Michael Grote
28f22968da
Reviewed-on: #127
Co-authored-by: Michael Grote <michael.grote@posteo.de>
Co-committed-by: Michael Grote <michael.grote@posteo.de>
ci: testing deployment (#128)
Reviewed-on: #128
Co-authored-by: Michael Grote <michael.grote@posteo.de>
Co-committed-by: Michael Grote <michael.grote@posteo.de>
ci: test
ci: enable deployment
ci: set ssh-key for deployment
ci: debug
ci: deactivate ansible-lint temporarily
ci: deactivate ansible-galaxy temporarily
ci: debug ssh-key shell redirect
ci: base64
ci: debug
ci: debug
ci: fix output
Revert "ci: deactivate ansible-lint temporarily"
This reverts commit 6729342f26.
ci: fix vault-pass secret
pbs_integration: enable no_log
ci: debug ansible-vault
ci: debug
ci: ansible-vault + move to viczem.keepass (#130)
Reviewed-on: #130
Co-authored-by: Michael Grote <michael.grote@posteo.de>
Co-committed-by: Michael Grote <michael.grote@posteo.de>
ff
plugin umbennennugn
ff
67 lines
1.9 KiB
Django/Jinja
67 lines
1.9 KiB
Django/Jinja
version: '3'
|
|
services:
|
|
######## traefik ########
|
|
traefik:
|
|
container_name: traefik
|
|
image: "traefik:v3.0.4"
|
|
restart: always
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- ./traefik.yml:/etc/traefik/traefik.yml
|
|
- ./file-provider.yml:/etc/traefik/file-provider.yml
|
|
- acme_data:/etc/traefik/acme
|
|
networks:
|
|
- traefik
|
|
ports:
|
|
- "80:80" # HTTP
|
|
- "8081:8080" # Web-GUI
|
|
- "443:443" # HTTPS
|
|
- "2222:2222" # SSH
|
|
environment:
|
|
TZ: Europe/Berlin
|
|
healthcheck:
|
|
test: ["CMD", "traefik", "healthcheck", "--ping"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
|
|
######## nforwardauth ########
|
|
nforwardauth:
|
|
restart: always
|
|
image: "nosduco/nforwardauth:v1.4.0"
|
|
container_name: traefik-nforwardauth
|
|
environment:
|
|
TOKEN_SECRET: "{{ lookup('viczem.keepass.keepass', 'nforwardauth_token_secret', 'password') }}"
|
|
AUTH_HOST: auth.mgrote.net
|
|
labels:
|
|
traefik.enable: true
|
|
traefik.http.routers.nforwardauth.rule: Host(`auth.mgrote.net`)
|
|
|
|
traefik.http.middlewares.nforwardauth.forwardauth.address: http://nforwardauth:3000
|
|
|
|
traefik.http.services.nforwardauth.loadbalancer.server.port: 3000
|
|
traefik.http.routers.nforwardauth.tls: true
|
|
traefik.http.routers.nforwardauth.tls.certresolver: resolver_letsencrypt
|
|
traefik.http.routers.nforwardauth.entrypoints: entry_https
|
|
volumes:
|
|
- "./passwd:/passwd:ro" # Mount local passwd file at /passwd as read only
|
|
networks:
|
|
- traefik
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--spider", "--tries=1", "http://127.0.0.1:3000/login"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
|
|
######## Networks ########
|
|
networks:
|
|
traefik:
|
|
external: true
|
|
######## Volumes ########
|
|
volumes:
|
|
acme_data:
|
|
|
|
|
|
# passwd
|
|
# echo "<user>:$(mkpasswd -m sha-512 <password>)"
|