.gitignore

@@ -1 +0,0 @@
-passphrase

docker-compose.yml

@@ -1,85 +1,86 @@
----
+version: "3.3"
+
 services:
+
   traefik:
-    image: traefik:latest
+    image: "traefik:latest"
-    restart: unless-stopped
+    container_name: "traefik"
-    container_name: traefik
     command:
-      - --api.insecure=true # disable in prod
+#      - "--log.level=DEBUG"  # disable in prod
-      - --certificatesresolvers.letsencrypt.acme.email=infra@clps.ch
+      - "--api.insecure=true" # disable in prod
-      - --certificatesresolvers.letsencrypt.acme.storage=/etc/traefik/acme.json
+      - "--providers.docker=true"
-      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
+      - "--providers.docker.exposedbydefault=false"
-      - --entrypoints.http.address=:80
+      - "--providers.file.directory=/etc/traefik/dynamic_conf.d"
-      - --entrypoints.http.http.redirections.entrypoint.to=https
+      - "--entryPoints.https.address=:443"
-      - --entrypoints.https.address=:443
+      - "--entryPoints.http.address=:80"
-      - --log.level=info
+      - "--certificatesresolvers.letsencrypt.acme.storage=/etc/traefik/letsencrypt/acme.json"
-      - --providers.docker.exposedbydefault=true
+      - "--certificatesresolvers.letsencrypt.acme.email=infra@clps.ch"
-      - --providers.docker=true
+      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
+    volumes:
+      - "/home/cloud/traefik/dynamic_conf.d:/etc/traefik/dynamic_conf.d/"
+      - "/home/cloud/traefik/letsencrypt/acme.json:/etc/traefik/letsencrypt/acme.json"
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+    restart: unless-stopped
     ports:
       - "80:80"
       - "443:443"
       - "8069:8080"
-    volumes:
-      - ./traefik/acme.json:/etc/traefik/acme.json
-      - /var/run/docker.sock:/var/run/docker.sock:ro
 
   grafana:
-    image: grafana/grafana:latest
+    image: "grafana/grafana:latest"
+    container_name: "grafana"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.grafana.rule=Host(`grafana.clps.ch`)"
+      - "traefik.http.routers.grafana.entrypoints=https"
+      - "traefik.http.routers.grafana.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.grafana.tls=true"
+      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
+    depends_on:
+      - traefik
     restart: unless-stopped
-    container_name: grafana
     environment:
       - GF_SECURITY_ADMIN_USER=admin
       - GF_SECURITY_ADMIN_PASSWORD=grafana
-    #labels:
-    #  - traefik.enable=true
-    #  - traefik.http.routers.grafana.entrypoints=https
-    #  - traefik.http.routers.grafana.rule=Host(`grafana.clps.ch`)
-    #  - traefik.http.routers.grafana.tls.certresolver=letsencrypt
-    #  - traefik.http.services.grafana.loadbalancer.server.port=3000
     volumes:
-      - ./grafana/:/etc/grafana/provisioning/datasources/
+      - ./grafana:/etc/grafana/provisioning/datasources
 
   prometheus:
-    image: prom/prometheus:latest
+    image: "prom/prometheus:latest"
-    restart: unless-stopped
+    container_name: "prometheus"
-    container_name: prometheus
     command:
-      - --config.file=/etc/prometheus/prometheus.yml
+      - '--config.file=/etc/prometheus/prometheus.yml'
-    #labels:
+    restart: unless-stopped
-    #  - traefik.enable=true
-    #  - traefik.http.routers.prometheus.entrypoints=https
-    #  - traefik.http.routers.prometheus.rule=Host(`prom.clps.ch`)
-    #  - traefik.http.routers.prometheus.tls.certresolver=letsencrypt
-    #  - traefik.http.services.prometheus.loadbalancer.server.port=9090
     volumes:
-      - ./prometheus/:/etc/prometheus/:ro
+      - ./prometheus:/etc/prometheus
-      - prom_data:/prometheus/
+      - prom_data:/prometheus
+    #labels:      # We might want to reserve this interface to a closed network
+    #  - "traefik.enable=true"
+    #  - "traefik.http.routers.prometheus.rule=Host(`prom.clps.ch`)"
+    #  - "traefik.http.routers.prometheus.entrypoints=https"
+    #  - "traefik.http.routers.prometheus.tls.certresolver=letsencrypt"
+    #  - "traefik.http.routers.prometheus.tls=true"
+    #  - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
+    depends_on:
+      -  traefik
 
