ldapauth

.gitignore

@@ -10,7 +10,7 @@ data/authelia
 data/mx-puppet-discord
 data/matrix
 data/heimdall
-data/traefik/traefik.yml
+data/traefik
 data/pihole/etc-pihole
 data/pxe
 data.tar.gz

services/agenda_militant.yml

@@ -0,0 +1,18 @@
+version: "3.9"
+services:
+  agenda_militant:
+    image: marcpartensky/agenda-militant
+    restart: unless-stopped
+    networks:
+      - caddy
+    labels:
+      caddy: agenda.militant.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 8080}}"
+      traefik.enable: "true"
+      traefik.http.routers.agenda_militant.rule: Host(`agenda.militant.marcpartensky.com`)
+      traefik.http.routers.agenda_militant.entrypoints: websecure
+      traefik.http.routers.agenda_militant.tls.certresolver: tls
+      traefik.http.services.agenda_militant.loadbalancer.server.port: 8080
+networks:
+  caddy:
+    external: true

services/arch.yml

@@ -18,6 +18,15 @@ services:
       traefik.http.routers.arch.entrypoints: websecure
       traefik.http.routers.arch.tls.certresolver: tls
       traefik.http.services.arch.loadbalancer.server.port: 8080
+      # ldapAuth Register Middleware ====================================================
+      traefik.http.routers.arch.middlewares: ldap_auth
+      # ldapAuth Options=================================================================
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.enabled: "true"
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.logLevel: DEBUG
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.url: ldap://ldap.marcpartensky.com
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.port: 636
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.baseDN: dc=marcpartensky,dc=com
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.attribute: uid
 
 volumes:
   arch:

services/duplicati.yml

@@ -18,6 +18,19 @@ services:
     labels:
       caddy: duplicati.marcpartensky.com
       caddy.reverse_proxy: "{{upstreams 8200}}"
+      traefik.enable: "true"
+      traefik.http.routers.duplicati.rule: Host(`duplicati.marcpartensky.com`)
+      traefik.http.routers.duplicati.entrypoints: websecure
+      traefik.http.routers.duplicati.tls.certresolver: tls
+      traefik.http.services.duplicati.loadbalancer.server.port: 8200
+    # ldapAuth Options=================================================================
+      traefik.http.routers.duplicati.middlewares: ldap_auth
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.enabled: "true"
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.logLevel: DEBUG
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.url: ldap://ldap.marcpartensky.com
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.port: 389
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.baseDN: dc=marcpartensky,dc=com
+      traefik.http.middlewares.ldap_auth.plugin.ldapAuth.attribute: uid
 
 volumes:
   duplicati_config:

services/ipsec.yml

@@ -0,0 +1,15 @@
+version: "3.9"
+services:
+  ipsec:
+    image: hwdsl2/ipsec-vpn-server
+    restart: unless-stopped
+    privileged: true
+    ports:
+      - "500:500/udp"
+      - "4500:4500/udp"
+    volumes:
+      - ikev2-vpn:/etc/ipsec.d
+      - /lib/modules:/lib/modules:ro
+
+volumes:
+  ikev2-vpn:

services/mongo.yml

@@ -34,7 +34,7 @@ services:
       traefik.http.routers.mongo.rule: Host(`mongo.marcpartensky.com`)
       traefik.http.routers.mongo.entrypoints: websecure
       traefik.http.routers.mongo.tls.certresolver: tls
-      traefik.http.services.mongo.loadbalancer.server.port: 80
+      traefik.http.services.mongo.loadbalancer.server.port: 8081
 
 volumes:
   mongo:

