traefik.env

.github/workflows/check-docker-compose.yml

@@ -0,0 +1,26 @@
+name: Check docker compose files
+
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - v*
+jobs:
+  build:
+    env:
+      BIND_MOUNTS: "/srv"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Install make and docker-compose
+        run: sudo apt install -y docker-compose make
+      # - name: Check docker-compose files
+      #   run: for file in `find services/*`; do docker-compose -f $file config > /dev/null; done
+      - name: Clone validator
+        run: git clone https://github.com/serviceprototypinglab/dcvalidator /opt/validator
+      - name: Merge to docker-compose.yml
+        run: make merge
+      - name: Validate docker-compose.yml
+        # run: docker-compose -f stacks/docker-compose.yml config
+        run: /opt/validator/validator-cli.py -f stacks/docker-compose.yml

.github/workflows/docker-swarm-deploy.yml

@@ -1,20 +0,0 @@
-name: Docker Swarm Deployed
-
-on:
-  push:
-    branches:
-      - master
-    tags:
-      - v*
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Update
-        run: apt-get update
-      - name: Install ssh
-        run: apt-get install openssh-client -y
-      - name: Setup ssh agent
-        run: eval $(ssh-agent -s) && ssh-add <(echo $SSH_PRIVATE_KEY)
-      - name: Deploy to Docker swarm
-        run: ssh -o StrictHostKeyChecking=no $SSH_REMOTE docker swarm deploy -c vps.yml vps

.gitignore

@@ -2,7 +2,6 @@ docker-compose.yml
 data/openvpn
 data/secrets
 data/certbot
-data/traefik
 data/searx
 data/jenkins
 data/beef
@@ -11,6 +10,7 @@ data/authelia
 data/mx-puppet-discord
 data/matrix
 data/heimdall
+data/traefik/traefik.yml
 data/pihole/etc-pihole
 data/pxe
 data.tar.gz

services/arch.yml

@@ -3,8 +3,11 @@ services:
   arch:
     image: marcpartensky/arch:vnc
     restart: unless-stopped
+    ports: # vnc is shared
+      - "5900:5900"
     networks:
       - caddy
+      - ldap
     volumes:
       - arch:/home/marc
     labels:
@@ -20,5 +23,7 @@ volumes:
   arch:
 
 networks:
+  ldap:
+    external: true
   caddy:
     external: true

services/authentik.yml

@@ -24,7 +24,6 @@ services:
       - authentik_postgres
       - authentik_redis
       - authentik_worker
-      - caddy
     networks:
       - authentik
       - caddy

services/beef.yml

@@ -6,10 +6,14 @@ services:
     restart: unless-stopped
     networks:
       - caddy
+    ports:
+      - "6789:6789"
+      - "61985:61985"
+      - "61986:61986"
     volumes:
       - beef:/root/.ms4f
       - /tmp/beef:/tmp/data
-      - ../data/beef/config.yaml:beef/config.yaml
+      - ../data/beef/config.yaml:/beef/config.yaml
     labels:
       caddy: beef.marcpartensky.com"
       caddy.reverse_proxy: "{{upstreams 3000}}"

services/caddy.yml

@@ -19,7 +19,8 @@ services:
       - caddy_data:/data
       - ../data/caddy/Caddyfile:/etc/Caddyfile
     networks:
-      - caddy
+      caddy:
+        # ipv4_address: 10.0.0.1
     logging:
       # syslog?
       options:

services/heimdall.yml

@@ -19,6 +19,8 @@ services:
       traefik.http.routers.heimdall.rule: Host(`heimdall.marcpartensky.com`)
       traefik.http.routers.heimdall.entrypoints: websecure
       traefik.http.routers.heimdall.tls: "true"
+      traefik.http.middlewares.test-ldap-auth.plugin.ldapAuth.source: marcpartensky.com
+      traefik.http.middlewares.test-ldap-auth.plugin.ldapAuth.baseDN: dc=marcpartensky,dc=com
       # traefik.http.services.heimdall.loadbalancer.server.port: 80
       # traefik.http.routers.heimdall.middlewares: authelia-basic@docker
 

services/ldap-manager.yml

@@ -31,5 +31,6 @@ services:
 
