root
2a79ac8e63
Build & Deploy / Build & Push Docker Image (push) Failing after 11s
Build & Deploy / Deploy to VPS (push) Has been skipped
Test / Type Check (all packages) (push) Failing after 10s
Test / API Unit Tests (push) Has been skipped
Test / Homepage Unit Tests (push) Has been skipped
Test / Carplace Unit Tests (push) Has been skipped
Test / Admin Unit Tests (push) Has been skipped
Test / Dashboard Unit Tests (push) Has been skipped
Test / API Integration Tests (push) Has been skipped
84 lines
2.6 KiB
YAML
84 lines
2.6 KiB
YAML
services:
|
|
traefik:
|
|
# Set TRAEFIK_VERSION in .env to the exact version you are running.
|
|
# Do not use "latest" in production.
|
|
image: traefik:${TRAEFIK_VERSION}
|
|
command:
|
|
- --api.dashboard=false
|
|
- --api.insecure=false
|
|
- --providers.docker=true
|
|
- --providers.docker.exposedbydefault=false
|
|
- --providers.docker.network=traefik-proxy
|
|
- --providers.file.directory=/etc/traefik/dynamic
|
|
- --providers.file.watch=true
|
|
- --entrypoints.web.address=:80
|
|
- --entrypoints.websecure.address=:443
|
|
- --entrypoints.websecure.transport.respondingTimeouts.readTimeout=0
|
|
- --entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0
|
|
- --entrypoints.websecure.transport.respondingTimeouts.idleTimeout=1800s
|
|
- --entrypoints.web.http.redirections.entrypoint.to=websecure
|
|
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
|
- --certificatesresolvers.letsencrypt.acme.tlschallenge=true
|
|
- --certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}
|
|
- --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
|
|
restart: unless-stopped
|
|
ports:
|
|
- 80:80
|
|
- 443:443
|
|
volumes:
|
|
- traefik-letsencrypt:/letsencrypt
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- ./dynamic:/etc/traefik/dynamic:ro
|
|
networks:
|
|
- traefik-proxy
|
|
|
|
traefik-certs-dumper:
|
|
image: ldez/traefik-certs-dumper:v2.11.4
|
|
depends_on:
|
|
- traefik
|
|
restart: unless-stopped
|
|
# Wait for Traefik's ACME storage, then export certificates whenever
|
|
# acme.json changes.
|
|
entrypoint:
|
|
- /bin/sh
|
|
- -ec
|
|
command:
|
|
- |
|
|
until [ -s /data/acme.json ]; do
|
|
sleep 2
|
|
done
|
|
|
|
exec traefik-certs-dumper file \
|
|
--version v3 \
|
|
--watch \
|
|
--source /data/acme.json \
|
|
--dest /output \
|
|
--domain-subdir \
|
|
--crt-name fullchain \
|
|
--key-name privkey \
|
|
--crt-ext .pem \
|
|
--key-ext .pem
|
|
volumes:
|
|
# Existing Traefik ACME volume, mounted read-only.
|
|
- traefik-letsencrypt:/data:ro
|
|
|
|
# Normal certificate files will appear on the VPS here.
|
|
- ./exported-certs:/output
|
|
# The dumper only reads a local volume and writes exported files.
|
|
# It needs no network access.
|
|
network_mode: none
|
|
labels:
|
|
- "traefik.enable=false"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=16m,mode=1777
|
|
networks:
|
|
traefik-proxy:
|
|
external: true
|
|
volumes:
|
|
traefik-letsencrypt:
|