Fix homepage Traefik network routing and update configurations
- Add traefik.docker.network=traefik-network label to homepage service - Prevent Traefik from using wrong IP from homelab-network - Resolve 504 Gateway Timeout issues after authentication - Update various docker-compose configurations and templates - Clean up unused configuration files
This commit is contained in:
EZ-Homelab Assistant
294
docker-compose/infrastructure/docker-compose.yml.template
Normal file
294
docker-compose/infrastructure/docker-compose.yml.template
Normal file
@@ -0,0 +1,294 @@
|
||||
# Infrastructure Services
|
||||
# Core services that other services depend on
|
||||
# Place in /opt/stacks/infrastructure/docker-compose.yml
|
||||
|
||||
# SABLIER SESSION DURATION: Set to 5m for testing. Increase to 30m for production in config-templates/traefik/dynamic/sablier.yml
|
||||
|
||||
# RESTART POLICY GUIDE:
|
||||
# - unless-stopped: Core infrastructure services that should always run
|
||||
# - no: Services with Sablier lazy loading (start on-demand)
|
||||
# - See individual service comments for specific reasoning
|
||||
|
||||
services:
|
||||
dockerproxy:
|
||||
# Docker socket proxy for security - provides safe Docker API access, must always run
|
||||
# REQUIREMENTS FOR SABLIER INTEGRATION:
|
||||
# 1. Docker daemon must be configured to listen on TCP port 2375 (not just unix socket)
|
||||
# 2. Firewall must allow access to port 2375 from Sablier service
|
||||
# 3. Docker daemon config should include: "hosts": ["tcp://0.0.0.0:2375", "unix:///var/run/docker.sock"]
|
||||
# 4. For security, consider restricting access to specific IP ranges or using TLS
|
||||
# 5. dockerproxy runs for additional security but doesn't expose port 2375 (handled by Docker daemon)
|
||||
image: tecnativa/docker-socket-proxy:latest
|
||||
container_name: dockerproxy
|
||||
privileged: true
|
||||
restart: unless-stopped
|
||||
# Note: Port 2375 is handled directly by Docker daemon for Sablier access
|
||||
# dockerproxy provides additional security features but doesn't expose the port
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
environment:
|
||||
- CONTAINERS=1
|
||||
- SERVICES=1
|
||||
- TASKS=1
|
||||
- NETWORKS=1
|
||||
- NODES=1
|
||||
- EXEC=1
|
||||
- IMAGES=1
|
||||
- VOLUMES=1
|
||||
- SWARM=1
|
||||
labels:
|
||||
- homelab.category=infrastructure
|
||||
- homelab.description=Docker socket proxy for security
|
||||
|
||||
# Pi-hole - Network-wide ad blocker and DNS server
|
||||
# Access at: https://pihole.${DOMAIN}
|
||||
# DNS service must always run for network-wide ad blocking
|
||||
pihole:
|
||||
image: pihole/pihole:2024.01.0
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.25'
|
||||
memory: 128M
|
||||
pids: 256
|
||||
reservations:
|
||||
cpus: '0.10'
|
||||
memory: 64M
|
||||
container_name: pihole
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- homelab-network
|
||||
- traefik-network
|
||||
ports:
|
||||
- "53:53/tcp" # DNS TCP
|
||||
- "53:53/udp" # DNS UDP
|
||||
volumes:
|
||||
- ./pihole/etc-pihole:/etc/pihole
|
||||
- ./pihole/etc-dnsmasq.d:/etc/dnsmasq.d
|
||||
environment:
|
||||
- TZ=${TZ}
|
||||
- WEBPASSWORD=${PIHOLE_PASSWORD}
|
||||
- FTLCONF_LOCAL_IPV4=${SERVER_IP}
|
||||
dns:
|
||||
- 127.0.0.1
|
||||
- 1.1.1.1
|
||||
cap_add:
|
||||
- NET_ADMIN
|
||||
labels:
|
||||
# TRAEFIK CONFIGURATION
|
||||
# ==========================================
|
||||
# Service metadata
|
||||
- "homelab.category=infrastructure"
|
||||
- "homelab.description=Network-wide ad blocking and DNS"