 networks:
   ldap:
+    external: true
   caddy:
     external: true

services/ldap.yml

@@ -26,3 +26,4 @@ volumes:
 
 networks:
   ldap:
+    external: true

services/matrix.yml

@@ -17,10 +17,10 @@ services:
       caddy: matrix.marcpartensky.com
       caddy.reverse_proxy: "{{upstreams 8008}}"
       traefik.enable: "true"
-      traefik.http.routers.nextcloud.rule: Host(`matrix.marcpartensky.com`)
-      traefik.http.routers.nextcloud.entrypoints: websecure
-      traefik.http.routers.nextcloud.tls.certresolver: tls
-      traefik.http.services.nextcloud.loadbalancer.server.port: 8008
+      traefik.http.routers.matrix.rule: Host(`matrix.marcpartensky.com`)
+      traefik.http.routers.matrix.entrypoints: websecure
+      traefik.http.routers.matrix.tls.certresolver: tls
+      traefik.http.services.matrix.loadbalancer.server.port: 8008
 
 networks:
   caddy:

services/minecraft_bedrock.yml

@@ -0,0 +1,13 @@
+version: "3.9"
+services:
+  minecraft_bedrock:
+    image: itzg/minecraft-bedrock-server
+    restart: unless-stopped
+    ports:
+      - "19132:19132"
+      - "39926:39926"
+    environment:
+      EULA: "true"
+      VERSION: "1.18"
+      OPS: "000901FA5EE9A31B"
+

services/nextcloud.yml

@@ -15,8 +15,8 @@ services:
     networks:
       - caddy
       - nextcloud
-    depends_on:
-      - nextcloud_mariadb
+        # depends_on:
+        #   - nextcloud_mariadb
     labels:
       caddy: cloud.marcpartensky.com
       caddy.reverse_proxy: "{{upstreams http 80}}"

services/oxivia.yml

@@ -14,7 +14,7 @@ services:
       - caddy
       - oxivia
     depends_on:
-      - oxivia_mysql
+      #   - oxivia_mysql
       - caddy
     healthcheck:
       test: ["CMD", "curl", "-f", "localhost:80"]

services/rustdesk.yml

@@ -0,0 +1,37 @@
+version: "3.9"
+
+services:
+  rustdesk_hbbs:
+    image: rustdesk/rustdesk-server:latest
+    restart: unless-stopped
+    ports:
+      - 21115:21115
+      - 21116:21116
+      - 21116:21116/udp
+      - 21118:21118
+    command: hbbs -r example.com:21117
+    volumes:
+      - rustdesk_hbbs:/root
+    networks:
+      - rustdesk
+    depends_on:
+      - rustdesk_hbbr
+
+  rustdesk_hbbr:
+    image: rustdesk/rustdesk-server:latest
+    restart: unless-stopped
+    ports:
+      - 21117:21117
+      - 21119:21119
+    command: hbbr
+    volumes:
+      - rustdesk_hbbr:/root
+    networks:
+      - rustdesk
+
+volumes:
+  rustdesk_hbbs:
+  rustdesk_hbbr:
+
+networks:
+  rustdesk:

