Compare commits
6 Commits
ce58685691
...
caddy-reva
| Author | SHA1 | Date | |
|---|---|---|---|
| abdd6c130e | |||
| fbdf91efbb | |||
| 39920fd1e6 | |||
| 2718e42ff8 | |||
| 27cd521a0f | |||
| 60dcae71ef |
@@ -12,7 +12,7 @@ Kubernetes has simply too much overhead for a small home lab like mine. I'm usin
|
||||
The only thing that would make me change idea would be a need for autoscaling, but I'm still far from that situation.
|
||||
|
||||
### How do I use this?
|
||||
The `caddy-docker-proxy` is the first container that should be started, after running `$ docker network create caddy` to ensure the external network exists on the system. The `Caddyfile` included and mounted in `/etc/caddy/caddyfile` is used in this case to give access to the air-gapped comtainers running on different machines on the same network.
|
||||
The `caddy-docker-proxy` is the first container that should be started, after running `$ docker network create caddy` to ensure the external network exists on the system. The `Caddyfile` included and mounted in `/etc/caddy/Caddyfile` is used in this case to give access to the air-gapped comtainers running on different machines on the same network. An example is found in the [Caddyfile](https://gitea.oddone.dev/Doddophonique/compose-personal-stack/src/branch/caddy-revamp/caddy-docker-proxy/Caddyfile), where the [Memos](https://gitea.oddone.dev/Doddophonique/compose-personal-stack/src/branch/caddy-revamp/memos/docker-compose.yml) container is exposed.
|
||||
As you can see, this is a borderline situation where some people may prefer having service discovery with either Swarm or Kubernetes, but in my experience this is still not enough to call for that.
|
||||
|
||||
### Conclusion (for now):
|
||||
|
||||
@@ -11,3 +11,11 @@ subdomain.domain.tld {
|
||||
}
|
||||
log
|
||||
}
|
||||
|
||||
# This is an example based on the docker-compose.yml contained
|
||||
# in the memos folder
|
||||
memos.domain.tld {
|
||||
reverse_proxy 192.168.1.128:9000
|
||||
encode zstd gzip
|
||||
log
|
||||
}
|
||||
|
||||
53
memos/docker-compose.yml
Normal file
53
memos/docker-compose.yml
Normal file
@@ -0,0 +1,53 @@
|
||||
---
|
||||
x-logging:
|
||||
&default-logging
|
||||
driver: syslog
|
||||
options:
|
||||
tag: "container_name/{{.Name}}"
|
||||
labels: "LABEL"
|
||||
syslog-facility: local7
|
||||
|
||||
x-opt-values:
|
||||
&volume-opt
|
||||
driver_opts: &options
|
||||
type: "nfs"
|
||||
o: "addr=${IP},rw"
|
||||
|
||||
services:
|
||||
memos:
|
||||
image: neosmemo/memos:stable
|
||||
container_name: memos
|
||||
# Use labels if this container is hosted on the same machine as
|
||||
# the Caddy reverse proxy
|
||||
labels:
|
||||
caddy: ${MEMOS_HOSTNAME}
|
||||
caddy.log:
|
||||
caddy.encode: "zstd gzip"
|
||||
caddy.reverse_proxy: "{{upstreams 5230}}"
|
||||
restart: unless-stopped
|
||||
# This is not needed if labels are used. If this container is
|
||||
# hosted on a different machine under the same subnetwoork, use
|
||||
# its private IP address instead of 192.168.1.128. Check the
|
||||
# Caddyfile inside caddy-docker-proxy folder for an example
|
||||
# on how to forward traffic to this container
|
||||
#
|
||||
# ports:
|
||||
# - "192.168.1.128:9000:5230"
|
||||
volumes:
|
||||
- /mnt/path:/var/opt/memos
|
||||
networks:
|
||||
- caddy
|
||||
logging: *default-logging
|
||||
|
||||
# Optional, needed if you are using an NFS server
|
||||
#
|
||||
# volumes:
|
||||
# volume:
|
||||
# <<: *volume-opt
|
||||
# driver_opts:
|
||||
# <<: *options
|
||||
# device: ":/mnt/path"
|
||||
|
||||
networks:
|
||||
caddy:
|
||||
external: true
|
||||
@@ -1,5 +0,0 @@
|
||||
# File that has to be put under /etc/netdata/go.d/nginx.conf to monitor
|
||||
# nginx_status
|
||||
jobs:
|
||||
- name: local
|
||||
url: http://nginx-proxy/nginx_status
|
||||
@@ -1,3 +0,0 @@
|
||||
# Simple reverse proxy project name to simplify network referencing.
|
||||
COMPOSE_PROJECT_NAME=rp
|
||||
DEFAULT_EMAIL=""
|
||||
@@ -1 +0,0 @@
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
# File to place in the conf/ directory of Nginx, to give other containers the
|
||||
# capability of accessing Nginx status
|
||||
|
||||
server {
|
||||
listen ${proxy-container-name}:80;
|
||||
server_name ${proxy-container-name};
|
||||
location /nginx_status {
|
||||
stub_status on;
|
||||
allow all;
|
||||
access_log on;
|
||||
}
|
||||
}
|
||||
@@ -1,78 +0,0 @@
|
||||
x-logging:
|
||||
&default-logging
|
||||
driver: syslog
|
||||
options:
|
||||
# This requires two files in /etc/rsyslog.d
|
||||
# https://www.loggly.com/use-cases/docker-syslog-logging-and-troubleshooting/
|
||||
tag: "container_name/{{.Name}}"
|
||||
labels: "${hostname}"
|
||||
syslog-facility: # cron, local7, etc.
|
||||
|
||||
# Can be removed if not needed
|
||||
x-opt-values:
|
||||
&volume-opt
|
||||
driver_opts: &options
|
||||
type: "nfs"
|
||||
o: "addr=${IP},rw"
|
||||
|
||||
services:
|
||||
nginx-proxy:
|
||||
image: jwilder/nginx-proxy
|
||||
container_name: proxy
|
||||
labels:
|
||||
com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
restart: always
|
||||
volumes:
|
||||
- conf:/etc/nginx/conf.d
|
||||
- vhost:/etc/nginx/vhost.d
|
||||
- passwords:/etc/nginx/htpasswd
|
||||
- html:/usr/share/nginx/html
|
||||
- certs:/etc/nginx/certs:ro
|
||||
- /var/run/docker.sock:/tmp/docker.sock:ro
|
||||
networks:
|
||||
- reverse-proxy
|
||||
logging: *default-logging
|
||||
|
||||
letsencrypt:
|
||||
image: nginxproxy/acme-companion
|
||||
container_name: letsencrypt
|
||||
restart: always
|
||||
volumes:
|
||||
- conf:/etc/nginx/conf.d
|
||||
- vhost:/etc/nginx/vhost.d
|
||||
- html:/usr/share/nginx/html
|
||||
- certs:/etc/nginx/certs:rw
|
||||
- acme:/etc/acme.sh
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
environment:
|
||||
NGINX_PROXY_CONTAINER: proxy
|
||||
DEFAULT_EMAIL: ${DEFAULT_EMAIL}
|
||||
networks:
|
||||
- reverse-proxy
|
||||
logging: *default-logging
|
||||
|
||||
networks:
|
||||
reverse-proxy:
|
||||
|
||||
volumes:
|
||||
acme:
|
||||
certs:
|
||||
conf:
|
||||
html:
|
||||
passwords:
|
||||
vhost:
|
||||
|
||||
# What if I want to use the x-opt-values:
|
||||
# acme:
|
||||
# <<: *volume-opt
|
||||
# driver_opts:
|
||||
# <<: *options
|
||||
# device: ":/mnt/path/nginx-proxy/acme"
|
||||
# o: "new_opts"
|
||||
# type: "new_type"
|
||||
#
|
||||
# 'o' and 'type' can be redifined again or left at default
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
# https://learn.netdata.cloud/docs/agent/running-behind-nginx#enable-authentication
|
||||
# Putting username and hashed password inside the htpasswd folder of
|
||||
# jwilder/nginx-proxy activates the Basic auth for the domain you
|
||||
# use as the filename of this file.
|
||||
|
||||
${username}:${hashed-password}
|
||||
@@ -1,10 +0,0 @@
|
||||
# https://docs.firefly-iii.org/firefly-iii/installation/docker/
|
||||
# In the section "Docker and reverse proxies", this is suggested for Nginx.
|
||||
# Put it in the vhost.d/ folder, with your domain and _location at the end
|
||||
# as a filename.
|
||||
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Server $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header Host $host;
|
||||
@@ -1,16 +0,0 @@
|
||||
# https://learn.netdata.cloud/docs/agent/running-behind-nginx#ways-to-access-netdata-via-nginx
|
||||
# Content suggested by Netdata documentation, excluding declarations that will
|
||||
# be automatically populated by jwilder/nginx-proxy.
|
||||
# To be placed in the vhost.d folder of Nginx, remember to put your domain as
|
||||
# the filename with _location at the end.
|
||||
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Server $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_pass_request_headers on;
|
||||
proxy_set_header Connection "keep-alive";
|
||||
proxy_store off;
|
||||
|
||||
gzip on;
|
||||
gzip_proxied any;
|
||||
gzip_types *;
|
||||
@@ -1,16 +0,0 @@
|
||||
# Template file for the routes of Vaultwarden. To be placed in the vhost.d/
|
||||
# folder of Nginx, substitute the name of the file with your domain.
|
||||
|
||||
location /admin {
|
||||
return 404;
|
||||
}
|
||||
|
||||
location /notifications/hub {
|
||||
proxy_pass http://${vaultwarden-container-name}:3012;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
|
||||
location /notifications/hub/negotiate {
|
||||
proxy_pass http://${vaultwarden-container-name}:8080;
|
||||
}
|
||||
Reference in New Issue
Block a user