docker-compose/minio/docker-compose.yml.j2

@@ -1,11 +1,11 @@
 services:
   minio:
-    image: minio/minio:latest # add to renovate; https://github.com/renovatebot/renovate/issues/2438
+    image: minio/minio:latest # TODO: add to renovate; https://github.com/renovatebot/renovate/issues/2438
     container_name: minio
     restart: unless-stopped
     pull_policy: missing
     ports:
-      # - '9000:9000' # S3
+      # - '9000:9000' # S3, nur über traefik
       - '9001:9001' # WebUI
     networks:
       - traefik
@@ -30,17 +30,6 @@ services:
       traefik.http.routers.minio-s3.tls.certresolver: resolver_letsencrypt
       traefik.http.routers.minio-s3.entrypoints: entry_https
       traefik.http.services.minio-s3.loadbalancer.server.port: 9000
-      # WebUI
-      # traefik.http.routers.minio-ui.service: minio-ui
-      # traefik.http.routers.minio-ui.priority: "20"
-      # traefik.http.routers.minio-ui.rule: Host(`ui-s3.mgrote.net`)
-      # traefik.http.routers.minio-ui.tls: true
-      # traefik.http.routers.minio-ui.tls.certresolver: resolver_letsencrypt
-      # traefik.http.routers.minio-ui.entrypoints: entry_https
-      # traefik.http.services.minio-ui.loadbalancer.server.port: 9001
-      # traefik.http.routers.minio-ui.middlewares: minio-ui-ipallowlist # also entferne den Prefix danach wieder
-      # traefik.http.middlewares.minio-ui-ipallowlist.ipallowlist.sourcerange: 192.168.2.0/24,10.25.25.0/24
-      # traefik.http.middlewares.minio-ui-ipallowlist.ipallowlist.ipstrategy.depth: 0 # https://doc.traefik.io/traefik/middlewares/http/ipallowlist/#ipstrategydepth
 
 ######## Networks ########
 networks:

docker-compose/registry/docker-compose.yml.j2

@@ -38,10 +38,7 @@ services:
       traefik.http.routers.registry.entrypoints: entry_https
       traefik.http.services.registry.loadbalancer.server.port: 5000
 
-      traefik.http.routers.registry.middlewares: registry-ipallowlist,ratelimit40
+      traefik.http.routers.registry.middlewares: registry-ipallowlist,ratelimit40,allowlist_localnet
-
-      traefik.http.middlewares.registry-ipallowlist.ipallowlist.sourcerange: 192.168.2.0/24,10.25.25.0/24,192.168.48.0/24,172.18.0.0/16 # .48. ist Docker
-      traefik.http.middlewares.registry-ipallowlist.ipallowlist.ipstrategy.depth: 0 # https://doc.traefik.io/traefik/middlewares/http/ipallowlist/#ipstrategydepth
 
     # registry aufräumen: docker exec -it oci-registry /bin/registry garbage-collect /etc/docker/registry/config.yml
 
@@ -92,16 +89,13 @@ services:
       retries: 3
     labels:
       traefik.http.routers.registry-ui.rule: Host(`rui.mgrote.net`)
-      traefik.http.routers.registry-ui.middlewares: authelia,registry-ui-ipallowlist,ratelimit40
+      traefik.http.routers.registry-ui.middlewares: authelia,allowlist_localnet,ratelimit40
       traefik.enable: true
       traefik.http.routers.registry-ui.tls: true
       traefik.http.routers.registry-ui.tls.certresolver: resolver_letsencrypt
       traefik.http.routers.registry-ui.entrypoints: entry_https
       traefik.http.services.registry-ui.loadbalancer.server.port: 80
 
-      traefik.http.middlewares.registry-ui-ipallowlist.ipallowlist.sourcerange: 192.168.2.0/24,10.25.25.0/24 # .48. ist Docker
-      traefik.http.middlewares.registry-ui-ipallowlist.ipallowlist.ipstrategy.depth: 0 # https://doc.traefik.io/traefik/middlewares/http/ipallowlist/#ipstrategydepth
-
 ######## Networks ########
 networks:
   traefik:

docker-compose/traefik/file-provider.yml

@@ -26,3 +26,12 @@ http:
         sourceCriterion:
           ipStrategy:
             depth: 2
+    allowlist_localnet:
+      ipallowlist:
+        sourcerange:
+          - 192.168.2.0/24
+          - 10.25.25.0/24
+          - 192.168.48.0/24 # docker
+          #- 172.18.0.0/16  # ???
+        ipstrategy:
+          depth: 0 # https://doc.traefik.io/traefik/middlewares/http/ipallowlist/#ipstrategydepth