525 lines
15 KiB
JSON
525 lines
15 KiB
JSON
{
|
|
"slug": "traefik-addons",
|
|
"kind": "compose",
|
|
"metadata": {
|
|
"name": "Traefik Addons",
|
|
"description": "Companion Docker Compose stack for the main Traefik template, with a docker-socket-proxy, a whoami test app, and file-provider middleware examples for hardening and external auth.",
|
|
"tags": [
|
|
"traefik",
|
|
"security",
|
|
"docker"
|
|
],
|
|
"icon": {
|
|
"provider": "selfhst",
|
|
"id": "traefik"
|
|
},
|
|
"draft": true,
|
|
"version": {
|
|
"name": "2026.04.13",
|
|
"source_dep_name": "manual/traefik-addons"
|
|
}
|
|
},
|
|
"variables": [
|
|
{
|
|
"title": "General",
|
|
"name": "general",
|
|
"items": [
|
|
{
|
|
"name": "restart_policy",
|
|
"type": "enum",
|
|
"title": "Restart Policy",
|
|
"required": true,
|
|
"default": "unless-stopped",
|
|
"config": {
|
|
"options": [
|
|
"unless-stopped",
|
|
"always",
|
|
"on-failure",
|
|
"no"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "Traefik",
|
|
"name": "traefik",
|
|
"items": [
|
|
{
|
|
"name": "traefik_network",
|
|
"type": "str",
|
|
"title": "Traefik Network",
|
|
"required": true,
|
|
"default": "traefik",
|
|
"description": "Shared Docker network used by the main Traefik stack.",
|
|
"config": {
|
|
"placeholder": "traefik"
|
|
}
|
|
},
|
|
{
|
|
"name": "traefik_network_external",
|
|
"type": "bool",
|
|
"title": "External Network",
|
|
"required": false,
|
|
"default": true
|
|
},
|
|
{
|
|
"name": "traefik_entrypoint",
|
|
"type": "str",
|
|
"title": "Entrypoint",
|
|
"required": true,
|
|
"default": "web",
|
|
"config": {
|
|
"placeholder": "web"
|
|
},
|
|
"needs": [
|
|
"whoami_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "traefik_tls_entrypoint",
|
|
"type": "str",
|
|
"title": "TLS Entrypoint",
|
|
"required": true,
|
|
"default": "websecure",
|
|
"config": {
|
|
"placeholder": "websecure"
|
|
},
|
|
"needs": [
|
|
"whoami_enabled=true",
|
|
"whoami_tls_enabled=true"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "Socket Proxy",
|
|
"toggle": "socket_proxy_enabled",
|
|
"name": "socket-proxy",
|
|
"items": [
|
|
{
|
|
"name": "socket_proxy_enabled",
|
|
"type": "bool",
|
|
"title": "Docker Socket Proxy",
|
|
"required": false,
|
|
"default": true,
|
|
"description": "Run a restricted Docker socket proxy for Traefik and companion tooling."
|
|
},
|
|
{
|
|
"name": "socket_proxy_service_name",
|
|
"type": "str",
|
|
"title": "Socket Proxy Service Name",
|
|
"required": true,
|
|
"default": "docker-socket-proxy",
|
|
"description": "Compose service name for the docker-socket-proxy.",
|
|
"needs": [
|
|
"socket_proxy_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "docker-socket-proxy"
|
|
}
|
|
},
|
|
{
|
|
"name": "socket_proxy_container_name",
|
|
"type": "str",
|
|
"title": "Socket Proxy Container Name",
|
|
"required": true,
|
|
"default": "docker-socket-proxy",
|
|
"description": "Container name for the docker-socket-proxy service.",
|
|
"needs": [
|
|
"socket_proxy_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "docker-socket-proxy"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "Whoami",
|
|
"toggle": "whoami_enabled",
|
|
"name": "whoami",
|
|
"items": [
|
|
{
|
|
"name": "whoami_enabled",
|
|
"type": "bool",
|
|
"title": "Whoami Test App",
|
|
"required": false,
|
|
"default": true,
|
|
"description": "Deploy a small Traefik-routed test application."