services/seafile.yml

@@ -1,47 +1,78 @@
-version: "3.9"
-
-services:
-  seafile_mariadb:
-    image: mariadb:10.5
-    env_file:
-      - ../data/secrets/seafile.env
-    volumes:
-      - seafile_mysql:/var/lib/mysql
-    networks:
-      - seafile
-
-  seafile_memcached:
-    image: memcached:1.5.6
-    entrypoint: memcached -m 256
-    networks:
-      - seafile
-
-  seafile:
-    image: seafileltd/seafile-mc:latest
-    volumes:
-      - seafile:/shared
-    env_file:
-      - ../data/secrets/seafile.env
-    depends_on:
-      - seafile_mariadb
-      - seafile_memcached
-    networks:
-      - seafile
-      - caddy
-    labels:
-      caddy: seafile.marcpartensky.com
-      caddy.reverse_proxy: "{{upstreams http 80}}"
-      traefik.enable: "true"
-      traefik.http.routers.seafile.rule: Host(`seafile.marcpartensky.com`)
-      traefik.http.routers.seafile.entrypoints: websecure
-      traefik.http.routers.seafile.tls.certresolver: tls
-      traefik.http.services.seafile.loadbalancer.server.port: 80
-
-volumes:
-  seafile:
-  seafile_mysql:
-
-networks:
-  seafile:
-  caddy:
-    external: true
+version: "3.9"
+services:
+  seafile_server:
+    image: ggogel/seafile-server:9.0.7
+    volumes:
+      - seafile_data:/shared
+    env_file:
+      - ../data/secrets/seafile.env
+    environment:
+      HTTPS: "true"
+      SEAFILE_SERVER_HOSTNAME: seafile.marcpartensky.com # Mandatory on first deployment!
+    depends_on:
+      - seafile_mariadb
+      - seafile_memcached
+      - seafile_caddy
+    networks:
+      - seafile
+
+  seahub:
+    image: ggogel/seahub:9.0.7
+    volumes:
+      - seafile_data:/shared
+      - seahub_avatars:/shared/seafile/seahub-data/avatars
+      - seahub_custom:/shared/seafile/seahub-data/custom
+    env_file:
+      - ../data/secrets/seafile.env
+    depends_on:
+      - seafile_server
+      - seafile_caddy
+      - seahub_media
+    networks:
+      - seafile
+
+  seahub_media:
+    image: ggogel/seahub-media:9.0.7
+    volumes:
+     - seahub_avatars:/usr/share/caddy/media/avatars
+     - seahub_custom:/usr/share/caddy/media/custom
+    depends_on:
+      - seafile_caddy
+    networks:
+      - seafile
+
+  seafile_mariadb:
+    image: mariadb:10.7.4
+    env_file:
+      - ../data/secrets/seafile.env
+    volumes:
+      - seafile_mariadb:/var/lib/mysql
+    networks:
+      - seafile
+
+  seafile_memcached:
+    image: memcached:1.6.16
+    entrypoint: memcached -m 1024
+    networks:
+      - seafile
+
+  seafile_caddy:
+    image: ggogel/seafile-caddy:1.0.6
+    networks:
+      - seafile
+      - caddy
+    labels:
+      caddy: seafile.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 80}}"
+
+networks:
+  seafile:
+    internal: true
+  caddy:
+    external: true
+
+volumes:
+  seafile_data:
+  seafile_mariadb:
+  seahub_avatars:
+  seahub_custom:

services/sslh.yml

@@ -2,7 +2,7 @@ version: "3.9"
 
 services:
   sslh:
-    image: tnwhitwell/sslh
+    image: marcpartensky/sslh
     restart: unless-stopped
     environment:
       # LISTEN_IP: 0.0.0.0
@@ -21,6 +21,12 @@ services:
       # - bridge
     depends_on:
       - caddy
+    healthcheck:
+      # test: ["CMD-SHELL", "wget", "--no-check-certificate", "https://caddy:8443"]
+      test: ["CMD", "/usr/bin/curl", "http://caddy"]
+      # interval: 30s
+      # timeout: 5s
+      # retries: 5
 
 networks:
   caddy:

services/tableau.yml

@@ -3,10 +3,22 @@ services:
   tableau:
     image: pvtmert/tableau
     restart: unless-stopped
-    ports:
-      - "8081:8080"
-    # env_file:
-    #   - ../data/secrets/tableau.env
+    env_file:
+      - ../data/secrets/tableau.env
+    networks:
+      - caddy
+    labels:
+      caddy: tableau.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 8080}}"
+      traefik.enable: "true"
+      traefik.http.routers.tableau.rule: Host(`tableau.marcpartensky.com`)
+      traefik.http.routers.tableau.entrypoints: websecure
+      traefik.http.routers.tableau.tls.certresolver: tls
+      traefik.http.services.tableau.loadbalancer.server.port: 8080
+
+networks:
+  caddy:
+    external: true
 
