VisualPCI/homelab-config
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore(traefik): reorganize config files and update to production versions

Browse Source 
- Moved service docker-compose files to services/ directory
- Added missing ha-nginx.conf and updated config files from CT 200
- Removed obsolete -final.yml files
- Updated dynamic.yml with full production config (HA, git, status-monitor)
This commit is contained in:
VisualPCI
2026-07-19 19:11:04 +00:00
parent e45c4b8a2a
commit af722e541e
10 changed files with 158 additions and 215 deletions
Download Patch File Download Diff File Expand all files Collapse all files
traefik-config/config/dynamic.yml
+58 -42
View File
@@ -1,19 +1,62 @@
# Configuration dynamique Traefik
# Fichier : /opt/traefik/config/dynamic.yml
http:
routers:
homeassistant:
rule: "Host(`ha.peis.fr`)"
entryPoints:
- "websecure"
tls:
certResolver: "letsencrypt"
service: homeassistant
middlewares:
- "security-headers"
traefik-public:
rule: "Host(`traefik.peis.fr`)"
service: api@internal
entryPoints:
- "websecure"
tls:
certResolver: "letsencrypt"
middlewares:
- "auth"
status-monitor:
rule: "Host(`status.peis.fr`)"
entryPoints:
- "websecure"
tls:
certResolver: "letsencrypt"
service: status-monitor
git-server:
rule: "Host(`git.peis.fr`)"
entryPoints:
- "websecure"
tls:
certResolver: "letsencrypt"
service: git-server
services:
homeassistant:
loadBalancer:
servers:
- url: "http://192.168.0.43:8123"
status-monitor:
loadBalancer:
servers:
- url: "http://192.168.0.201:80"
git-server:
loadBalancer:
servers:
- url: "http://192.168.0.202:3000"
middlewares:
# Redirection HTTP -> HTTPS
redirect-to-https:
redirectScheme:
scheme: https
permanent: true
# Compression
compress:
compress: {}
# Headers de securite
auth:
basicAuth:
users:
- "admin:$apr1$xnK9sM6u$q81sJuvBe5R3rfefqDLuk1"
security-headers:
headers:
frameDeny: true
@@ -30,31 +73,4 @@ http:
X-Frame-Options: "DENY"
X-XSS-Protection: "1; mode=block"
Referrer-Policy: "strict-origin-when-cross-origin"
Permissions-Policy: "camera=(), microphone=(), geolocation=()"
# Router pour Home Assistant (VM 100)
routers:
homeassistant:
rule: "Host(`ha.peis.fr`)"
entryPoints:
- "websecure"
tls:
certResolver: "letsencrypt"
service: homeassistant
middlewares:
- "security-headers"
# Service Home Assistant
services:
homeassistant:
loadBalancer:
servers:
- url: "http://192.168.0.43:8123"
tcp:
routers: {}
services: {}
udp:
routers: {}
services: {}
Permissions-Policy: "camera=(), microphone=(), geolocation()"
traefik-config/config/ha-nginx.conf
+28
View File
@@ -0,0 +1,28 @@
user nginx;
worker_processes auto;
events {
worker_connections 1024;
}
http {
upstream homeassistant {
server 192.168.0.43:8123;
}
server {
listen 80;
server_name ha.peis.fr;
location / {
proxy_pass http://homeassistant;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
}
traefik-config/config/traefik.yml
+44 -45
View File
@@ -1,45 +1,44 @@
# Configuration globale Traefik v2.10
# Fichier : /opt/traefik/config/traefik.yml
api:
dashboard: true
insecure: false
# Entrypoints (ports d'entree)
entryPoints:
web:
address: ":80"
http:
redirections:
entryPoint:
to: websecure
scheme: https
websecure:
address: ":443"
# Providers (sources de configuration)
providers:
docker:
endpoint: "unix:///var/run/docker.sock"
exposedByDefault: false
network: traefik_network
file:
filename: /etc/traefik/dynamic.yml
watch: true
# Certificats SSL - Let's Encrypt PRODUCTION
certificatesResolvers:
letsencrypt:
acme:
email: theo@peis.fr
storage: /etc/traefik/certs/acme.json
httpChallenge:
entryPoint: web
# Logs
log:
level: INFO
filePath: /var/log/traefik/traefik.log
accessLog:
filePath: /var/log/traefik/access.log
# Configuration globale
api:
dashboard: true
insecure: false
# Entrypoints (ports d'entree)
entryPoints:
web:
address: :80
http:
redirections:
entryPoint:
to: websecure
scheme: https
websecure:
address: :443
# Providers (sources de configuration)
providers:
file:
filename: /etc/traefik/dynamic.yml
watch: true
docker:
endpoint: unix:///var/run/docker.sock
exposedByDefault: false
network: traefik_network
# Certificats SSL - PRODUCTION Let's Encrypt
certificatesResolvers:
letsencrypt:
acme:
email: theo@peis.fr
storage: /etc/traefik/certs/acme.json
httpChallenge:
entryPoint: web
caServer: https://acme-v02.api.letsencrypt.org/directory
# Logs
log:
level: DEBUG
filePath: /var/log/traefik/traefik.log
accessLog:
filePath: /var/log/traefik/access.log
traefik-config/docker-compose-final.yml
-31
View File
@@ -1,31 +0,0 @@
version: '3.8'
services:
traefik:
image: traefik:v2.10
container_name: traefik-proxy
