ldapauth

.gitignore

@@ -2,7 +2,6 @@ docker-compose.yml
 data/openvpn
 data/secrets
 data/certbot
-data/traefik
 data/searx
 data/jenkins
 data/beef
@@ -11,6 +10,7 @@ data/authelia
 data/mx-puppet-discord
 data/matrix
 data/heimdall
+data/traefik
 data/pihole/etc-pihole
 data/pxe
 data.tar.gz

services/agenda_militant.yml

@@ -0,0 +1,18 @@
+version: "3.9"
+services:
+  agenda_militant:
+    image: marcpartensky/agenda-militant
+    restart: unless-stopped
+    networks:
+      - caddy
+    labels:
+      caddy: agenda.militant.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 8080}}"
+      traefik.enable: "true"
+      traefik.http.routers.agenda_militant.rule: Host(`agenda.militant.marcpartensky.com`)
+      traefik.http.routers.agenda_militant.entrypoints: websecure
+      traefik.http.routers.agenda_militant.tls.certresolver: tls
+      traefik.http.services.agenda_militant.loadbalancer.server.port: 8080
+networks:
+  caddy:
+    external: true

services/arch.yml

@@ -7,6 +7,7 @@ services:
       - "5900:5900"
     networks:
       - caddy
+      - ldap
     volumes:
       - arch:/home/marc
     labels:
@@ -17,10 +18,21 @@ services:
       traefik.http.routers.arch.entrypoints: websecure
       traefik.http.routers.arch.tls.certresolver: tls
       traefik.http.services.arch.loadbalancer.server.port: 8080
+      # ldapAuth Register Middleware ====================================================
+      traefik.http.routers.arch.middlewares: ldap_auth
+      # ldapAuth Options=================================================================
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.enabled: "true"
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.logLevel: DEBUG
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.url: ldap://ldap.marcpartensky.com
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.port: 636
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.baseDN: dc=marcpartensky,dc=com
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.attribute: uid
 
 volumes:
   arch:
 
 networks:
+  ldap:
+    external: true
   caddy:
     external: true

services/caddy.yml

@@ -11,7 +11,7 @@ services:
     image: marcpartensky/caddy
     ports:
       - "80:80"
-      - "443:443"
+      # - "443:443"
     environment:
       CADDY_INGRESS_NETWORKS: caddy
     volumes:

services/duplicati.yml

@@ -18,6 +18,19 @@ services:
     labels:
       caddy: duplicati.marcpartensky.com
       caddy.reverse_proxy: "{{upstreams 8200}}"
+      traefik.enable: "true"
+      traefik.http.routers.duplicati.rule: Host(`duplicati.marcpartensky.com`)
+      traefik.http.routers.duplicati.entrypoints: websecure
+      traefik.http.routers.duplicati.tls.certresolver: tls
+      traefik.http.services.duplicati.loadbalancer.server.port: 8200
+    # ldapAuth Options=================================================================
+      traefik.http.routers.duplicati.middlewares: ldap_auth
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.enabled: "true"
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.logLevel: DEBUG
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.url: ldap://ldap.marcpartensky.com
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.port: 389
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.baseDN: dc=marcpartensky,dc=com
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.attribute: uid
 
 volumes:
   duplicati_config:

services/heimdall.yml

@@ -19,6 +19,8 @@ services:
       traefik.http.routers.heimdall.rule: Host(`heimdall.marcpartensky.com`)
       traefik.http.routers.heimdall.entrypoints: websecure
       traefik.http.routers.heimdall.tls: "true"
+      traefik.http.middlewares.test-ldap-auth.plugin.ldapAuth.source: marcpartensky.com
+      traefik.http.middlewares.test-ldap-auth.plugin.ldapAuth.baseDN: dc=marcpartensky,dc=com
       # traefik.http.services.heimdall.loadbalancer.server.port: 80
       # traefik.http.routers.heimdall.middlewares: authelia-basic@docker
 

services/ipsec.yml

@@ -0,0 +1,15 @@
+version: "3.9"
+services:
+  ipsec:
+    image: hwdsl2/ipsec-vpn-server
+    restart: unless-stopped
+    privileged: true
+    ports:
+      - "500:500/udp"
+      - "4500:4500/udp"
+    volumes:
+      - ikev2-vpn:/etc/ipsec.d
+      - /lib/modules:/lib/modules:ro
+
+volumes:
+  ikev2-vpn:

services/ldap-manager.yml

@@ -31,5 +31,6 @@ services:
 
 networks:
   ldap:
+    external: true
   caddy:
     external: true

services/ldap.yml

@@ -26,3 +26,4 @@ volumes:
 
 networks:
   ldap:
+    external: true

services/mongo.yml

@@ -34,7 +34,7 @@ services:
       traefik.http.routers.mongo.rule: Host(`mongo.marcpartensky.com`)
       traefik.http.routers.mongo.entrypoints: websecure
       traefik.http.routers.mongo.tls.certresolver: tls
-      traefik.http.services.mongo.loadbalancer.server.port: 80
+      traefik.http.services.mongo.loadbalancer.server.port: 8081
 
 volumes:
   mongo:

services/sslh.yml

@@ -14,7 +14,7 @@ services:
       HTTPS_HOST: caddy
       HTTPS_PORT: 443
     ports:
-      # - "443:8443"
+      - "443:8443"
     # command: --tls=caddy:443 --ssh=marcpartensky.com:7022
     networks:
       - caddy

services/traefik.yml

@@ -3,47 +3,59 @@ version: "3.9"
 services:
   traefik:
     image: traefik
+    # env_file:
+    #   - ../data/secrets/traefik.env
     restart: unless-stopped
-    command:
-      ## Provider Settings - https://docs.traefik.io/providers/docker/#provider-configuration ##
-      # - --providers.docker.exposedbydefault=false # <== Don't expose every container to traefik, only expose enabled ones
-      - --providers.file.filename=/dynamic.yaml # <== Referring to a dynamic configuration file
-      # - --providers.docker.network=web # <== Operate on the docker network named web
-      - --providers.docker=true # <== Enabling docker as the provider for traefik
-      ## API Settings - https://docs.traefik.io/operations/api/, endpoints - https://docs.traefik.io/operations/api/#endpoints ##
-      - --api.insecure=false # <== Enabling insecure api, NOT RECOMMENDED FOR PRODUCTION
-      - --api.dashboard=true
-      - --api.debug=true # <== Enabling additional endpoints for debugging and profiling
-      ## Entrypoints Settings - https://docs.traefik.io/routing/entrypoints/#configuration ##
-      - --entrypoints.web.address=:80
-      - --entrypoints.websecure.address=:443
-      - --certificatesresolvers.tls.acme.tlschallenge=true # <== Enable TLS-ALPN-01 to generate and renew ACME certs
-      - --certificatesresolvers.tls.acme.email=marc.partensky@gmail.com
-      - --certificatesresolvers.tls.acme.storage=/letsencrypt/acme.json # Log Settings (options: ERROR, DEBUG, PANIC, FATAL, WARN, INFO) - https://docs.traefik.io/observability/logs/ ##
-      - --log.level=DEBUG # <== Setting the level of the logs from traefik
-      - --entrypoints.web.http.redirections.entryPoint.to=websecure
-      - --entrypoints.web.http.redirections.entryPoint.scheme=https
-      - --entrypoints.web.http.redirections.entrypoint.permanent=true
+    # command:
+    #   ## Provider Settings - https://docs.traefik.io/providers/docker/#provider-configuration ##
+    #   # - --providers.docker.exposedbydefault=false # <== Don't expose every container to traefik, only expose enabled ones
+    #   - --providers.file.filename=/dynamic.yaml # <== Referring to a dynamic configuration file
+    #   # - --providers.docker.network=web # <== Operate on the docker network named web
+    #   - --providers.docker=true # <== Enabling docker as the provider for traefik
+    #   ## API Settings - https://docs.traefik.io/operations/api/, endpoints - https://docs.traefik.io/operations/api/#endpoints ##
+    #   - --api.insecure=false # <== Enabling insecure api, NOT RECOMMENDED FOR PRODUCTION
+    #   - --api.dashboard=true
+    #   - --api.debug=true # <== Enabling additional endpoints for debugging and profiling
+    #   ## Entrypoints Settings - https://docs.traefik.io/routing/entrypoints/#configuration ##
+    #   - --entrypoints.web.address=:80
+    #   - --entrypoints.websecure.address=:443
+    #   - --certificatesresolvers.tls.acme.tlschallenge=true # <== Enable TLS-ALPN-01 to generate and renew ACME certs
+    #   - --certificatesresolvers.tls.acme.email=marc.partensky@gmail.com
+    #   - --certificatesresolvers.tls.acme.storage=/letsencrypt/acme.json # Log Settings (options: ERROR, DEBUG, PANIC, FATAL, WARN, INFO) - https://docs.traefik.io/observability/logs/ ##
+    #   - --log.level=DEBUG # <== Setting the level of the logs from traefik
+    #   - --entrypoints.web.http.redirections.entryPoint.to=websecure
+    #   - --entrypoints.web.http.redirections.entryPoint.scheme=https
+    #   - --entrypoints.web.http.redirections.entrypoint.permanent=true
     ports:
       - "80:80"
       - "443:443"
     networks:
       - caddy
     volumes:
-      - ../data/traefik/letsencrypt:/letsencrypt
-      # - ./data/traefik/dynamic.yaml:/dynamic.yaml
+      - ../data/traefik/traefik.yml:/traefik.yml # static configuration
+      - ../data/traefik/dynamic.yml:/dynamic.yml
+      - traefik_letsencrypt:/letsencrypt
       - /var/run/docker.sock:/var/run/docker.sock:ro
     labels:
-      traefik.enable: true
+      traefik.enable: "true"
       traefik.http.routers.traefik.rule: Host(`traefik.marcpartensky.com`)
       traefik.http.routers.traefik.service: api@internal
       traefik.http.routers.traefik.entrypoints: websecure
       traefik.http.routers.traefik.tls.certresolver: tls
       traefik.docker.network: caddy
-      # traefik.http.routers.redirs.entrypoints: web
+        # traefik.http.middlewares.test-ldap-auth.plugin.ldapAuth.source: marcpartensky.com
+        # traefik.http.middlewares.test-ldap-auth.plugin.ldapAuth.baseDN: dc=marcpartensky,dc=com
+        # # traefik.http.routers.redirs.entrypoints: web
       # traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: https
       # traefik.http.routers.redirs.middlewares: redirect-to-https
       # traefik.http.routers.redirs.rule: hostregexp(`{host:.+}`)
+    deploy:
+      placement:
+        constraints:
+          - node.role == manager
+
+volumes:
+  traefik_letsencrypt:
 
 networks:
   caddy:

services/valentin.yml

@@ -6,17 +6,11 @@ services:
     restart: unless-stopped
     environment:
       PRODUCTION: "True"
-    env_file:
-      - ../data/secrets/valentin.env
     build:
       context: ./
       dockerfile: Dockerfile
     networks:
       - caddy
-    entrypoint: sh -c "
-        ./manage.py migrate &&
-        /app/entrypoint.sh
-      "
     labels:
       caddy: valentin-colin.fr
       caddy.reverse_proxy: "{{upstreams 80}}"

services/website.yml

@@ -80,10 +80,10 @@ services:
       caddy.basicauth: /* bcrypt
       caddy.basicauth.admin: JDJhJDEyJDVRUXdqQllCR2dCSEZ0ZUlaVUZTRE95WXpROFdUcFdXSm4wVGE2TmE4cEkxNHc5Si4venJxCg==
       traefik.enable: "true"
-      traefik.http.routers.website.rule: Host(`db.marcpartensky.com`)
-      traefik.http.routers.website.entrypoints: websecure
-      traefik.http.routers.website.tls.certresolver: tls
-      traefik.http.services.website.loadbalancer.server.port: 8081
+      traefik.http.routers.pgweb.rule: Host(`db.marcpartensky.com`)
+      traefik.http.routers.pgweb.entrypoints: websecure
+      traefik.http.routers.pgweb.tls.certresolver: tls
+      traefik.http.services.pgweb.loadbalancer.server.port: 8081
 
   # postgres_adminer:
   # adminer: