73cb274160
- Implement multi-server Traefik + Sablier architecture - Add label-based automatic service discovery - Create separate Sablier stack deployment - Add remote server deployment workflow (Option 3) - Add 9 new functions for multi-server management - Remove deprecated config-templates folder - Replace hardcoded private data with placeholders - Update backup timestamp format to YY_MM_DD_hh_mm - Add markup.yml to .gitignore Breaking changes: - Removed Sablier from core docker-compose.yml (now separate stack) - Config templates moved from config-templates/ to docker-compose/core/ - REQUIRED_VARS now dynamic based on deployment type
103 lines
3.5 KiB
YAML
103 lines
3.5 KiB
YAML
# Core Infrastructure Services
|
|
# RESTART POLICY GUIDE:
|
|
# - unless-stopped: Core infrastructure services that should always run
|
|
# - no: Services with Sablier lazy loading (start on-demand)
|
|
# - See individual service comments for specific reasoning
|
|
|
|
services:
|
|
|
|
duckdns:
|
|
# Dynamic DNS service - must always run to maintain domain resolution
|
|
image: lscr.io/linuxserver/duckdns:latest
|
|
container_name: duckdns
|
|
restart: unless-stopped
|
|
environment:
|
|
- PUID=1000
|
|
- PGID=1000
|
|
- TZ=America/New_York
|
|
- SUBDOMAINS=yourdomain
|
|
- TOKEN=your-duckdns-token
|
|
volumes:
|
|
- ./duckdns/config:/config
|
|
networks:
|
|
- traefik-network
|
|
|
|
traefik:
|
|
# Reverse proxy and SSL termination - core routing service, must always run
|
|
image: traefik:v3
|
|
container_name: traefik
|
|
restart: unless-stopped
|
|
command: ['--configFile=/config/traefik.yml']
|
|
environment:
|
|
- DUCKDNS_TOKEN=your-duckdns-token
|
|
ports:
|
|
- 80:80
|
|
- 443:443
|
|
- 8080:8080
|
|
volumes:
|
|
- ./traefik/config:/config
|
|
- ./traefik/letsencrypt:/letsencrypt
|
|
- ./traefik/dynamic:/dynamic
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
networks:
|
|
- traefik-network
|
|
labels:
|
|
# TRAEFIK CONFIGURATION
|
|
# ==========================================
|
|
# Service metadata
|
|
- 'homelab.category=core'
|
|
- 'homelab.description=Reverse proxy and SSL termination'
|
|
- 'traefik.enable=true'
|
|
- 'traefik.http.routers.traefik.rule=Host(`traefik.yourdomain.duckdns.org`)'
|
|
- 'traefik.http.routers.traefik.entrypoints=websecure'
|
|
- 'traefik.http.routers.traefik.tls.certresolver=letsencrypt'
|
|
- 'traefik.http.routers.traefik.middlewares=authelia@docker'
|
|
- 'traefik.http.services.traefik.loadbalancer.server.port=8080'
|
|
|
|
authelia:
|
|
# Single sign-on authentication service - must always run for user authentication
|
|
image: authelia/authelia:latest
|
|
container_name: authelia
|
|
restart: unless-stopped
|
|
environment:
|
|
- TZ=America/New_York
|
|
ports:
|
|
- '9091:9091'
|
|
volumes:
|
|
- ./authelia/config:/config
|
|
- ./authelia/secrets:/secrets
|
|
networks:
|
|
- traefik-network
|
|
depends_on:
|
|
- traefik
|
|
labels:
|
|
# TRAEFIK CONFIGURATION
|
|
# ==========================================
|
|
# Service metadata
|
|
- 'homelab.category=core'
|
|
- 'homelab.description=Single sign-on authentication'
|
|
# Traefik reverse proxy (comment/uncomment to disable/enable)
|
|
# If Traefik is on a remote server: these labels are NOT USED;
|
|
# configure external yml files in /traefik/dynamic folder instead.
|
|
- 'traefik.enable=true'
|
|
- 'traefik.http.routers.authelia.rule=Host(`auth.yourdomain.duckdns.org`)'
|
|
- 'traefik.http.routers.authelia.entrypoints=websecure'
|
|
- 'traefik.http.routers.authelia.tls.certresolver=letsencrypt'
|
|
- 'traefik.http.routers.authelia.service=authelia'
|
|
- 'traefik.http.services.authelia.loadbalancer.server.port=9091'
|
|
# Authelia forward auth middleware configuration
|
|
- 'traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.yourdomain.duckdns.org/'
|
|
- 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=X-Secret'
|
|
- 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true'
|
|
|
|
networks:
|
|
traefik-network:
|
|
external: true
|
|
|
|
x-dockge:
|
|
urls:
|
|
- https://auth.yourdomain.duckdns.org
|
|
- http://192.168.1.100:9091
|
|
- https://traefik.yourdomain.duckdns.org
|
|
- http://192.168.1.100:8080
|