3cf02f9904
Add two new global-only properties to configure a dedicated Traefik entrypoint for the API and dashboard, enabling network isolation on private interfaces. Includes comprehensive test coverage for property management and compose config. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
86 lines
3.2 KiB
Plaintext
86 lines
3.2 KiB
Plaintext
---
|
|
services:
|
|
traefik:
|
|
image: "{{ $.TRAEFIK_IMAGE }}"
|
|
command:
|
|
- --entrypoints.http.address=:80
|
|
{{ if $.TRAEFIK_LETSENCRYPT_EMAIL }}
|
|
- --entrypoints.http.http.redirections.entrypoint.to=https
|
|
- --entrypoints.http.http.redirections.entrypoint.scheme=https
|
|
- --entrypoints.https.address=:443
|
|
{{ end }}
|
|
{{ if and ($.TRAEFIK_API_ENTRY_POINT) ($.TRAEFIK_API_ENTRY_POINT_ADDRESS) }}
|
|
- --entrypoints.{{ $.TRAEFIK_API_ENTRY_POINT }}.address={{ $.TRAEFIK_API_ENTRY_POINT_ADDRESS }}
|
|
{{ end }}
|
|
- --providers.docker
|
|
- --providers.docker.exposedByDefault=false
|
|
- --api={{ $.TRAEFIK_API_ENABLED }}
|
|
- --api.dashboard={{ $.TRAEFIK_DASHBOARD_ENABLED }}
|
|
|
|
- --log.level={{ $.TRAEFIK_LOG_LEVEL }}
|
|
- --log.format=json
|
|
|
|
{{ if $.TRAEFIK_LETSENCRYPT_EMAIL }}
|
|
- --certificatesresolvers.leresolver.acme.caserver={{ $.TRAEFIK_LETSENCRYPT_SERVER }}
|
|
- --certificatesresolvers.leresolver.acme.email={{ $.TRAEFIK_LETSENCRYPT_EMAIL }}
|
|
- --certificatesresolvers.leresolver.acme.storage=/data/acme.json
|
|
{{ if and (eq $.TRAEFIK_CHALLENGE_MODE "dns") ($.TRAEFIK_DNS_PROVIDER) }}
|
|
- --certificatesresolvers.leresolver.acme.dnschallenge=true
|
|
- --certificatesresolvers.leresolver.acme.dnschallenge.provider={{ $.TRAEFIK_DNS_PROVIDER }}
|
|
{{ else }}
|
|
- --certificatesresolvers.leresolver.acme.tlschallenge=true
|
|
{{ end }}
|
|
{{ end }}
|
|
|
|
{{ if $.TRAEFIK_DNS_PROVIDER_ENV_VARS }}
|
|
environment:
|
|
{{ range $env_var := $.TRAEFIK_DNS_PROVIDER_ENV_VARS | split "\n" }}
|
|
{{ $env_parts := $env_var | split " " }}
|
|
{{ $env_key := index $env_parts 0 }}
|
|
{{ $env_value := index $env_parts 1 }}
|
|
{{ if $env_key }}
|
|
- {{ $env_key | replace "dns-provider-" "" | upper }}={{ $env_value }}
|
|
{{ end }}
|
|
{{ end }}
|
|
{{ end }}
|
|
|
|
{{ if or (eq $.TRAEFIK_API_ENABLED "true") ($.TRAEFIK_BASIC_AUTH) ($.TRAEFIK_LETSENCRYPT_EMAIL) }}
|
|
labels:
|
|
{{ else }}
|
|
labels: []
|
|
{{ end }}
|
|
|
|
{{ if eq $.TRAEFIK_API_ENABLED "true" }}
|
|
# Dashboard
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.api.rule=Host(`{{ $.TRAEFIK_API_VHOST }}`)"
|
|
- "traefik.http.routers.api.service=api@internal"
|
|
- "traefik.http.routers.api.entrypoints={{ if $.TRAEFIK_API_ENTRY_POINT }}{{ $.TRAEFIK_API_ENTRY_POINT }}{{ else if $.TRAEFIK_LETSENCRYPT_EMAIL }}https{{ else }}http{{ end }}"
|
|
{{ end }}
|
|
|
|
{{ if $.TRAEFIK_BASIC_AUTH }}
|
|
- "traefik.http.routers.api.middlewares=auth"
|
|
- "traefik.http.middlewares.auth.basicauth.users={{ $.TRAEFIK_BASIC_AUTH }}"
|
|
{{ end }}
|
|
|
|
{{ if and ($.TRAEFIK_LETSENCRYPT_EMAIL) (not $.TRAEFIK_API_ENTRY_POINT) }}
|
|
- "traefik.http.routers.api.tls.certresolver=leresolver"
|
|
{{ end }}
|
|
|
|
network_mode: bridge
|
|
|
|
ports:
|
|
- "80:80"
|
|
{{ if $.TRAEFIK_LETSENCRYPT_EMAIL }}
|
|
- "443:443"
|
|
{{ end }}
|
|
{{ if and ($.TRAEFIK_API_ENTRY_POINT) ($.TRAEFIK_API_ENTRY_POINT_ADDRESS) }}
|
|
- "{{ $.TRAEFIK_API_ENTRY_POINT_ADDRESS }}:{{ $.TRAEFIK_API_ENTRY_POINT_PORT }}"
|
|
{{ end }}
|
|
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
|
- "{{ $.TRAEFIK_DATA_DIR }}:/data"
|