From f113bdbdd4b5e92fae73dfb6c87313bc1e40e67f Mon Sep 17 00:00:00 2001 From: Christian Krakau-Louis Date: Thu, 22 Oct 2020 00:27:51 +0200 Subject: [PATCH] Update traefik.yml --- infra-compose-files/traefik.yml | 97 ++++++++++++++++++++++++++++++++- 1 file changed, 96 insertions(+), 1 deletion(-) diff --git a/infra-compose-files/traefik.yml b/infra-compose-files/traefik.yml index 3776a6f..6c87d3c 100644 --- a/infra-compose-files/traefik.yml +++ b/infra-compose-files/traefik.yml @@ -1 +1,96 @@ - +version: '3.2' +services: + traefik: + image: traefik:v1.7 + networks: + - dmz + - dmz2 + - portainer_portainer + - public + ports: + - 443:443/tcp + - 4433:4433/tcp + - 80:80/tcp + - 8080:8080/tcp + - 8088:8088/tcp + + deploy: + mode: replicated + replicas: 1 + placement: + constraints: + - node.role == manager + update_config: + parallelism: 1 + delay: 10s + restart_policy: + condition: on-failure + labels: + - "traefik.backend=traefik" + - "traefik.docker.network=public" + - "traefik.port=8080" + - "traefik.enable=true" + - "traefik.frontend.entryPoints=http,https" + - "traefik.frontend.headers.SSLRedirect=true" + - "traefik.frontend.rule=Host:traefik-admin.origins.akamaipartnertraining.com" + + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - Traefik_traefik_certs:/certs + environment: + - EMAIL=${EMAIL} + - DOMAIN=${DOMAIN} + - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} + - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} + + command: + - "--api" + - "--acme" + - "--acme.storage=/certs/acme.json" + - "--acme.entryPoint=https" + - "--acme.tlsChallenge" + - "--acme.httpChallenge.entryPoint=http" + - "--acme.dnsChallenge.provider=route53" + - "--acme.onHostRule=true" + - "--acme.onDemand=false" + - "--acme.acmelogging=true" + - "--acme.email=${EMAIL:-chlouis@akamai.com}" + - "--acme.domains=*.akaorigin.com" + - "--acme.domains=*.filtered.akaorigin.com" + - "--acme.domains=*.my-akashop.com" + - "--acme.domains=*.my-juiceshop.com" + - "--acme.domains=*.admin.akamaipartnertraining.com" + - "--acme.domains=*.o.akamaipartnertraining.com" + - "--acme.domains=*.origins.akamaipartnertraining.com" + - "--acme.dnsChallenge.resolvers=1.1.1.1:53,8.8.8.8:53" + - "--debug" + - "--docker" + - "--docker.swarmMode" + - "--docker.domain=${DOMAIN:-origins.akamaipartnertraining.com}" + - "--docker.watch" + - "--defaultentrypoints=http,https,https-filtered" + - "--entrypoints=Name:http Address::80 Compress:true" + - "--entrypoints=Name:https Address::443 TLS Compress:true TLS.MinVersion:VersionTLS12 TLS.CipherSuites:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305" + - "--entrypoints=Name:http-filtered Address::8088 Compress:true ProxyProtocol.TrustedIPs:192.168.0.1 ProxyProtocol.Insecure:true WhiteList.SourceRange:209.170.113.98/31,209.170.113.100/31,209.170.113.106/31,209.170.113.108/32,204.2.166.173/32,204.2.166.174/31,204.2.166.176/30,204.2.166.180/32,209.8.112.100/30,209.8.112.104/31,208.49.157.49/32,208.49.157.50/31,208.49.157.52/31,208.49.157.54/32,184.84.242.21/32,184.84.242.22/31,63.151.118.0/24,67.220.142.19/32,67.220.142.20/32,67.220.142.21/32,67.220.142.22/32,66.198.8.141/32,66.198.8.142/32,66.198.8.143/32,66.198.8.144/32,209.8.112.96/30,184.84.242.32/30,23.48.168.0/22,23.50.48.0/20,67.220.142.19/32,67.220.142.20/32,67.220.142.21/32,67.220.142.22/32,66.198.8.141/32,66.198.8.142/32,66.198.8.143/32,66.198.8.144/32,23.48.168.0/22,23.50.48.0/20,2600:14a0::/40,2600:14a0::/40,188.40.15.155/32 WhiteList.UseXForwardedFor:true" + - "--entrypoints=Name:https-filtered Address::4433 TLS TLS:/certs/cert1.pem,/certs/privkey1.pem TLS.DefaultCertificate.Cert:/certs/cert1.pem TLS.DefaultCertificate.Key:/certs/privkey1.pem compress:true TLS.MinVersion:VersionTLS12 TLS.CipherSuites:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 ProxyProtocol.TrustedIPs:192.168.0.1 ProxyProtocol.Insecure:true WhiteList.SourceRange:209.170.113.98/31,209.170.113.100/31,209.170.113.106/31,209.170.113.108/32,204.2.166.173/32,204.2.166.174/31,204.2.166.176/30,204.2.166.180/32,209.8.112.100/30,209.8.112.104/31,208.49.157.49/32,208.49.157.50/31,208.49.157.52/31,208.49.157.54/32,184.84.242.21/32,184.84.242.22/31,63.151.118.0/24,67.220.142.19/32,67.220.142.20/32,67.220.142.21/32,67.220.142.22/32,66.198.8.141/32,66.198.8.142/32,66.198.8.143/32,66.198.8.144/32,209.8.112.96/30,184.84.242.32/30,23.48.168.0/22,23.50.48.0/20,67.220.142.19/32,67.220.142.20/32,67.220.142.21/32,67.220.142.22/32,66.198.8.141/32,66.198.8.142/32,66.198.8.143/32,66.198.8.144/32,23.48.168.0/22,23.50.48.0/20,2600:14a0::/40,2600:14a0::/40,188.40.15.155/32 WhiteList.UseXForwardedFor:true" + - "--logLevel=INFO" + - "--accessLog" + - "--metrics" + - "--metrics.prometheus" + - "--web" + + +networks: + dmz: + external: true + dmz2: + external: true + portainer_portainer: + external: true + public: + external: true + + +volumes: + Traefik_traefik_certs: + external: true