|
||||
# Traefik reverse proxy (comment/uncomment to disable/enable)
|
||||
# IMPORTANT: On REMOTE SERVERS (where Traefik runs elsewhere):
|
||||
# - COMMENT OUT all traefik.* labels below (don't delete them)
|
||||
# - Routes are configured via external YAML files on the core server
|
||||
# - This prevents conflicts between Docker labels and file provider
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.pihole.rule=Host(`pihole.${DOMAIN}`)"
|
||||
- "traefik.http.routers.pihole.entrypoints=websecure"
|
||||
- "traefik.http.routers.pihole.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.pihole.middlewares=authelia@docker"
|
||||
- "traefik.http.services.pihole.loadbalancer.server.port=80"
|
||||
|
||||
# Watchtower - Automatic container updates
|
||||
# Monitors and updates Docker containers to latest versions
|
||||
# Runs daily at 4 AM
|
||||
watchtower:
|
||||
image: containrrr/watchtower:latest
|
||||
container_name: watchtower
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- homelab-network
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
environment:
|
||||
- DOCKER_API_VERSION=1.52
|
||||
- WATCHTOWER_CLEANUP=true
|
||||
- WATCHTOWER_INCLUDE_RESTARTING=true
|
||||
- WATCHTOWER_SCHEDULE=0 0 4 * * * # 4 AM daily
|
||||
- WATCHTOWER_NOTIFICATIONS=shoutrrr
|
||||
- WATCHTOWER_NOTIFICATION_URL=${WATCHTOWER_NOTIFICATION_URL}
|
||||
labels:
|
||||
- "homelab.category=infrastructure"
|
||||
- "homelab.description=Automatic Docker container updates"
|
||||
|
||||
# Dozzle - Real-time Docker log viewer
|
||||
# Access at: https://dozzle.${DOMAIN}
|
||||
# Uses Sablier lazy loading - starts on-demand, stops after 5min inactivity
|
||||
dozzle:
|
||||
image: amir20/dozzle:latest
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 256M
|
||||
pids: 512
|
||||
reservations:
|
||||
cpus: '0.25'
|
||||
memory: 128M
|
||||
container_name: dozzle
|
||||
restart: no
|
||||
networks:
|
||||
- homelab-network
|
||||
- traefik-network
|
||||
ports:
|
||||
- "8085:8080"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
environment:
|
||||
- DOZZLE_LEVEL=info
|
||||
- DOZZLE_TAILSIZE=300
|
||||
- DOZZLE_FILTER=status=running
|
||||
healthcheck:
|
||||
test: ["CMD", "/dozzle", "healthcheck"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 30s
|
||||
labels:
|
||||
# TRAEFIK CONFIGURATION
|
||||
# Service metadata
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
- "homelab.category=infrastructure"
|
||||
- "homelab.description=Real-time Docker log viewer"
|
||||
- "traefik.enable=true"
|
||||
# Router configuration
|
||||
- "traefik.http.routers.dozzle.rule=Host(`dozzle.${SERVER_HOSTNAME}.${DOMAIN}`)"
|
||||
- "traefik.http.routers.dozzle.entrypoints=websecure"
|
||||
- "traefik.http.routers.dozzle.tls=true"
|
||||
- "traefik.http.routers.dozzle.middlewares=authelia@docker"
|
||||
# Service configuration
|
||||
- "traefik.http.services.dozzle.loadbalancer.server.port=8085"
|
||||
# Sablier configuration
|
||||
- "sablier.enable=true"
|
||||
- "sablier.group=${SERVER_HOSTNAME}-dozzle"
|
||||
- "sablier.start-on-demand=true"
|
||||
|
||||
# Glances - System monitoring
|
||||
# Access at: https://glances.${DOMAIN}
|
||||
# Uses Sablier lazy loading - starts on-demand, stops after 30min inactivity
|
||||
glances:
|
||||
image: nicolargo/glances:latest-full
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 256M
|
||||
pids: 512
|
||||
reservations:
|
||||
cpus: '0.25'
|
||||
memory: 128M
|
||||
container_name: glances
|
||||
restart: no
|
||||
networks:
|
||||
- homelab-network
|
||||
- traefik-network
|
||||
ports:
|
||||
- "61208:61208"
|
||||
pid: host
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- ./glances/config:/glances/conf
|
||||
environment:
|
||||
- GLANCES_OPT=-w
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:61208/"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 30s
|
||||
labels:
|
||||
# TRAEFIK CONFIGURATION
|
||||
# Service metadata
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
- "homelab.category=infrastructure"
|
||||
- "homelab.description=System and Docker monitoring"
|
||||
- "traefik.enable=true"
|
||||
# Router configuration
|
||||
- "traefik.http.routers.glances.rule=Host(`glances.${SERVER_HOSTNAME}.${DOMAIN}`)"
|
||||
- "traefik.http.routers.glances.entrypoints=websecure"
|
||||
- "traefik.http.routers.glances.tls=true"
|
||||
- "traefik.http.routers.glances.middlewares=authelia@docker"
|
||||
# Service configuration
|
||||
- "traefik.http.services.glances.loadbalancer.server.port=61208"
|
||||
# Sablier configuration
|
||||
- "sablier.enable=true"
|
||||
- "sablier.group=${SERVER_HOSTNAME}-glances"
|
||||
- "sablier.start-on-demand=true"
|
||||
|
||||
# Code Server - VS Code in browser
|
||||
# Access at: https://code.${DOMAIN}
|
||||
# Uses Sablier lazy loading - starts on-demand, stops after 30min inactivity
|
||||
code-server:
|
||||
image: lscr.io/linuxserver/code-server:latest
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '1.5'
|
||||
memory: 1G
|
||||
pids: 2048
|
||||
reservations:
|
||||
cpus: '0.75'
|
||||
memory: 512M
|
||||
container_name: code-server
|
||||
restart: no
|
||||
networks:
|
||||
- homelab-network
|
||||
- traefik-network
|
||||
ports:
|
||||
- "8079:8443"
|
||||
volumes:
|
||||
- ./code-server/config:/config
|
||||
- /opt/stacks:/opt/stacks # Access to all stacks
|
||||
- /mnt:/mnt:ro # Read-only access to data
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- PASSWORD=${CODE_SERVER_PASSWORD}
|
||||
- SUDO_PASSWORD=${CODE_SERVER_SUDO_PASSWORD}
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:8443/"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 60s
|
||||
labels:
|
||||
# TRAEFIK CONFIGURATION
|
||||
# Service metadata
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
- "homelab.category=infrastructure"
|
||||
- "homelab.description=VS Code in browser"
|
||||
- "traefik.enable=true"
|
||||
# Router configuration
|
||||
- "traefik.http.routers.code-server.rule=Host(`code.${DOMAIN}`)"
|
||||
- "traefik.http.routers.code-server.entrypoints=websecure"
|
||||
- "traefik.http.routers.code-server.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.code-server.middlewares=authelia@docker"
|
||||
# Service configuration
|
||||
- "traefik.http.services.code-server.loadbalancer.server.port=8443"
|
||||
# Sablier configuration
|
||||
- "sablier.enable=true"
|
||||
- "sablier.group=${SERVER_HOSTNAME}-code-server"
|
||||
- "sablier.start-on-demand=true"
|
||||
|
||||
x-dockge:
|
||||
urls:
|
||||
- https://pihole.${DOMAIN}
|
||||
- https://${SERVER_IP}:53
|
||||
- https://dozzle.${DOMAIN}
|
||||
- https://${SERVER_IP}:8085
|
||||
- https://glances.${DOMAIN}
|
||||
- https://${SERVER_IP}:61208
|
||||
- https://code.${DOMAIN}
|
||||
- https://${SERVER_IP}:8079
|
||||
- http://${SERVER_IP}:2375 # Docker Proxy
|
||||
- http://${SERVER_IP}:19999 # Netdata
|
||||
|
||||
networks:
|
||||
homelab-network:
|
||||
external: true
|
||||
traefik-network:
|
||||
external: true
|
||||
Reference in New Issue
Block a user