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./config/traefik.yml:/etc/traefik/traefik.yml:ro
- ./config/dynamic.yml:/etc/traefik/dynamic.yml:ro
- ./certs:/etc/traefik/certs
- ./logs:/var/log/traefik
networks:
- traefik_network
labels:
- "traefik.enable=true"
- "traefik.http.routers.traefik-public.rule=Host(`traefik.peis.fr`)"
- "traefik.http.routers.traefik-public.service=api@internal"
- "traefik.http.routers.traefik-public.entrypoints=websecure"
- "traefik.http.routers.traefik-public.tls=true"
- "traefik.http.routers.traefik-public.tls.certresolver=letsencrypt"
- "traefik.http.routers.traefik-public.middlewares=auth"
- "traefik.http.middlewares.auth.basicauth.users=admin:$$2y$$12$$sMXYYX3YiSvlrgRka2OB6.15HjK/hDSifu73xL8KA5HICjaxn9H4G"
networks:
traefik_network:
external: true
traefik-config/docker-compose.yml
+1 -3
View File
@@ -11,21 +11,19 @@ services:
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./config/traefik.yml:/etc/traefik/traefik.yml:ro
- ./config/dynamic.yml:/etc/traefik/dynamic.yml:ro
- ./config/dynamic.yml:/etc/traefik/dynamic.yml
- ./certs:/etc/traefik/certs
- ./logs:/var/log/traefik
networks:
- traefik_network
labels:
- "traefik.enable=true"
# Dashboard accessible via traefik.peis.fr (HTTPS avec cert LE)
- "traefik.http.routers.traefik-public.rule=Host(`traefik.peis.fr`)"
- "traefik.http.routers.traefik-public.service=api@internal"
- "traefik.http.routers.traefik-public.entrypoints=websecure"
- "traefik.http.routers.traefik-public.tls=true"
- "traefik.http.routers.traefik-public.tls.certresolver=letsencrypt"
- "traefik.http.routers.traefik-public.middlewares=auth"
# Middleware d'authentification pour le dashboard
- "traefik.http.middlewares.auth.basicauth.users=admin:$$2y$$12$$sMXYYX3YiSvlrgRka2OB6.15HjK/hDSifu73xL8KA5HICjaxn9H4G"
networks:
traefik-config/dynamic-final.yml
-50
View File
@@ -1,50 +0,0 @@
http:
routers:
homeassistant:
rule: "Host(`ha.peis.fr`)"
entryPoints:
- "websecure"
tls:
certResolver: "letsencrypt"
service: homeassistant
middlewares:
- "security-headers"
traefik-public:
rule: "Host(`traefik.peis.fr`)"
service: api@internal
entryPoints:
- "websecure"
tls:
certResolver: "letsencrypt"
middlewares:
- "auth"
services:
homeassistant:
loadBalancer:
servers:
- url: "http://192.168.0.43:8123"
middlewares:
auth:
basicAuth:
users:
- "admin:$apr1$xnK9sM6u$q81sJuvBe5R3rfefqDLuk1"
security-headers:
headers:
frameDeny: true
sslRedirect: true
browserXssFilter: true
contentTypeNosniff: true
forceSTSHeader: true
stsIncludeSubdomains: true
stsPreload: true
stsSeconds: 31536000
customResponseHeaders:
X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex"
X-Content-Type-Options: "nosniff"
X-Frame-Options: "DENY"
X-XSS-Protection: "1; mode=block"
Referrer-Policy: "strict-origin-when-cross-origin"
Permissions-Policy: "camera=(), microphone=(), geolocation()"
traefik-config/docker-compose-adguard.yml → traefik-config/services/docker-compose-adguard.yml
View File
traefik-config/services/docker-compose-ha.yml
+27
View File
@@ -0,0 +1,27 @@
version: '3.8'
services:
homeassistant:
image: homeassistant/home-assistant:2024.6.3
container_name: homeassistant
restart: unless-stopped
volumes:
- /opt/homeassistant/config:/config
- /etc/localtime:/etc/localtime:ro
environment:
- TZ=Europe/Paris
labels:
- "traefik.enable=true"
# Router HTTPS (la redirection HTTP->HTTPS est geree par Traefik au niveau de l_entrypoint web)
- "traefik.http.routers.ha.rule=Host(`ha.peis.fr`)"
- "traefik.http.routers.ha.entrypoints=websecure"
- "traefik.http.routers.ha.tls=true"
- "traefik.http.routers.ha.tls.certresolver=letsencrypt"
# Service
- "traefik.http.services.ha.loadbalancer.server.port=8123"
networks:
- traefik_network
networks:
traefik_network:
external: true
traefik-config/docker-compose-whoami.yml → traefik-config/services/docker-compose-whoami.yml
View File
traefik-config/traefik-final.yml
-44
View File
@@ -1,44 +0,0 @@
# Configuration globale
api:
dashboard: true
insecure: false
# Entrypoints (ports d'entree)
entryPoints:
web:
address: ":80"
http:
redirections:
entryPoint:
to: websecure
scheme: https
websecure:
address: ":443"
# Providers (sources de configuration)
providers:
docker:
endpoint: "unix:///var/run/docker.sock"
exposedByDefault: false
network: traefik_network
file:
filename: /etc/traefik/dynamic.yml
watch: true
# Certificats SSL - PRODUCTION Let's Encrypt
certificatesResolvers:
letsencrypt:
acme:
email: theo@peis.fr
storage: /etc/traefik/certs/acme.json
httpChallenge:
entryPoint: web
caServer: https://acme-v02.api.letsencrypt.org/directory
# Logs
log:
level: INFO
filePath: /var/log/traefik/traefik.log
accessLog:
filePath: /var/log/traefik/access.log