update

2026-07-23 19:38:14 -04:00
parent 72272e4006
commit 84e1ead50c
283 changed files with 0 additions and 206 deletions
@@ -0,0 +1,56 @@
+services:
+  <%- if socket_proxy_enabled %>
+  << socket_proxy_service_name >>:
+    image: tecnativa/docker-socket-proxy:0.4.2
+    container_name: << socket_proxy_container_name >>
+    environment:
+      CONTAINERS: 1
+      EVENTS: 1
+      INFO: 1
+      NETWORKS: 1
+      PING: 1
+      POST: 0
+      SERVICES: 1
+      TASKS: 1
+      VERSION: 1
+      VOLUMES: 1
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - << traefik_network >>
+    restart: << restart_policy >>
+  <%- endif %>
+  <%- if whoami_enabled %>
+  << whoami_service_name >>:
+    image: traefik/whoami:v1.11.0
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=<< traefik_network >>
+      - traefik.http.services.<< whoami_service_name >>.loadbalancer.server.port=80
+      - traefik.http.routers.<< whoami_service_name >>-http.rule=Host(`<< whoami_host >>.<< whoami_domain >>`)
+      - traefik.http.routers.<< whoami_service_name >>-http.entrypoints=<< traefik_entrypoint >>
+      <%- if whoami_chain_middleware %>
+      - traefik.http.routers.<< whoami_service_name >>-http.middlewares=<< whoami_chain_middleware >>
+      <%- endif %>
+      <%- if whoami_tls_enabled %>
+      - traefik.http.routers.<< whoami_service_name >>-https.rule=Host(`<< whoami_host >>.<< whoami_domain >>`)
+      - traefik.http.routers.<< whoami_service_name >>-https.entrypoints=<< traefik_tls_entrypoint >>
+      - traefik.http.routers.<< whoami_service_name >>-https.tls=true
+      - traefik.http.routers.<< whoami_service_name >>-https.tls.certresolver=<< whoami_tls_certresolver >>
+      <%- if whoami_chain_middleware %>
+      - traefik.http.routers.<< whoami_service_name >>-https.middlewares=<< whoami_chain_middleware >>
+      <%- endif %>
+      <%- endif %>
+    networks:
+      - << traefik_network >>
+    restart: << restart_policy >>
+  <%- endif %>
+
+networks:
+  << traefik_network >>:
+    <%- if traefik_network_external %>
+    external: true
+    <%- else %>
+    driver: bridge
+    name: << traefik_network >>
+    <%- endif %>
@@ -0,0 +1,32 @@
+http:
+  middlewares:
+    default-secured:
+      chain:
+        middlewares:
+          <%- if security_headers_enabled %>
+          - security-headers
+          <%- endif %>
+          <%- if ipallowlist_enabled %>
+          - default-ipallowlist
+          <%- endif %>
+          <%- if crowdsec_middleware_enabled %>
+          - crowdsec-bouncer
+          <%- endif %>
+          <%- if forwardauth_enabled %>
+          - forward-auth
+          <%- endif %>
+    dashboard-secured:
+      chain:
+        middlewares:
+          <%- if security_headers_enabled %>
+          - security-headers
+          <%- endif %>
+          <%- if dashboard_basicauth_enabled %>
+          - dashboard-basicauth
+          <%- endif %>
+          <%- if ipallowlist_enabled %>
+          - dashboard-ipallowlist
+          <%- endif %>
+          <%- if crowdsec_middleware_enabled %>
+          - crowdsec-bouncer
+          <%- endif %>
@@ -0,0 +1,78 @@
+http:
+  middlewares:
+    <%- if security_headers_enabled %>
+    security-headers:
+      headers:
+        contentTypeNosniff: true
+        frameDeny: true
+        browserXssFilter: true
+        referrerPolicy: same-origin
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        customResponseHeaders:
+          X-Robots-Tag: none
+    <%- endif %>
+    <%- if dashboard_basicauth_enabled %>
+    dashboard-basicauth:
+      basicAuth:
+        users:
+          - << dashboard_basicauth_users >>
+    <%- endif %>
+    <%- if ipallowlist_enabled %>
+    dashboard-ipallowlist:
+      ipAllowList:
+        sourceRange:
+          - << ipallowlist_range_1 >>
+          <%- if ipallowlist_range_2 %>
+          - << ipallowlist_range_2 >>
+          <%- endif %>
+          <%- if ipallowlist_range_3 %>
+          - << ipallowlist_range_3 >>
+          <%- endif %>
+    default-ipallowlist:
+      ipAllowList:
+        sourceRange:
+          - << ipallowlist_range_1 >>
+          <%- if ipallowlist_range_2 %>
+          - << ipallowlist_range_2 >>
+          <%- endif %>
+          <%- if ipallowlist_range_3 %>
+          - << ipallowlist_range_3 >>
+          <%- endif %>
+    <%- endif %>
+    <%- if forwardauth_enabled %>
+    forward-auth:
+      forwardAuth:
+        address: "<< forwardauth_address >>"
+        trustForwardHeader: << forwardauth_trust_forward_header | lower >>
+        authResponseHeadersRegex: "<< forwardauth_response_headers_regex >>"
+    <%- endif %>
+    <%- if crowdsec_middleware_enabled %>
+    crowdsec-bouncer:
+      plugin:
+        crowdsec-bouncer-traefik-plugin:
+          enabled: true
+          crowdsecMode: << crowdsec_mode >>
+          crowdsecLapiScheme: http
+          crowdsecLapiHost: << crowdsec_lapi_host >>
+          crowdsecLapiKey: << crowdsec_bouncer_key >>
+          <%- if crowdsec_trusted_ip_1 or crowdsec_trusted_ip_2 or crowdsec_trusted_ip_3 %>
+          forwardedHeadersTrustedIPs:
+            <%- if crowdsec_trusted_ip_1 %>
+            - << crowdsec_trusted_ip_1 >>
+            <%- endif %>
+            <%- if crowdsec_trusted_ip_2 %>
+            - << crowdsec_trusted_ip_2 >>
+            <%- endif %>
+            <%- if crowdsec_trusted_ip_3 %>
+            - << crowdsec_trusted_ip_3 >>
+            <%- endif %>
+          <%- endif %>
+          crowdsecAppsecEnabled: << crowdsec_appsec_enabled | lower >>
+          <%- if crowdsec_appsec_enabled %>
+          crowdsecAppsecHost: << crowdsec_appsec_host >>
+          crowdsecAppsecFailureBlock: << crowdsec_appsec_failure_block | lower >>
+          crowdsecAppsecUnreachableBlock: << crowdsec_appsec_unreachable_block | lower >>
+          <%- endif %>
+    <%- endif %>