73 lines
2.5 KiB
YAML
73 lines
2.5 KiB
YAML
services:
|
|
traefik:
|
|
image: traefik:latest
|
|
restart: unless-stopped
|
|
|
|
command:
|
|
- --api.dashboard=true
|
|
- --api.insecure=true
|
|
|
|
- --providers.docker=true
|
|
- --providers.docker.exposedbydefault=false
|
|
|
|
- --entrypoints.web.address=:80
|
|
- --entrypoints.websecure.address=:443
|
|
|
|
- --serversTransport.insecureSkipVerify=true
|
|
|
|
# ✅ Cloudflare DNS challenge
|
|
- --certificatesresolvers.cloudflare.acme.dnschallenge=true
|
|
- --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
|
|
- --certificatesresolvers.cloudflare.acme.email=${ADM_EMAIL}
|
|
- --certificatesresolvers.cloudflare.acme.storage=/letsencrypt/acme.json
|
|
|
|
# ✅ Trust Cloudflare
|
|
- --entrypoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22
|
|
- --entrypoints.websecure.forwardedHeaders.insecure=true
|
|
|
|
labels:
|
|
- traefik.enable=true
|
|
|
|
# =========================
|
|
# 🔐 AUTHENTIK FORWARD AUTH
|
|
# =========================
|
|
- traefik.http.middlewares.authentik.forwardauth.address=http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
|
|
- traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
|
|
- traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid
|
|
|
|
# =========================
|
|
# 🏠 LOCAL BYPASS (optionnel)
|
|
# =========================
|
|
- traefik.http.middlewares.local-ipwhitelist.ipwhitelist.sourcerange=10.0.0.0/8,192.168.0.0/16
|
|
|
|
# =========================
|
|
# 🔗 GLOBAL CHAIN
|
|
# =========================
|
|
# 👉 AVEC bypass LAN :
|
|
- traefik.http.middlewares.chain-auth.chain.middlewares=local-ipwhitelist,authentik
|
|
|
|
# 👉 SI tu veux FORCER auth partout (sans bypass LAN) :
|
|
# - traefik.http.middlewares.chain-auth.chain.middlewares=authentik
|
|
|
|
ports:
|
|
- 80:80
|
|
- 443:443
|
|
|
|
environment:
|
|
- CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
|
|
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- /home/docker/DenRoute/letsencrypt:/letsencrypt
|
|
|
|
networks:
|
|
tan-network:
|
|
ipv4_address: 10.10.0.20
|
|
nextcloud-aio:
|
|
|
|
networks:
|
|
tan-network:
|
|
external: true
|
|
nextcloud-aio:
|
|
external: true
|