migrate infra from single server to multi-server cluster

2025-12-12 11:41:32 +01:00
parent b1a70673a4
commit 156733f65a
63 changed files with 2219 additions and 3 deletions
@@ -0,0 +1,44 @@
+[global]
+  checkNewVersion = true
+
+[accessLog]
+  filePath = "/access.log"
+# Enable the Dashboard
+[api]
+  dashboard = true
+
+# Write out Traefik logs
+[log]
+  level = "DEBUG"
+  filePath = "/traefik.log"
+
+[entryPoints]
+	[entryPoints.http]
+	  address = ":80"
+	  [entryPoints.http.http.redirections.entryPoint]
+	    to = "https"
+	    scheme = "https"
+
+	[entryPoints.https]
+	  address = ":443"
+	  # [entryPoints.https.http.tls]
+	  #   certResolver = "main"
+
+# Let's Encrypt
+[certificatesResolvers.main.acme]
+  email = "ma@coachhamburg.com"
+  storage = "acme.json"
+  # uncomment to use staging CA for testing
+  # caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
+  # [certificatesResolvers.main.acme.tlsChallenge]
+  [certificatesResolvers.main.acme.dnsChallenge]
+    provider = "digitalocean"
+  # Uncomment to use HTTP validation, like a caveman!
+  # [certificatesResolvers.main.acme.httpChallenge]
+  # 	entryPoint = "http"
+
+# Docker Traefik provider
+[providers.docker]
+  endpoint = "unix:///var/run/docker.sock"
+  swarmMode = true
+  watch = true
@@ -0,0 +1,22 @@
+version: "3.2"
+
+# What is this?
+#
+# This stack exists solely to deploy the traefik_public overlay network, so that
+# other stacks (including traefik-app) can attach to it
+
+services:
+  scratch:
+    image: scratch
+    deploy:
+      replicas: 0
+    networks:
+      - public
+
+networks:
+  public:
+    driver: overlay
+    attachable: true
+    ipam:
+      config:
+        - subnet: 172.16.200.0/24
@@ -0,0 +1 @@
+DO_AUTH_TOKEN=dop_v1_34e88e03c46ded3af8e11389e80abbdc61d89e001058d1fbbb719422f64d91fc
@@ -0,0 +1,53 @@
+version: "3.2"
+
+services:
+  app:
+    image: traefik:v2.9.1
+    env_file: traefik.env
+    # Note below that we use host mode to avoid source nat being applied to our ingress HTTP/HTTPS sessions
+    # Without host mode, all inbound sessions would have the source IP of the swarm nodes, rather than the
+    # original source IP, which would impact logging. If you don't care about this, you can expose ports the
+    # "minimal" way instead
+    ports:
+      - target: 80
+        published: 80
+        protocol: tcp
+        mode: host
+      - target: 443
+        published: 443
+        protocol: tcp
+        mode: host
+      - target: 8080
+        published: 8080
+        protocol: tcp
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /srv/traefik/config:/etc/traefik
+      - /srv/traefik/data/traefik.log:/traefik.log
+      - /srv/traefik/data/access.log:/access.log
+      - /srv/traefik/data/acme.json:/acme.json
+    networks:
+      - traefik_public
+    # Global mode makes an instance of traefik listen on _every_ node, so that regardless of which
+    # node the request arrives on, it'll be forwarded to the correct backend service.
+    deploy:
+      mode: global
+      labels:
+        - "traefik.docker.network=traefik_public"
+        - "traefik.http.routers.api.rule=Host(`traefik.genius.ceo`)"
+        - "traefik.http.routers.api.entrypoints=https"
+        - "traefik.http.routers.api.tls.domains[0].main=genius.ceo"
+        - "traefik.http.routers.api.tls.domains[0].sans=*.genius.ceo"
+        - "traefik.http.routers.api.tls=true"
+        - "traefik.http.routers.api.tls.certresolver=main"
+        - "traefik.http.routers.api.service=api@internal"
+        - "traefik.http.services.dummy.loadbalancer.server.port=9999"
+
+        # uncomment this to enable forward authentication on the traefik api/dashboard
+        #- "traefik.http.routers.api.middlewares=forward-auth"
+      placement:
+        constraints: [node.role == manager]
+
+networks:
+  traefik_public:
+    external: true
				`@@ -0,0 +1 @@`
				`DO_AUTH_TOKEN=dop_v1_34e88e03c46ded3af8e11389e80abbdc61d89e001058d1fbbb719422f64d91fc`