forked from Haxxnet/Compose-Examples
-
Notifications
You must be signed in to change notification settings - Fork 0
/
docker-compose-command-config.yml
91 lines (87 loc) · 6.66 KB
/
docker-compose-command-config.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
# This docker compose example configures traefik by command definitions.
# This makes the traefik.yml static configuration obsolete.
# Note that we still reference a dynamic configuration for best practice
version: '3.8'
services:
traefik:
image: traefik:2.10
container_name: traefik
command:
- --global.checkNewVersion=true # check for updates
- --global.sendAnonymousUsage=false # do not send anonymous statistics
- --providers.docker=true # enable docker provider
- --providers.docker.network=proxy # define default network to monitor for docker provider
- --providers.docker.exposedbydefault=false # do not expose docker hosts per default
- --providers.docker.swarmModeRefreshSeconds=15s # defeine swarm mode fresh seconds
- --providers.providersThrottleDuration=2s # define throttle duration
- --providers.file.watch=true # monitor file provider for changes
- --providers.file.filename=/etc/traefik/fileConfig.yml # location of the dynamic configuration
- --entrypoints.http.address=:80 # entrypoint for unencrypted http
- --entrypoints.http.forwardedHeaders.trustedIPs=103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,104.16.0.0/13,104.24.0.0/14,108.162.192.0/18,131.0.72.0/22,141.101.64.0/18,162.158.0.0/15,172.64.0.0/13,173.245.48.0/20,188.114.96.0/20,190.93.240.0/20,197.234.240.0/22,198.41.128.0/17,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32 # define cloudflare ip ranges as trusted
- --entrypoints.http.http.redirections.entryPoint.to=https # automatic redirect from http to https
- --entrypoints.http.http.redirections.entryPoint.scheme=https # automatic redirect from http to https
- --entrypoints.https.address=:443 # entrypoint for encrypted https
- --entrypoints.https.forwardedHeaders.trustedIPs=103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,104.16.0.0/13,104.24.0.0/14,108.162.192.0/18,131.0.72.0/22,141.101.64.0/18,162.158.0.0/15,172.64.0.0/13,173.245.48.0/20,188.114.96.0/20,190.93.240.0/20,197.234.240.0/22,198.41.128.0/17,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32 # define cloudflare ip ranges as trusted
- --entrypoints.https.http.middlewares=security-headers@file,rate-limit@file # define default middlewares for all proxy entries
- --api.dashboard=true # enable traefik api dashboard
- --api.insecure=true # expose traefik api dashboard on TCP/8080 without need for router
####################################################
# !!! ADJUST TO YOUR INFRASTRUCTURE SETUP BELOW !!!!
- --entrypoints.https.http.tls.certresolver=myresolver # define default cert resolver
- --entrypoints.https.http.tls.domains[0].main=example.com # define main domain, change to your domain
- --entrypoints.https.http.tls.domains[0].sans=*.example.com # define sans domain, change to your domain
- [email protected] # define your email address
- --certificatesresolvers.myresolver.acme.dnschallenge=true # enable dns challenge to obtain wildcard certificates
- --certificatesresolvers.myresolver.acme.dnschallenge.provider=cloudflare # define provider for certificates
- --certificatesresolvers.myresolver.acme.storage=/etc/traefik/acme.json # define acme path for certificate information
- --certificatesresolvers.myresolver.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53 # define dns servers for your resolver, here cloudflare
####################################################
- --log.level=INFO # enable log level
- --accesslog=true # enable access logs
- --accesslog.filepath=/logs/traefik.log # define access log path
- --accesslog.format=json # set access log format to json instead clm
- --accesslog.bufferingsize=0 # set access log buffer size to 0
- --accesslog.filters.statuscodes=400-599 # only log http errors in logs; alternatively set 200-599 to include successful http requests
- --accesslog.fields.headers.defaultmode=drop # drop all headers
- --serversTransport.insecureSkipVerify=true # set insecureSkipVerify to true to allow self-signed certificates
labels:
- traefik.enable=true # enable traefik
- traefik.http.routers.api.rule=Host(`traefik.example.com`) # define subdomain for the traefik api dashboard
- traefik.http.routers.api.service=api@internal # enable traefik api dashboard
- traefik.http.routers.api.middlewares=local-ipwhitelist@file,basic-auth@file # protect dashboard with basic auth and restrict access to private class subnets only
ports:
- 80:80 # http
- 443:443 # https
- 127.0.0.1:8080:8080 # traefik api dashboard
networks:
- proxy # define traefik docker network
environment:
- TZ=Europe/Berlin # define timezone
- CF_DNS_API_TOKEN=<MY-CF-API-TOKEN> # define your cloudflare api token
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro # pass docker socket as read-only
- ${DOCKER_VOLUME_STORAGE:-/mnt/docker-volumes}/traefik:/etc/traefik/ # bind mount volume for persistent traefik data
- ${DOCKER_VOLUME_STORAGE:-/mnt/docker-volumes}/traefik/logs:/logs # bind mount volume for persistent traefik logs
restart: always # always restart traefik
extra_hosts:
- host.docker.internal:172.17.0.1 # define internal ip; helps traefik to resolve containers running in host network mode
whoami:
image: traefik/whoami
networks:
- proxy
labels:
- traefik.enable=true
- traefik.http.routers.whoami.rule=Host(`whoami.example.com`)
- traefik.http.services.whoami.loadbalancer.server.port=80
#- traefik.http.services.whoami.loadbalancer.server.scheme=https # optional, but sometines necessary when proxying to https services
#- traefik.http.services.whoami.loadbalancer.serverstransport=insecureTransport@file # optional, but sometines necessary when proxying to https services
#- traefik.http.middlewares.limit.buffering.maxRequestBodyBytes=50000000 # optional, only necessary for enabled file uploads
#- traefik.http.middlewares.limit.buffering.maxResponseBodyBytes=50000000 # optional, only necessary for enabled file uploads
#- traefik.http.middlewares.limit.buffering.memRequestBodyBytes=50000000 # optional, only necessary for enabled file uploads
#- traefik.http.middlewares.limit.buffering.memResponseBodyBytes=50000000 # optional, only necessary for enabled file uploads
- traefik.docker.network=proxy
# Part for optional traefik middlewares
- traefik.http.routers.whoami.middlewares=local-ipwhitelist@file
networks:
proxy:
external: true