|
|
},
|
|
{
|
|
"name": "whoami_service_name",
|
|
"type": "str",
|
|
"title": "Whoami Service Name",
|
|
"required": true,
|
|
"default": "whoami",
|
|
"description": "Compose service name for the whoami test container.",
|
|
"needs": [
|
|
"whoami_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "whoami"
|
|
}
|
|
},
|
|
{
|
|
"name": "whoami_host",
|
|
"type": "str",
|
|
"title": "Whoami Host",
|
|
"required": true,
|
|
"default": "whoami",
|
|
"needs": [
|
|
"whoami_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "whoami"
|
|
}
|
|
},
|
|
{
|
|
"name": "whoami_domain",
|
|
"type": "str",
|
|
"title": "Whoami Domain",
|
|
"required": true,
|
|
"default": "home.arpa",
|
|
"needs": [
|
|
"whoami_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "home.arpa"
|
|
}
|
|
},
|
|
{
|
|
"name": "whoami_tls_enabled",
|
|
"type": "bool",
|
|
"title": "Whoami TLS",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Create an HTTPS router for the whoami test route.",
|
|
"needs": [
|
|
"whoami_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "whoami_tls_certresolver",
|
|
"type": "str",
|
|
"title": "Whoami Cert Resolver",
|
|
"required": true,
|
|
"default": "cloudflare",
|
|
"description": "Traefik certificate resolver used for the HTTPS whoami router.",
|
|
"needs": [
|
|
"whoami_enabled=true",
|
|
"whoami_tls_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "cloudflare"
|
|
}
|
|
},
|
|
{
|
|
"name": "whoami_chain_middleware",
|
|
"type": "str",
|
|
"title": "Whoami Chain Middleware",
|
|
"required": false,
|
|
"default": "default-secured@file",
|
|
"description": "File-provider middleware chain attached to the whoami routers.",
|
|
"needs": [
|
|
"whoami_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "default-secured@file"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "Dashboard Hardening",
|
|
"name": "dashboard-hardening",
|
|
"items": [
|
|
{
|
|
"name": "security_headers_enabled",
|
|
"type": "bool",
|
|
"title": "Security Headers",
|
|
"required": false,
|
|
"default": true,
|
|
"description": "Render a reusable security-headers middleware."
|
|
},
|
|
{
|
|
"name": "dashboard_basicauth_enabled",
|
|
"type": "bool",
|
|
"title": "Dashboard BasicAuth",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Render a BasicAuth middleware suitable for dashboard protection."
|
|
},
|
|
{
|
|
"name": "dashboard_basicauth_users",
|
|
"type": "secret",
|
|
"title": "BasicAuth Users",
|
|
"required": true,
|
|
"description": "One htpasswd entry to render into the dashboard BasicAuth middleware.",
|
|
"needs": [
|
|
"dashboard_basicauth_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "ipallowlist_enabled",
|
|
"type": "bool",
|
|
"title": "IP Allowlist",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Render IP allowlist middlewares for restricted dashboards or internal apps."
|
|
},
|
|
{
|
|
"name": "ipallowlist_range_1",
|
|
"type": "str",
|
|
"title": "Allowlist Range 1",
|
|
"required": true,
|
|
"default": "192.168.0.0/16",
|
|
"description": "Primary CIDR allowed through the IP allowlist middleware.",
|
|
"needs": [
|
|
"ipallowlist_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "192.168.0.0/16"
|
|
}
|
|
},
|
|
{
|
|
"name": "ipallowlist_range_2",
|
|
"type": "str",
|
|
"title": "Allowlist Range 2",
|
|
"required": false,
|
|
"default": "10.0.0.0/8",
|
|
"description": "Optional second CIDR allowed through the IP allowlist middleware.",
|
|
"needs": [
|
|
"ipallowlist_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "10.0.0.0/8"
|
|
}
|
|
},
|
|
{
|
|
"name": "ipallowlist_range_3",
|
|
"type": "str",
|
|
"title": "Allowlist Range 3",
|
|
"required": false,
|
|
"default": "",
|
|
"description": "Optional third CIDR allowed through the IP allowlist middleware.",
|
|
"needs": [
|
|
"ipallowlist_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "fd00::/8"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "ForwardAuth",
|
|
"toggle": "forwardauth_enabled",
|
|
"name": "forwardauth",
|
|
"items": [
|
|
{
|
|
"name": "forwardauth_enabled",
|
|
"type": "bool",
|
|
"title": "ForwardAuth",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Render a ForwardAuth middleware for Authentik, Authelia, or another auth proxy."
|
|
},
|
|
{
|
|
"name": "forwardauth_address",
|
|
"type": "str",
|
|
"title": "ForwardAuth Address",
|
|
"required": true,
|
|
"default": "https://auth.home.arpa/outpost.goauthentik.io/auth/traefik",
|
|
"description": "ForwardAuth endpoint Traefik should call for authentication.",
|
|
"needs": [
|
|
"forwardauth_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "https://auth.home.arpa/outpost.goauthentik.io/auth/traefik"
|
|
}
|
|
},
|
|
{
|
|
"name": "forwardauth_trust_forward_header",
|
|
"type": "bool",
|
|
"title": "Trust Forwarded Headers",
|
|
"required": false,
|
|
"default": true,
|
|
"description": "Trust existing forwarded headers when calling the ForwardAuth endpoint.",
|
|
"needs": [
|
|
"forwardauth_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "forwardauth_response_headers_regex",
|
|
"type": "str",
|
|
"title": "Auth Response Headers Regex",
|
|
"required": false,
|
|
"default": "^X-authentik-.*",
|
|
"description": "Regex of headers copied back from the auth response.",
|
|
"needs": [
|
|
"forwardauth_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "^X-authentik-.*"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"title": "CrowdSec Middleware",
|
|
"toggle": "crowdsec_middleware_enabled",
|
|
"name": "crowdsec",
|
|
"items": [
|
|
{
|
|
"name": "crowdsec_middleware_enabled",
|
|
"type": "bool",
|
|
"title": "CrowdSec Middleware",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Render the Traefik CrowdSec plugin middleware example."
|
|
},
|
|
{
|
|
"name": "crowdsec_lapi_host",
|
|
"type": "str",
|
|
"title": "CrowdSec LAPI Host",
|
|
"required": true,
|
|
"default": "crowdsec:8080",
|
|
"description": "CrowdSec Local API host and port reachable from Traefik.",
|
|
"needs": [
|
|
"crowdsec_middleware_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "crowdsec:8080"
|
|
}
|
|
},
|
|
{
|
|
"name": "crowdsec_bouncer_key",
|
|
"type": "secret",
|
|
"title": "CrowdSec Bouncer Key",
|
|
"required": true,
|
|
"description": "API key for the Traefik CrowdSec remediation component.",
|
|
"needs": [
|
|
"crowdsec_middleware_enabled=true"
|
|
],
|
|
"config": {
|
|
"autogenerated": {
|
|
"length": 32
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"name": "crowdsec_mode",
|
|
"type": "enum",
|
|
"title": "CrowdSec Mode",
|
|
"required": true,
|
|
"default": "stream",
|
|
"description": "CrowdSec plugin mode used by Traefik.",
|
|
"needs": [
|
|
"crowdsec_middleware_enabled=true"
|
|
],
|
|
"config": {
|
|
"options": [
|
|
"live",
|
|
"stream",
|
|
"alone",
|
|
"appsec"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"name": "crowdsec_appsec_enabled",
|
|
"type": "bool",
|
|
"title": "CrowdSec AppSec",
|
|
"required": false,
|
|
"default": false,
|
|
"needs": [
|
|
"crowdsec_middleware_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "crowdsec_appsec_host",
|
|
"type": "str",
|
|
"title": "CrowdSec AppSec Host",
|
|
"required": true,
|
|
"default": "crowdsec:7422",
|
|
"description": "CrowdSec AppSec host and port reachable from Traefik.",
|
|
"needs": [
|
|
"crowdsec_middleware_enabled=true",
|
|
"crowdsec_appsec_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "crowdsec:7422"
|
|
}
|
|
},
|
|
{
|
|
"name": "crowdsec_appsec_failure_block",
|
|
"type": "bool",
|
|
"title": "Block On AppSec Failure",
|
|
"required": false,
|
|
"default": true,
|
|
"description": "Block requests if CrowdSec AppSec returns an internal error.",
|
|
"needs": [
|
|
"crowdsec_middleware_enabled=true",
|
|
"crowdsec_appsec_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "crowdsec_appsec_unreachable_block",
|
|
"type": "bool",
|
|
"title": "Block When AppSec Unreachable",
|
|
"required": false,
|
|
"default": false,
|
|
"description": "Block requests if CrowdSec AppSec cannot be reached.",
|
|
"needs": [
|
|
"crowdsec_middleware_enabled=true",
|
|
"crowdsec_appsec_enabled=true"
|
|
]
|
|
},
|
|
{
|
|
"name": "crowdsec_trusted_ip_1",
|
|
"type": "str",
|
|
"title": "Trusted IP 1",
|
|
"required": false,
|
|
"default": "10.0.0.0/8",
|
|
"description": "Optional trusted upstream CIDR for forwarded headers.",
|
|
"needs": [
|
|
"crowdsec_middleware_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "10.0.0.0/8"
|
|
}
|
|
},
|
|
{
|
|
"name": "crowdsec_trusted_ip_2",
|
|
"type": "str",
|
|
"title": "Trusted IP 2",
|
|
"required": false,
|
|
"default": "192.168.0.0/16",
|
|
"description": "Optional second trusted CIDR for forwarded headers.",
|
|
"needs": [
|
|
"crowdsec_middleware_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "192.168.0.0/16"
|
|
}
|
|
},
|
|
{
|
|
"name": "crowdsec_trusted_ip_3",
|
|
"type": "str",
|
|
"title": "Trusted IP 3",
|
|
"required": false,
|
|
"default": "",
|
|
"description": "Optional third trusted CIDR for forwarded headers.",
|
|
"needs": [
|
|
"crowdsec_middleware_enabled=true"
|
|
],
|
|
"config": {
|
|
"placeholder": "fd00::/8"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|