- PROXY -----------------------------------------
- "--entryPoints.web.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7"
- "--entryPoints.web.proxyProtocol.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7"
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7"
- "--entryPoints.websecure.proxyProtocol.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7"
- "--entryPoints.web.forwardedHeaders.insecure=false"
- "--entryPoints.web.proxyProtocol.insecure=false"
- "--entryPoints.websecure.forwardedHeaders.insecure=false"
- "--entryPoints.websecure.proxyProtocol.insecure=false"
labels:
- com.centurylinklabs.watchtower.enable=true
- traefik.enable=true
- traefik.docker.network=public_network
- traefik.http.routers.api.tls=true
- traefik.http.routers.api.entryPoints=websecure
- traefik.http.routers.api.service=api@internal
- traefik.http.routers.api.tls.certresolver=letsencrypt
- traefik.http.routers.api.rule=Host(`${MY_DOMAIN:?error}`)
environment:
DUCKDNS_TOKEN: "${DUCKDNS_TOKEN:?error}"
ports:
- 80:80/tcp
- 443:443/tcp
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /etc/localtime:/etc/localtime:ro
- traefik_data:/letsencrypt
networks:
- public_network
secrets-generator:
image: veerendra2/secrets-generator:latest
container_name: secrets-generator
environment:
PUID: ${PUID:?error}
PGID: ${PGID:?error}
volumes:
- authelia_secrets:/secrets
authelia:
image: authelia/authelia:latest
container_name: authelia
hostname: authelia
restart: on-failure:3
labels:
- com.centurylinklabs.watchtower.enable=true
- traefik.enable=true
- traefik.docker.network=public_network
- traefik.http.routers.authelia.entryPoints=websecure
- traefik.http.routers.authelia.tls.certresolver=letsencrypt
- traefik.http.routers.authelia.rule=Host(`auth.${MY_DOMAIN:?error}`)
- traefik.http.middlewares.authelia.forwardAuth.address=http://authelia:9091/api/authz/forward-auth
- traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true
- traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Email,Remote-Name
- traefik.http.routers.authelia.middlewares=authelia@docker
- traefik.http.services.authelia.loadbalancer.server.port=9091
depends_on:
secrets-generator:
condition: service_completed_successfully
environment:
PUID: ${PUID:?error}
PGID: ${PGID:?error}
X_AUTHELIA_CONFIG_FILTERS: template
MY_DOMAIN: ${MY_DOMAIN:?error}
AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE: /var/secrets/JWT_SECRET
AUTHELIA_SESSION_SECRET_FILE: /var/secrets/SESSION_SECRET
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: /var/secrets/STORAGE_ENCRYPTION_KEY
volumes:
- ./config:/config
- authelia_secrets:/var/secrets
- /etc/localtime:/etc/localtime:ro
- /etc/timezone:/etc/timezone:ro
networks:
- public_network
- redis_network
wg-easy:
image: ghcr.io/wg-easy/wg-easy:latest
container_name: wg-easy
hostname: wg-easy
restart: on-failure:3
labels:
- com.centurylinklabs.watchtower.enable=true
- traefik.enable=true
- traefik.docker.network=wireguard_network
- traefik.http.routers.wg-easy.tls=true
- traefik.http.routers.wg-easy.entrypoints=websecure
- traefik.http.routers.wg-easy.tls.certresolver=letsencrypt
- traefik.http.routers.wg-easy.rule=Host(`wg.${MY_DOMAIN:?error}`)
- traefik.http.routers.wg-easy.middlewares=authelia@docker
- traefik.http.services.wg-easy.loadbalancer.server.port=51821
depends_on:
- authelia
- traefik
environment:
LANG: en
WG_HOST: wg.${MY_DOMAIN:?error}
WG_DEFAULT_DNS: 1.1.1.1,1.0.0.1
WG_DEFAULT_ADDRESS: 10.8.0.x
WG_PORT: 51820
WG_PERSISTENT_KEEPALIVE: 25
WG_ALLOWED_IPS: "0.0.0.0/0,::/0"
UI_TRAFFIC_STATS: true
UI_CHART_TYPE: 2
volumes:
- /etc/localtime:/etc/localtime:ro
- wireguard_data:/etc/wireguard
ports:
- "51820:51820/udp"
cap_add:
- NET_ADMIN
- SYS_MODULE
sysctls:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.src_valid_mark=1
networks:
wireguard_network:
ipv4_address: 10.8.2.8
public_network:
watchtower:
image: containrrr/watchtower:latest
container_name: watchtower
hostname: watchtower
restart: on-failure:3
labels:
- com.centurylinklabs.watchtower.enable=true
- traefik.enable=false
user: ${PUID?error}:${PGID?error}
group_add:
- 999
environment:
WATCHTOWER_CLEANUP: true
WATCHTOWER_LABEL_ENABLE: true
WATCHTOWER_RUN_ONCE: true
WATCHTOWER_HTTP_API_METRICS: true
WATCHTOWER_ROLLING_RESTART: true
WATCHTOWER_TIMEOUT: 30s
WATCHTOWER_SCHEDULE: "0 8 * * *"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /etc/localtime:/etc/localtime:ro
redis:
image: redis:latest
container_name: redis
hostname: redis
restart: on-failure:3
labels:
- com.centurylinklabs.watchtower.enable=true
user: ${PUID:?error}:${PGID:?error}
networks:
- redis_network