services/traefik.yml

@@ -3,38 +3,38 @@ version: "3.9"
 services:
   traefik:
     image: traefik
-    env_file:
-      - ../data/secrets/traefik.env
+    # env_file:
+    #   - ../data/secrets/traefik.env
     restart: unless-stopped
-    command:
-      ## Provider Settings - https://docs.traefik.io/providers/docker/#provider-configuration ##
-      # - --providers.docker.exposedbydefault=false # <== Don't expose every container to traefik, only expose enabled ones
-      - --providers.file.filename=/dynamic.yaml # <== Referring to a dynamic configuration file
-      # - --providers.docker.network=web # <== Operate on the docker network named web
-      - --providers.docker=true # <== Enabling docker as the provider for traefik
-      ## API Settings - https://docs.traefik.io/operations/api/, endpoints - https://docs.traefik.io/operations/api/#endpoints ##
-      - --api.insecure=false # <== Enabling insecure api, NOT RECOMMENDED FOR PRODUCTION
-      - --api.dashboard=true
-      - --api.debug=true # <== Enabling additional endpoints for debugging and profiling
-      ## Entrypoints Settings - https://docs.traefik.io/routing/entrypoints/#configuration ##
-      - --entrypoints.web.address=:80
-      - --entrypoints.websecure.address=:443
-      - --certificatesresolvers.tls.acme.tlschallenge=true # <== Enable TLS-ALPN-01 to generate and renew ACME certs
-      - --certificatesresolvers.tls.acme.email=marc.partensky@gmail.com
-      - --certificatesresolvers.tls.acme.storage=/letsencrypt/acme.json # Log Settings (options: ERROR, DEBUG, PANIC, FATAL, WARN, INFO) - https://docs.traefik.io/observability/logs/ ##
-      - --log.level=DEBUG # <== Setting the level of the logs from traefik
-      - --entrypoints.web.http.redirections.entryPoint.to=websecure
-      - --entrypoints.web.http.redirections.entryPoint.scheme=https
-      - --entrypoints.web.http.redirections.entrypoint.permanent=true
+    # command:
+    #   ## Provider Settings - https://docs.traefik.io/providers/docker/#provider-configuration ##
+    #   # - --providers.docker.exposedbydefault=false # <== Don't expose every container to traefik, only expose enabled ones
+    #   - --providers.file.filename=/dynamic.yaml # <== Referring to a dynamic configuration file
+    #   # - --providers.docker.network=web # <== Operate on the docker network named web
+    #   - --providers.docker=true # <== Enabling docker as the provider for traefik
+    #   ## API Settings - https://docs.traefik.io/operations/api/, endpoints - https://docs.traefik.io/operations/api/#endpoints ##
+    #   - --api.insecure=false # <== Enabling insecure api, NOT RECOMMENDED FOR PRODUCTION
+    #   - --api.dashboard=true
+    #   - --api.debug=true # <== Enabling additional endpoints for debugging and profiling
+    #   ## Entrypoints Settings - https://docs.traefik.io/routing/entrypoints/#configuration ##
+    #   - --entrypoints.web.address=:80
+    #   - --entrypoints.websecure.address=:443
+    #   - --certificatesresolvers.tls.acme.tlschallenge=true # <== Enable TLS-ALPN-01 to generate and renew ACME certs
+    #   - --certificatesresolvers.tls.acme.email=marc.partensky@gmail.com
+    #   - --certificatesresolvers.tls.acme.storage=/letsencrypt/acme.json # Log Settings (options: ERROR, DEBUG, PANIC, FATAL, WARN, INFO) - https://docs.traefik.io/observability/logs/ ##
+    #   - --log.level=DEBUG # <== Setting the level of the logs from traefik
+    #   - --entrypoints.web.http.redirections.entryPoint.to=websecure
+    #   - --entrypoints.web.http.redirections.entryPoint.scheme=https
+    #   - --entrypoints.web.http.redirections.entrypoint.permanent=true
     ports:
       - "80:80"
       - "443:443"
     networks:
       - caddy
     volumes:
+      - ../data/traefik/traefik.yml:/traefik.yml # static configuration
+      - ../data/traefik/dynamic.yml:/dynamic.yml
       - traefik_letsencrypt:/letsencrypt
-      # - ../data/traefik/traefik.yml:/root/.config/traefik.yml # no configuration file
-      # - ./data/traefik/dynamic.yaml:/dynamic.yaml
       - /var/run/docker.sock:/var/run/docker.sock:ro
     labels:
       traefik.enable: "true"
@@ -43,12 +43,16 @@ services:
       traefik.http.routers.traefik.entrypoints: websecure
       traefik.http.routers.traefik.tls.certresolver: tls
       traefik.docker.network: caddy
-      traefik.http.middlewares.test-ldap-auth.plugin.ldapAuth.source: marcpartensky.com
-      traefik.http.middlewares.test-ldap-auth.plugin.ldapAuth.baseDN: dc=marcpartensky,dc=com
-      # traefik.http.routers.redirs.entrypoints: web
+        # traefik.http.middlewares.test-ldap-auth.plugin.ldapAuth.source: marcpartensky.com
+        # traefik.http.middlewares.test-ldap-auth.plugin.ldapAuth.baseDN: dc=marcpartensky,dc=com
+        # # traefik.http.routers.redirs.entrypoints: web
       # traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: https
       # traefik.http.routers.redirs.middlewares: redirect-to-https
       # traefik.http.routers.redirs.rule: hostregexp(`{host:.+}`)
+    deploy:
+      placement:
+        constraints:
+          - node.role == manager
 
 volumes:
   traefik_letsencrypt:

services/website.yml

@@ -80,10 +80,10 @@ services:
       caddy.basicauth: /* bcrypt
       caddy.basicauth.admin: JDJhJDEyJDVRUXdqQllCR2dCSEZ0ZUlaVUZTRE95WXpROFdUcFdXSm4wVGE2TmE4cEkxNHc5Si4venJxCg==
       traefik.enable: "true"
-      traefik.http.routers.website.rule: Host(`db.marcpartensky.com`)
-      traefik.http.routers.website.entrypoints: websecure
-      traefik.http.routers.website.tls.certresolver: tls
-      traefik.http.services.website.loadbalancer.server.port: 8081
+      traefik.http.routers.pgweb.rule: Host(`db.marcpartensky.com`)
+      traefik.http.routers.pgweb.entrypoints: websecure
+      traefik.http.routers.pgweb.tls.certresolver: tls
+      traefik.http.services.pgweb.loadbalancer.server.port: 8081
 
   # postgres_adminer:
   # adminer: