From a9af3c74c81f42d021af56196bf8d1b0421c5314 Mon Sep 17 00:00:00 2001 From: TuDatTr Date: Tue, 15 Aug 2023 04:16:51 +0200 Subject: [PATCH] Switched to nginx proxy manager Signed-off-by: TuDatTr --- group_vars/all/vars.yml | 30 ++++-- roles/docker/tasks/nginx-proxy-manager.yml | 13 +++ roles/docker/tasks/pi_compose.yml | 4 +- roles/docker/tasks/pihole.yml | 9 ++ roles/docker/tasks/traefik.yml | 7 ++ roles/docker/templates/aya01/compose.yaml | 98 +++---------------- .../pihole/etc-dnsmasq/02-wildcard-dns.conf | 3 + .../common/traefik/etc-traefik/traefik.yml | 13 +++ roles/docker/templates/pi/compose.yaml | 30 +++--- 9 files changed, 98 insertions(+), 109 deletions(-) create mode 100644 roles/docker/tasks/nginx-proxy-manager.yml create mode 100644 roles/docker/templates/common/pihole/etc-dnsmasq/02-wildcard-dns.conf diff --git a/group_vars/all/vars.yml b/group_vars/all/vars.yml index 1927fc8..0e24804 100644 --- a/group_vars/all/vars.yml +++ b/group_vars/all/vars.yml @@ -172,12 +172,16 @@ kuma_config: "{{ docker_dir }}/kuma/" # Traefik # -traefik_host: "traefik" -traefik_user_port: "80" -traefik_admin_port: "8080" - -traefik_config: "{{ docker_dir }}/traefik/etc-traefik/" -traefik_data: "{{ docker_dir }}/traefik/var-log/" +traefik: + host: "traefik" + admin: + port: "8080" + config: "{{ docker_dir }}/traefik/etc-traefik/" + data: "{{ docker_dir }}/traefik/var-log/" + letsencrypt: "{{ docker_dir }}/traefik/letsencrypt/" + user: + web: "80" + websecure: "443" # # DynDns Updater @@ -451,3 +455,17 @@ stirling: host: "stirling" dns: "pdf" port: 8084 + +# +# nginx proxy manager +# + +nginx: + host: "nginx" + endpoints: + http: 80 + https: 443 + admin: 8080 + paths: + letsencrypt: "{{docker_dir}}/nginx/letsencrypt" + data: "{{docker_dir}}/nginx/data" diff --git a/roles/docker/tasks/nginx-proxy-manager.yml b/roles/docker/tasks/nginx-proxy-manager.yml new file mode 100644 index 0000000..c6a7328 --- /dev/null +++ b/roles/docker/tasks/nginx-proxy-manager.yml @@ -0,0 +1,13 @@ +--- + +- name: Create nginx-data directory + file: + path: "{{ item }}" + owner: "{{ puid }}" + group: "{{ pgid }}" + mode: '755' + state: directory + loop: + - "{{ nginx.paths.letsencrypt }}" + - "{{ nginx.paths.data }}" + become: yes diff --git a/roles/docker/tasks/pi_compose.yml b/roles/docker/tasks/pi_compose.yml index 21f3435..a4fa09b 100644 --- a/roles/docker/tasks/pi_compose.yml +++ b/roles/docker/tasks/pi_compose.yml @@ -1,8 +1,8 @@ --- -- include_tasks: traefik.yml +- include_tasks: nginx-proxy-manager.yml tags: - - traefik + - nginx - include_tasks: pihole.yml tags: diff --git a/roles/docker/tasks/pihole.yml b/roles/docker/tasks/pihole.yml index 123193b..a98e2ba 100644 --- a/roles/docker/tasks/pihole.yml +++ b/roles/docker/tasks/pihole.yml @@ -10,3 +10,12 @@ - "{{ docker_dir }}/pihole/etc-pihole/" - "{{ docker_dir }}/pihole/etc-dnsmasq.d/" become: true + + +- name: Copy wildcard config + template: + owner: "{{ puid }}" + src: "templates/common/pihole/etc-dnsmasq/02-wildcard-dns.conf" + dest: "{{ docker_dir }}/pihole/etc-dnsmasq.d/02-wildcard-dns.conf" + mode: '660' + become: true diff --git a/roles/docker/tasks/traefik.yml b/roles/docker/tasks/traefik.yml index 222955f..d69ceaa 100644 --- a/roles/docker/tasks/traefik.yml +++ b/roles/docker/tasks/traefik.yml @@ -9,3 +9,10 @@ loop: - "{{ docker_dir }}/traefik/etc-traefik/" - "{{ docker_dir }}/traefik/var-log/" + +- name: Copy traefik-config + template: + owner: 1000 + src: "templates/common/traefik/etc-traefik/traefik.yml" + dest: "{{ traefik.config }}" + mode: '400' diff --git a/roles/docker/templates/aya01/compose.yaml b/roles/docker/templates/aya01/compose.yaml index 26de969..4e6de9a 100644 --- a/roles/docker/templates/aya01/compose.yaml +++ b/roles/docker/templates/aya01/compose.yaml @@ -1,26 +1,26 @@ version: '3' services: - traefik: - image: traefik:latest - container_name: traefik + nginx: + container_name: "{{nginx.host}}" + image: 'jc21/nginx-proxy-manager:latest' restart: unless-stopped networks: net: {} - volumes: - - "/etc/localtime:/etc/localtime:ro" - - "/var/run/docker.sock:/var/run/docker.sock:ro" - - "{{ traefik_config }}:/etc/traefik/" - - "{{ traefik_data }}:/var/log/" ports: - - "{{ traefik_user_port}}:80" - - "{{ traefik_admin_port}}:8080" + - '{{nginx.endpoints.http}}:80' + - '{{nginx.endpoints.https}}:443' + - '{{nginx.endpoints.admin}}:81' + volumes: + - "{{nginx.paths.data}}:/data" + - "{{nginx.paths.letsencrypt}}:/etc/letsencrypt" + - '/var/run/docker.sock:/var/run/docker.sock' pihole: - image: pihole/pihole:latest container_name: pihole + image: pihole/pihole:latest restart: unless-stopped depends_on: - - traefik + - nginx networks: - net ports: @@ -46,10 +46,6 @@ services: - 1.1.1.1 cap_add: - NET_ADMIN - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{ pihole_host }}.rule=Host(`{{ pihole_host }}.{{ aya01_host }}.{{ local_domain }}`)" - - "traefik.http.services.{{ pihole_host }}.loadbalancer.server.port=80" syncthing: image: syncthing/syncthing @@ -71,10 +67,6 @@ services: - PGID={{pgid}} - TZ={{timezone}} hostname: syncthing - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{ syncthing_host }}.rule=Host(`{{ syncthing_host }}.{{ aya01_host }}.{{ local_domain }}`)" - - "traefik.http.services.{{ syncthing_host }}.loadbalancer.server.port={{ syncthing_port }}" cupsd: container_name: cupsd @@ -93,10 +85,6 @@ services: volumes: - /var/run/dbus:/var/run/dbus - "{{cupsd_config}}:/etc/cups" - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{ cupsd_host }}.rule=Host(`{{ cupsd_host }}.{{ aya01_host }}.{{local_domain}}`)" - - "traefik.http.services.{{ cupsd_host }}.loadbalancer.server.port={{ cupsd_port }}" kuma: container_name: kuma @@ -114,10 +102,6 @@ services: - "{{ kuma_port }}:3001" volumes: - "{{ kuma_config }}:/app/data" - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{kuma_host}}.rule=Host(`{{ kuma_host }}.{{ aya01_host }}.{{local_domain}}`)" - - "traefik.http.services.{{kuma_host}}.loadbalancer.server.port={{ kuma_port }}" plex: image: lscr.io/linuxserver/plex:latest @@ -148,10 +132,6 @@ services: - "{{ plex_tv }}:/tv" - "{{ plex_movies }}:/movies" - "{{ plex_music }}:/music" - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{plex_host}}.rule=Host(`{{ plex_host }}.{{ aya01_host }}.{{local_domain}}`)" - - "traefik.http.services.{{plex_host}}.loadbalancer.server.port={{ plex_port }}" sonarr: image: lscr.io/linuxserver/sonarr:latest @@ -171,10 +151,6 @@ services: - {{ sonarr_downloads }}:/downloads #optional ports: - {{ sonarr_port }}:8989 - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{sonarr_host}}.rule=Host(`{{ sonarr_host }}.{{ aya01_host }}.{{local_domain}}`)" - - "traefik.http.services.{{sonarr_host}}.loadbalancer.server.port={{ sonarr_port }}" radarr: image: lscr.io/linuxserver/radarr:latest @@ -194,10 +170,6 @@ services: - {{ radarr_downloads }}:/downloads #optional ports: - {{ radarr_port }}:7878 - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{radarr_host}}.rule=Host(`{{ radarr_host }}.{{ aya01_host }}.{{local_domain}}`)" - - "traefik.http.services.{{radarr_host}}.loadbalancer.server.port={{ radarr_port }}" lidarr: image: lscr.io/linuxserver/lidarr:latest @@ -217,10 +189,6 @@ services: - {{ lidarr_downloads }}:/downloads #optional ports: - {{ lidarr_port }}:8686 - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{lidarr_host}}.rule=Host(`{{ lidarr_host }}.{{ aya01_host }}.{{local_domain}}`)" - - "traefik.http.services.{{lidarr_host}}.loadbalancer.server.port={{ lidarr_port }}" prowlarr: image: lscr.io/linuxserver/prowlarr:latest @@ -238,10 +206,6 @@ services: - {{ prowlarr_config }}:/config ports: - {{ prowlarr_port }}:9696 - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{prowlarr_host}}.rule=Host(`{{ prowlarr_host }}.{{ aya01_host }}.{{local_domain}}`)" - - "traefik.http.services.{{prowlarr_host}}.loadbalancer.server.port={{ prowlarr_port }}" pastebin: image: wantguns/bin @@ -261,10 +225,6 @@ services: - HOST_URL={{ bin_host }}.{{ aya01_host }}.{{ local_domain }} volumes: - {{ bin_upload }}:/app/upload - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{ bin_host }}.rule=Host(`{{ bin_host }}.{{ aya01_host }}.{{ local_domain }}`)" - - "traefik.http.services.{{ bin_host }}.loadbalancer.server.port={{ bin_port }}" tautulli: image: lscr.io/linuxserver/tautulli:latest @@ -282,10 +242,6 @@ services: - {{ tautulli_config}}:/config ports: - {{ tautulli_port }}:8181 - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{ tautulli_host }}.rule=Host(`{{ tautulli_host }}.{{ aya01_host }}.{{ local_domain }}`)" - - "traefik.http.services.{{ tautulli_host }}.loadbalancer.server.port={{ tautulli_port }}" {{ gluetun_host }}: image: qmcgaw/gluetun @@ -312,16 +268,6 @@ services: - SERVER_COUNTRIES={{ gluetun_country }} - OPENVPN_USER={{ vault_qbit_vpn_user }}+pmp - OPENVPN_PASSWORD={{ vault_qbit_vpn_password }} - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{ gluetun_host }}.rule=Host(`{{ gluetun_host }}.{{ aya01_host }}.{{ local_domain }}`)" - - "traefik.http.services.{{ gluetun_host }}.loadbalancer.server.port={{ gluetun_port }}" - - "traefik.http.routers.{{ torrentleech_host }}.service={{ torrentleech_host }}" - - "traefik.http.routers.{{ torrentleech_host }}.rule=Host(`{{ torrentleech_host }}.{{ aya01_host }}.{{ local_domain }}`)" - - "traefik.http.services.{{ torrentleech_host }}.loadbalancer.server.port={{ torrentleech_port }}" - - "traefik.http.routers.{{ qbit_host }}.service={{ qbit_host }}" - - "traefik.http.routers.{{ qbit_host }}.rule=Host(`{{ qbit_host }}.{{ aya01_host }}.{{ local_domain }}`)" - - "traefik.http.services.{{ qbit_host }}.loadbalancer.server.port={{ qbit_port }}" {{ torrentleech_host }}: image: qbittorrentofficial/qbittorrent-nox @@ -380,10 +326,6 @@ services: - prometheus_data:/prometheus/ ports: - {{ prometheus_port }}:9090 - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{ prometheus_host }}.rule=Host(`{{ prometheus_host }}.{{ aya01_host }}.{{ local_domain }}`)" - - "traefik.http.services.{{ prometheus_host }}.loadbalancer.server.port={{ prometheus_port }}" {{ grafana_host }}: image: grafana/grafana-oss @@ -403,10 +345,6 @@ services: - {{ grafana_config }}:/etc/grafana/ ports: - {{ grafana_port }}:3000 - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{ grafana_host }}.rule=Host(`{{ grafana_host }}.{{ aya01_host }}.{{ local_domain }}`)" - - "traefik.http.services.{{ grafana_host }}.loadbalancer.server.port={{ grafana_port }}" ddns-updater: container_name: ddns-updater @@ -420,10 +358,6 @@ services: - "{{ ddns_data }}:/updater/data/" ports: - "{{ ddns_port }}:8000/tcp" - labels: - - "traefik.enable=true" - - "traefik.http.routers.ddns-updater.rule=Host(`{{ ddns_host }}.{{ aya01_host }}.{{local_domain}}`)" - - "traefik.http.services.ddns-updater.loadbalancer.server.port={{ ddns_port }}" homeassistant: container_name: homeassistant @@ -442,10 +376,6 @@ services: - 4357:4357 - 5683:5683 - 5683:5683/udp - labels: - - "traefik.enable=true" - - "traefik.http.routers.homeassistant.rule=Host(`{{ ha_host }}.{{ aya01_host }}.{{ local_domain }}`)" - - "traefik.http.services.homeassistant.loadbalancer.server.port={{ ha_port }}" {{stirling.host}}: container_name: {{stirling.host}} @@ -457,10 +387,6 @@ services: net: {} ports: - '{{stirling.port}}:8080' - labels: - - "traefik.enable=true" - - "traefik.http.routers.{{stirling.host}}.rule=Host(`{{ stirling.dns }}.{{ aya01_host }}.{{ local_domain }}`)" - - "traefik.http.services.{{stirling.host}}.loadbalancer.server.port={{ 8080 }}" networks: zoneminder: diff --git a/roles/docker/templates/common/pihole/etc-dnsmasq/02-wildcard-dns.conf b/roles/docker/templates/common/pihole/etc-dnsmasq/02-wildcard-dns.conf new file mode 100644 index 0000000..c3ad8f6 --- /dev/null +++ b/roles/docker/templates/common/pihole/etc-dnsmasq/02-wildcard-dns.conf @@ -0,0 +1,3 @@ +address=/pi.borg.land/192.168.20.11 +address=/aya01.borg.land/192.168.20.12 +address=/naruto.borg.land/192.168.20.13 diff --git a/roles/docker/templates/common/traefik/etc-traefik/traefik.yml b/roles/docker/templates/common/traefik/etc-traefik/traefik.yml index 077da0c..266e754 100644 --- a/roles/docker/templates/common/traefik/etc-traefik/traefik.yml +++ b/roles/docker/templates/common/traefik/etc-traefik/traefik.yml @@ -10,6 +10,7 @@ entryPoints: providers: docker: endpoint: "unix:///var/run/docker.sock" + exposedbydefault: "false" # API and dashboard configuration api: @@ -21,3 +22,15 @@ log: accessLog: filePath: "/var/log/access.log" + +certificatesResolvers: + myresolver: + acme: + email: "me+cert@tudattr.dev" + storage: "/letsencrypt/acme.json" + dnsChallenge: + provider: "namecheap" + +metrics: + prometheus: + entrypoint: "traefik" diff --git a/roles/docker/templates/pi/compose.yaml b/roles/docker/templates/pi/compose.yaml index 72b4cf6..0cfd5a4 100644 --- a/roles/docker/templates/pi/compose.yaml +++ b/roles/docker/templates/pi/compose.yaml @@ -1,23 +1,27 @@ version: '3' services: - traefik: - container_name: traefik - image: traefik:latest + nginx: + container_name: "{{nginx.host}}" + image: 'jc21/nginx-proxy-manager:latest' restart: unless-stopped networks: net: {} - volumes: - - "/etc/localtime:/etc/localtime:ro" - - "/var/run/docker.sock:/var/run/docker.sock:ro" - - "{{ traefik_config }}:/etc/traefik/" - - "{{ traefik_data }}:/var/log/" ports: - - "{{ traefik_user_port }}:80" - - "{{ traefik_admin_port }}:8080" + - '{{nginx.endpoints.http}}:80' + - '{{nginx.endpoints.https}}:443' + - '{{nginx.endpoints.admin}}:81' + volumes: + - "{{nginx.paths.data}}:/data" + - "{{nginx.paths.letsencrypt}}:/etc/letsencrypt" + - '/var/run/docker.sock:/var/run/docker.sock' + + pihole: container_name: pihole image: pihole/pihole:latest restart: unless-stopped + depends_on: + - nginx networks: net: {} ports: @@ -26,7 +30,7 @@ services: - "67:67/udp" - "{{ pihole_port }}:80/tcp" environment: - - "WEBPASSWORD={{ vault_pi_pihole_password }}" + - "WEBPASSWORD={{ vault.pi.pihole.password }}" - "ServerIP=192.168.20.11" - "INTERFACE=eth0" - "DNS1=1.1.1.1" @@ -40,10 +44,6 @@ services: - 1.1.1.1 cap_add: - NET_ADMIN - labels: - - "traefik.enable=true" - - "traefik.http.routers.pihole.rule=Host(`{{ pihole_host }}.{{ pi_host }}.{{ local_domain }}`)" - - "traefik.http.services.pihole.loadbalancer.server.port={{ 80 }}" networks: net: