Compare commits
6 Commits
ce58685691
...
caddy-reva
| Author | SHA1 | Date | |
|---|---|---|---|
| abdd6c130e | |||
| fbdf91efbb | |||
| 39920fd1e6 | |||
| 2718e42ff8 | |||
| 27cd521a0f | |||
| 60dcae71ef |
@@ -12,7 +12,7 @@ Kubernetes has simply too much overhead for a small home lab like mine. I'm usin
|
|||||||
The only thing that would make me change idea would be a need for autoscaling, but I'm still far from that situation.
|
The only thing that would make me change idea would be a need for autoscaling, but I'm still far from that situation.
|
||||||
|
|
||||||
### How do I use this?
|
### How do I use this?
|
||||||
The `caddy-docker-proxy` is the first container that should be started, after running `$ docker network create caddy` to ensure the external network exists on the system. The `Caddyfile` included and mounted in `/etc/caddy/caddyfile` is used in this case to give access to the air-gapped comtainers running on different machines on the same network.
|
The `caddy-docker-proxy` is the first container that should be started, after running `$ docker network create caddy` to ensure the external network exists on the system. The `Caddyfile` included and mounted in `/etc/caddy/Caddyfile` is used in this case to give access to the air-gapped comtainers running on different machines on the same network. An example is found in the [Caddyfile](https://gitea.oddone.dev/Doddophonique/compose-personal-stack/src/branch/caddy-revamp/caddy-docker-proxy/Caddyfile), where the [Memos](https://gitea.oddone.dev/Doddophonique/compose-personal-stack/src/branch/caddy-revamp/memos/docker-compose.yml) container is exposed.
|
||||||
As you can see, this is a borderline situation where some people may prefer having service discovery with either Swarm or Kubernetes, but in my experience this is still not enough to call for that.
|
As you can see, this is a borderline situation where some people may prefer having service discovery with either Swarm or Kubernetes, but in my experience this is still not enough to call for that.
|
||||||
|
|
||||||
### Conclusion (for now):
|
### Conclusion (for now):
|
||||||
|
|||||||
@@ -11,3 +11,11 @@ subdomain.domain.tld {
|
|||||||
}
|
}
|
||||||
log
|
log
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# This is an example based on the docker-compose.yml contained
|
||||||
|
# in the memos folder
|
||||||
|
memos.domain.tld {
|
||||||
|
reverse_proxy 192.168.1.128:9000
|
||||||
|
encode zstd gzip
|
||||||
|
log
|
||||||
|
}
|
||||||
|
|||||||
53
memos/docker-compose.yml
Normal file
53
memos/docker-compose.yml
Normal file
@@ -0,0 +1,53 @@
|
|||||||
|
---
|
||||||
|
x-logging:
|
||||||
|
&default-logging
|
||||||
|
driver: syslog
|
||||||
|
options:
|
||||||
|
tag: "container_name/{{.Name}}"
|
||||||
|
labels: "LABEL"
|
||||||
|
syslog-facility: local7
|
||||||
|
|
||||||
|
x-opt-values:
|
||||||
|
&volume-opt
|
||||||
|
driver_opts: &options
|
||||||
|
type: "nfs"
|
||||||
|
o: "addr=${IP},rw"
|
||||||
|
|
||||||
|
services:
|
||||||
|
memos:
|
||||||
|
image: neosmemo/memos:stable
|
||||||
|
container_name: memos
|
||||||
|
# Use labels if this container is hosted on the same machine as
|
||||||
|
# the Caddy reverse proxy
|
||||||
|
labels:
|
||||||
|
caddy: ${MEMOS_HOSTNAME}
|
||||||
|
caddy.log:
|
||||||
|
caddy.encode: "zstd gzip"
|