 # docker run \
 # -e LICENSE_KEY=<key> \

services/traefik.yml

@@ -3,6 +3,8 @@ version: "3.9"
 services:
   traefik:
     image: traefik
+    env_file:
+      - ../data/secrets/traefik.env
     restart: unless-stopped
     command:
       ## Provider Settings - https://docs.traefik.io/providers/docker/#provider-configuration ##
@@ -30,21 +32,27 @@ services:
     networks:
       - caddy
     volumes:
-      - ../data/traefik/letsencrypt:/letsencrypt
+      - traefik_letsencrypt:/letsencrypt
+      # - ../data/traefik/traefik.yml:/root/.config/traefik.yml # no configuration file
       # - ./data/traefik/dynamic.yaml:/dynamic.yaml
       - /var/run/docker.sock:/var/run/docker.sock:ro
     labels:
-      traefik.enable: true
+      traefik.enable: "true"
       traefik.http.routers.traefik.rule: Host(`traefik.marcpartensky.com`)
       traefik.http.routers.traefik.service: api@internal
       traefik.http.routers.traefik.entrypoints: websecure
       traefik.http.routers.traefik.tls.certresolver: tls
       traefik.docker.network: caddy
+      traefik.http.middlewares.test-ldap-auth.plugin.ldapAuth.source: marcpartensky.com
+      traefik.http.middlewares.test-ldap-auth.plugin.ldapAuth.baseDN: dc=marcpartensky,dc=com
       # traefik.http.routers.redirs.entrypoints: web
       # traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: https
       # traefik.http.routers.redirs.middlewares: redirect-to-https
       # traefik.http.routers.redirs.rule: hostregexp(`{host:.+}`)
 
+volumes:
+  traefik_letsencrypt:
+
 networks:
   caddy:
     external: true

services/valentin.yml

@@ -0,0 +1,25 @@
+version: "3.9"
+
+services:
+  valentin_website:
+    image: valentincolin/website
+    restart: unless-stopped
+    environment:
+      PRODUCTION: "True"
+    build:
+      context: ./
+      dockerfile: Dockerfile
+    networks:
+      - caddy
+    labels:
+      caddy: valentin-colin.fr
+      caddy.reverse_proxy: "{{upstreams 80}}"
+      traefik.enable: "true"
+      traefik.http.routers.valentincolin_website.rule: Host(`valentin-colin.com`)
+      traefik.http.routers.valentincolin_website.entrypoints: websecure
+      traefik.http.routers.valentincolin_website.tls.certresolver: tls
+      traefik.http.services.valentincolin_website.loadbalancer.server.port: 80
+
+networks:
+  caddy:
+    external: true

services/vaultwarden.yml

@@ -13,7 +13,6 @@ services:
       RUST_BACKTRACE: 1
     depends_on:
       - vaultwarden
-      - ldap
 
   vaultwarden:
     image: vaultwarden/server
@@ -39,9 +38,7 @@ services:
     environment:
       PHPLDAPADMIN_HTTPS: 'false'
       PHPLDAPADMIN_LDAP_HOSTS: ldap
-    depends_on:
-      - ldap
 
-  networks:
-    caddy:
-      external: true
+networks:
+  caddy:
+    external: true

services/website.yml

@@ -9,15 +9,9 @@ services:
     environment:
       VIRTUAL_HOST: marcpartensky.com
       VIRTUAL_PORT: 80
-      # DEBUG: true
       # SECURE_SSL_REDIRECT: false
       # KEY: /app/privkey.pem
       # CERT: /app/fullchain.pem
-    working_dir: /app
-    entrypoint: >
-      sh -c "./manage.py migrate;
-             ./manage.py collectstatic --noinput;
-             daphne django_project.asgi:application --port 80 --bind 0.0.0.0 -v2"
     # entrypoint: "daphne -e ssl:443:privateKey=$$KEY:certKey=$$CERT django_project.asgi:application"
     # entrypoint: daphne -b website -e ssl:443:privateKey=/app/privkey.pem:certKey=/app/fullchain.pem django_project.asgi:application
     # command:

services/wordpress.yml

@@ -33,7 +33,19 @@ services:
       - wordpress_mysql:/var/lib/mysql
     # healthcheck:
     #   test: CMD /bin/sh -c 'mysqladmin ping --user=$MYSQL_USER --password=$MYSQL_PASSWORD'
-
+    #
+  phpmyadmin:
+    image: phpmyadmin
+    restart: unless-stopped
+    env_file:
+      - ../data/secrets/wordpress.env
+    networks:
+      - wordpress
+    ports:
+      - "8880:80"
+    labels:
+      caddy: phpmyadmin.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams}}"
 
 volumes:
   wordpress: