diff --git a/.env.dist b/.env.dist new file mode 100644 index 0000000..369e823 --- /dev/null +++ b/.env.dist @@ -0,0 +1,8 @@ +# Automated Certificate Management Environment (ACME) email address. +# This is used for certificate-related notifications and recovery purposes. +# Example: ACME_EMAIL='your-email@example.com' +ACME_EMAIL='CHANGEME' + +# IPs you can trust to forward headers. Useful if your application is behind Cloudflare, for example. +# Add IPs as a comma-separated list. +TRUSTED_IPS='10.0.0.0/8,172.16.0.0/16,192.168.0.0/16,fc00::/7,173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32' diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..4c49bd7 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.env diff --git a/LICENCE b/LICENCE new file mode 100644 index 0000000..7356467 --- /dev/null +++ b/LICENCE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2024 Guillaume 'B.B.' Van Hemmen + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index 84b64d8..9130052 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,49 @@ -# traefik-standalone +# Traefik Standalone -choose this repository to deploy only traefik \ No newline at end of file +## Introduction + +This project sets up a standalone Traefik reverse proxy using Docker Compose. Traefik is a modern HTTP reverse proxy and +load balancer that makes deploying microservices and integrating them with your existing infrastructure easy. + +## Table of Contents + +- [Introduction](#introduction) +- [Prerequisites](#prerequisites) +- [Installation](#installation) +- [Usage](#usage) +- [License](#license) + +## Prerequisites + +- Docker: Make sure Docker is installed and running on your system. +- Docker Compose: You also need Docker Compose to orchestrate the container setup. + +## Installation + +1. Clone the repository: + + ```bash + git clone https://github.com/your-repository-url/traefik-standalone.git + cd traefik-standalone + ``` + +2. Copy the environment variable template: + + ```bash + cp .env.dist .env + ``` + +3. Customize the `.env` file as necessary for your environment. + +## Usage + +1. Start the Traefik service with Docker Compose: + + ```bash + docker compose up -d + ``` +2. You can now start adding your services and configure Traefik to reverse proxy to them. + +## License + +This project is licensed under the terms of the MIT license. See the [LICENSE](LICENSE) file for details. diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..6e1390c --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,53 @@ +networks: + network: + name: traefik_network + +services: + + reverse-proxy: + image: traefik:v3.1 # The official Traefik docker image + command: + - '--api=true' + - '--api.dashboard=false' + - '--api.insecure=false' + - '--global.sendAnonymousUsage=false' + - '--global.checkNewVersion=false' + - '--log=true' + - '--log.level=WARN' + - '--providers.docker=true' # Enabling docker provider + - '--providers.docker.exposedbydefault=false' # Do not expose containers unless explicitly told so + - '--entrypoints.web.address=:80' # Traefik will listen to incoming request on the port 80 (HTTP) + - '--entrypoints.web.http.redirections.entrypoint.to=websecure' + - '--entrypoints.web.http.redirections.entrypoint.scheme=https' + ## Please see the Forwarded Header Trust section of the Authelia Traefik Integration documentation. + - '--entryPoints.web.forwardedHeaders.trustedips=${TRUSTED_IPS:-}' + - '--entryPoints.web.proxyProtocol.trustedips=${TRUSTED_IPS:-}' + - '--entryPoints.web.forwardedHeaders.insecure=false' + - '--entryPoints.web.proxyProtocol.insecure=false' + - '--entrypoints.websecure.address=:443' # Traefik will listen to incoming request on the port 443 (HTTPS) + ## Please see the Forwarded Header Trust section of the Authelia Traefik Integration documentation. + - '--entryPoints.websecure.forwardedHeaders.trustedips=${TRUSTED_IPS:-}' + - '--entryPoints.websecure.proxyProtocol.trustedips=${TRUSTED_IPS:-}' + - '--entryPoints.websecure.forwardedHeaders.insecure=false' + - '--entryPoints.websecure.proxyProtocol.insecure=false' + - '--certificatesresolvers.myresolver.acme.httpchallenge=true' # Enable a http challenge named 'myresolver' + - '--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web' # Tell it to use our predefined entrypoint named 'web' + - '--certificatesresolvers.myresolver.acme.email=${ACME_EMAIL}' # The email to provide to let's encrypt + - '--certificatesresolvers.myresolver.acme.storage=/acme.json' # Tell to store the certificate on a path under our volume + networks: + - network + ports: + - target: 80 + published: 80 + mode: host + - target: 443 + published: 443 + mode: host + volumes: + - /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events + - ../acme.json:/acme.json + deploy: + replicas: 1 + restart_policy: + condition: any + delay: 5s