Traefik

compose.yaml

networks:
  default:
  traefik:
    external: true
    name: br_traefik_rp

services:
  traefik:
    image: traefik:v3.3
    container_name: traefik
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
      - 443:443/udp
    networks:
      - default
      - traefik
    environment:
      TZ: Europe/Paris
    volumes:
      - ./conf:/etc/traefik:rw
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      kveer.dns: traefik.kveer.fr
      traefik.http.routers.traefik.entryPoints: web-ssl
      traefik.http.routers.traefik.service: api@internal
      traefik.http.routers.traefik.middlewares: internal@file
    deploy:
      resources:
        reservations:
          memory: 6M
        limits:
          memory: 512M

~_conf_router.yaml

http:
  routers:
    adfs:
      entryPoints: [web-ssl]
      service: adfs
      rule: Host(`prout.kveer.fr`)
      middlewares: [adfs]
      tls:
        certResolver: main
    ping:
      entryPoints: [web-ssl]
      service: ping@internal
      rule: Host(`traefik.kveer.fr`) && PathPrefix(`/ping`)
      tls:
        certResolver: main
    service1:
      entryPoints: [web-ssl]
      service: service1
      rule: Host(`service1.kveer.fr`)
      middlewares: [source_fr]
      tls:
        certResolver: main
    service2:
      entryPoints: [web-ssl]
      service: service2
      rule: Host(`service2.kveer.fr`)
      middlewares: [source_fr]
      tls:
        certResolver: main
    service3:
      entryPoints: [web-ssl]
      service: service3
      rule: Host(`service3.kveer.fr`)
      middlewares: [source_fr]
      tls:
        certResolver: main

  middlewares:
    internal:
      ipAllowList:
        sourceRange:
          - "192.168.45.0/24"
    source_fr:
      ipAllowList:
        sourceRange:
          - 192.168.45.0/24
          - 2.3.0.0/16
          - 2.4.0.0/14
          - 2.8.0.0/13
          - 5.48.0.0/14
          - 31.32.0.0/13
          - 37.64.0.0/13
          - 46.35.0.0/19
          - 46.218.0.0/16
          - 62.8.0.0/19
          - 62.34.0.0/15
          - 62.39.0.0/16
          - 62.62.128.0/17
          - 62.106.128.0/17
          - 62.129.160.0/19
          - 62.147.0.0/16
          - 62.160.0.0/15
          - 62.201.128.0/19
          - 62.241.64.0/18
[...]
    httpsForced:
      redirectScheme:
        scheme: https
        permanent: true
    adfs:
      headers:
        customRequestHeaders:
          User-Agent: ""
          X-MS-Proxy: "192.168.45.34"
    defaultHttpsHeaders:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        #frameDeny: true
        customFrameOptionsValue: SAMEORIGIN
        browserXssFilter: true
        contentTypeNosniff: true
        referrerPolicy: strict-origin-when-cross-origin
        customResponseHeaders:
          Server: ""
    websocket:
      headers:
        customRequestHeaders:
          X-Forwarded-Proto: "https"
  services:
    adfs:
      loadBalancer:
        servers:
          - url: "https://prout.kveer.fr:443"
    service1:
      loadBalancer:
        servers:
          - url: http://truenas.home.kveer.fr:7878
    service2:
      loadBalancer:
        servers:
          - url: http://truenas.home.kveer.fr:8989
    service3:
      loadBalancer:
        servers:
          - url: http://truenas.home.kveer.fr:8112

  serversTransports:
    insecureTls:
      insecureSkipVerify: true

tls:
  options:
    default:
      minVersion: VersionTLS12
      sniStrict: true
      preferServerCipherSuites: true
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
      curvePreferences:
        - X25519
        - CurveP256
        - CurveP384
        - CurveP521
    mintls13:
      minVersion: VersionTLS13

~_conf_traefik.yaml

entryPoints:
  web:
    address: ":80"
  web-ssl:
    address: ":443"
    http:
      middlewares:
        - defaultHttpsHeaders@file
      tls:
        options: default
        certResolver: main
    http2:
    http3:
  nexus-docker:
    address: ":8482"
    http:
      middlewares:
        - defaultHttpsHeaders@file
      tls:
        options: default
        certResolver: main

serversTransport:
  insecureSkipVerify: true

api:
  dashboard: true

ping:
  entrypoint: web-ssl
  manualRouting: true

log:
  level: DEBUG

providers:
  file:
    filename: /etc/traefik/routers.yaml
    watch: true
  docker:
    exposedByDefault: true
    network: br_traefik_rp
    defaultRule: Host(`{{ index .Labels "kveer.dns" }}`)
    constraints: LabelRegex(`kveer.dns`, `.+`)
certificatesResolvers:
  main:
    acme:
      email: veovis_acme@kveer.fr
      storage: /etc/traefik/acme.json
      keyType: EC256
      tlsChallenge: {}