   nextcloud:
-    image: nextcloud/all-in-one:latest
+    image: "nextcloud/all-in-one:latest"
-    restart: unless-stopped
+    container_name: "nextcloud-aio-mastercontainer"
-    container_name: nextcloud-aio-mastercontainer
     init: true
     environment:
-      - APACHE_PORT=11000
+      - "APACHE_PORT=11000"
-#      - SKIP_DOMAIN_VALIDATION=true
+      - "APACHE_IP_BINDING=0.0.0.0"
-
-    labels:
-      - traefik.enable=true
-      - traefik.http.middlewares.nextcloud_headers.headers.hostsProxyHeaders=X-Forwarded-Host
-      - traefik.http.middlewares.nextcloud_headers.headers.referrerPolicy=same-origin
-      - traefik.http.routers.nextcloud.middlewares=nextcloud_headers
-      - traefik.http.routers.nextcloud.rule=Host(`cloud.clps.ch`)
-      - traefik.http.routers.nextcloud.entrypoints=https
-      - traefik.http.routers.nextcloud.tls.certresolver=letsencrypt
-      - traefik.http.services.nextcloud.loadbalancer.server.port=11000
     ports:
-      - "8080:8080" # disable in prod
+      -  "8080:8080" # disable in prod
+      -  "8443:8443" # disable in prod
     volumes:
-      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
+      - "nextcloud_aio_mastercontainer:/mnt/docker-aio-config"
-      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+    depends_on:
+      -  traefik
+    restart: unless-stopped
 
 volumes:
   nextcloud_aio_mastercontainer:
-    name: nextcloud_aio_mastercontainer
   prom_data:

traefik/.gitignore

@@ -1 +0,0 @@
-acme.json

traefik/dynamic_conf.d/nextcloud.yml

@@ -0,0 +1,35 @@
+http:
+  routers:
+    nextcloud:
+      rule: "Host(`cloud.clps.ch`)"
+      entrypoints:
+        - "https"
+      service: nextcloud
+      middlewares:
+        - nextcloud-chain
+      tls:
+        certresolver: "letsencrypt"
+
+  services:
+    nextcloud:
+      loadBalancer:
+        servers:
+          - url: "http://nextcloud-aio-mastercontainer:11000" # Use the host's IP address if Traefik runs outside the host network
+
+  middlewares:
+    nextcloud-secure-headers:
+      headers:
+        hostsProxyHeaders:
+          - "X-Forwarded-Host"
+        referrerPolicy: "same-origin"
+
+    https-redirect:
+      redirectscheme:
+        scheme: https
+
+    nextcloud-chain:
+      chain:
+        middlewares:
+          # - ... (e.g. rate limiting middleware)
+          - https-redirect
+          - nextcloud-secure-headers

traefik/traefik.yml

@@ -0,0 +1,26 @@
+# STATIC CONFIGURATION
+
+entryPoints:
+  https:
+    address: ":443" # Create an entrypoint called "https" that uses port 443
+    # If you want to enable HTTP/3 support, uncomment the line below
+    # http3: {}
+  web:
+    address: ":80"
+
+certificatesResolvers:
+  # Define "letsencrypt" certificate resolver
+  letsencrypt:
+    acme:
+      storage: /letsencrypt/acme.json # Defines the path where certificates should be stored
+      email: "infra@clps.ch" #Where LE sends notification about certificates expiring
+      tlschallenge: true
+
+providers:
+  file:
+    directory: "/etc/traefik/dynamic_conf.d" # Adjust the path according your needs.
+    watch: true
+
+# Enable HTTP/3 feature by uncommenting the lines below. Don't forget to route 443 UDP to Traefik (Firewall\NAT\Traefik Container)
+# experimental:
+  # http3: true