||||||
|
caddy.reverse_proxy: "{{upstreams 5230}}"
|
||||||
|
restart: unless-stopped
|
||||||
|
# This is not needed if labels are used. If this container is
|
||||||
|
# hosted on a different machine under the same subnetwoork, use
|
||||||
|
# its private IP address instead of 192.168.1.128. Check the
|
||||||
|
# Caddyfile inside caddy-docker-proxy folder for an example
|
||||||
|
# on how to forward traffic to this container
|
||||||
|
#
|
||||||
|
# ports:
|
||||||
|
# - "192.168.1.128:9000:5230"
|
||||||
|
volumes:
|
||||||
|
- /mnt/path:/var/opt/memos
|
||||||
|
networks:
|
||||||
|
- caddy
|
||||||
|
logging: *default-logging
|
||||||
|
|
||||||
|
# Optional, needed if you are using an NFS server
|
||||||
|
#
|
||||||
|
# volumes:
|
||||||
|
# volume:
|
||||||
|
# <<: *volume-opt
|
||||||
|
# driver_opts:
|
||||||
|
# <<: *options
|
||||||
|
# device: ":/mnt/path"
|
||||||
|
|
||||||
|
networks:
|
||||||
|
caddy:
|
||||||
|
external: true
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
# File that has to be put under /etc/netdata/go.d/nginx.conf to monitor
|
|
||||||
# nginx_status
|
|
||||||
jobs:
|
|
||||||
- name: local
|
|
||||||
url: http://nginx-proxy/nginx_status
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
# Simple reverse proxy project name to simplify network referencing.
|
|
||||||
COMPOSE_PROJECT_NAME=rp
|
|
||||||
DEFAULT_EMAIL=""
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
# File to place in the conf/ directory of Nginx, to give other containers the
|
|
||||||
# capability of accessing Nginx status
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen ${proxy-container-name}:80;
|
|
||||||
server_name ${proxy-container-name};
|
|
||||||
location /nginx_status {
|
|
||||||
stub_status on;
|
|
||||||
allow all;
|
|
||||||
access_log on;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,78 +0,0 @@
|
|||||||
x-logging:
|
|
||||||
&default-logging
|
|
||||||
driver: syslog
|
|
||||||
options:
|
|
||||||
# This requires two files in /etc/rsyslog.d
|
|
||||||
# https://www.loggly.com/use-cases/docker-syslog-logging-and-troubleshooting/
|
|
||||||
tag: "container_name/{{.Name}}"
|
|
||||||
labels: "${hostname}"
|
|
||||||
syslog-facility: # cron, local7, etc.
|
|
||||||
|
|
||||||
# Can be removed if not needed
|
|
||||||
x-opt-values:
|
|
||||||
&volume-opt
|
|
||||||
driver_opts: &options
|
|
||||||
type: "nfs"
|
|
||||||
o: "addr=${IP},rw"
|
|
||||||
|
|
||||||
services:
|
|
||||||
nginx-proxy:
|
|
||||||
image: jwilder/nginx-proxy
|
|
||||||
container_name: proxy
|
|
||||||
labels:
|
|
||||||
com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
|
|
||||||
ports:
|
|
||||||
- "80:80"
|
|
||||||
- "443:443"
|
|
||||||
restart: always
|
|
||||||
volumes:
|
|
||||||
- conf:/etc/nginx/conf.d
|
|
||||||
- vhost:/etc/nginx/vhost.d
|
|
||||||
- passwords:/etc/nginx/htpasswd
|
|
||||||
- html:/usr/share/nginx/html
|
|
||||||
- certs:/etc/nginx/certs:ro
|
|
||||||
- /var/run/docker.sock:/tmp/docker.sock:ro
|
|
||||||
networks:
|
|
||||||
- reverse-proxy
|
|
||||||
logging: *default-logging
|
|
||||||
|
|
||||||
letsencrypt:
|
|
||||||
image: nginxproxy/acme-companion
|
|
||||||
container_name: letsencrypt
|
|
||||||
restart: always
|
|
||||||
volumes:
|
|
||||||
- conf:/etc/nginx/conf.d
|
|
||||||
- vhost:/etc/nginx/vhost.d
|
|
||||||
- html:/usr/share/nginx/html
|
|
||||||
- certs:/etc/nginx/certs:rw
|
|
||||||
- acme:/etc/acme.sh
|
|
||||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
||||||
environment:
|
|
||||||
NGINX_PROXY_CONTAINER: proxy
|
|
||||||
DEFAULT_EMAIL: ${DEFAULT_EMAIL}
|
|
||||||
networks:
|
|
||||||
- reverse-proxy
|
|
||||||
logging: *default-logging
|
|
||||||
|
|
||||||
networks:
|
|
||||||
reverse-proxy:
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
acme:
|
|
||||||
certs:
|
|
||||||
conf:
|
|
||||||
html:
|
|
||||||
passwords:
|
|
||||||
vhost:
|
|
||||||
|
|
||||||
# What if I want to use the x-opt-values:
|
|
||||||
# acme:
|
|
||||||
# <<: *volume-opt
|
|
||||||
# driver_opts:
|
|
||||||
# <<: *options
|
|
||||||
# device: ":/mnt/path/nginx-proxy/acme"
|
|
||||||
# o: "new_opts"
|
|
||||||
# type: "new_type"
|
|
||||||
#
|
|
||||||
# 'o' and 'type' can be redifined again or left at default
|
|
||||||
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
# https://learn.netdata.cloud/docs/agent/running-behind-nginx#enable-authentication
|
|
||||||
# Putting username and hashed password inside the htpasswd folder of
|
|
||||||
# jwilder/nginx-proxy activates the Basic auth for the domain you
|
|
||||||
# use as the filename of this file.
|
|
||||||
|
|
||||||
${username}:${hashed-password}
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
# https://docs.firefly-iii.org/firefly-iii/installation/docker/
|
|
||||||
# In the section "Docker and reverse proxies", this is suggested for Nginx.
|
|
||||||
# Put it in the vhost.d/ folder, with your domain and _location at the end
|
|
||||||
# as a filename.
|
|
||||||
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
proxy_set_header X-Forwarded-Host $host;
|
|
||||||
proxy_set_header X-Forwarded-Server $host;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
# https://learn.netdata.cloud/docs/agent/running-behind-nginx#ways-to-access-netdata-via-nginx
|
|
||||||
# Content suggested by Netdata documentation, excluding declarations that will
|
|
||||||
# be automatically populated by jwilder/nginx-proxy.
|
|
||||||
# To be placed in the vhost.d folder of Nginx, remember to put your domain as
|
|
||||||
# the filename with _location at the end.
|
|
||||||
|
|
||||||
proxy_set_header X-Forwarded-Host $host;
|
|
||||||
proxy_set_header X-Forwarded-Server $host;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_pass_request_headers on;
|
|
||||||
proxy_set_header Connection "keep-alive";
|
|
||||||
proxy_store off;
|
|
||||||
|
|
||||||
gzip on;
|
|
||||||
gzip_proxied any;
|
|
||||||
gzip_types *;
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
# Template file for the routes of Vaultwarden. To be placed in the vhost.d/
|
|
||||||
# folder of Nginx, substitute the name of the file with your domain.
|
|
||||||
|
|
||||||
location /admin {
|
|
||||||
return 404;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /notifications/hub {
|
|
||||||
proxy_pass http://${vaultwarden-container-name}:3012;
|
|
||||||
proxy_set_header Upgrade $http_upgrade;
|
|
||||||
proxy_set_header Connection "upgrade";
|
|
||||||
}
|
|
||||||
|
|
||||||
location /notifications/hub/negotiate {
|
|
||||||
proxy_pass http://${vaultwarden-container-name}:8080;
|
|
||||||
}
|
|
||||||
Reference in New Issue
Block a user