53 lines
2.0 KiB
YAML
53 lines
2.0 KiB
YAML
version: "3.2"
|
|
|
|
services:
|
|
app:
|
|
image: traefik:v2.9.1
|
|
env_file: traefik.env
|
|
# Note below that we use host mode to avoid source nat being applied to our ingress HTTP/HTTPS sessions
|
|
# Without host mode, all inbound sessions would have the source IP of the swarm nodes, rather than the
|
|
# original source IP, which would impact logging. If you don't care about this, you can expose ports the
|
|
# "minimal" way instead
|
|
ports:
|
|
- target: 80
|
|
published: 80
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 443
|
|
published: 443
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 8080
|
|
published: 8080
|
|
protocol: tcp
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- /srv/traefik/config:/etc/traefik
|
|
- /srv/traefik/data/traefik.log:/traefik.log
|
|
- /srv/traefik/data/access.log:/access.log
|
|
- /srv/traefik/data/acme.json:/acme.json
|
|
networks:
|
|
- traefik_public
|
|
# Global mode makes an instance of traefik listen on _every_ node, so that regardless of which
|
|
# node the request arrives on, it'll be forwarded to the correct backend service.
|
|
deploy:
|
|
mode: global
|
|
labels:
|
|
- "traefik.docker.network=traefik_public"
|
|
- "traefik.http.routers.api.rule=Host(`traefik.genius.ceo`)"
|
|
- "traefik.http.routers.api.entrypoints=https"
|
|
- "traefik.http.routers.api.tls.domains[0].main=genius.ceo"
|
|
- "traefik.http.routers.api.tls.domains[0].sans=*.genius.ceo"
|
|
- "traefik.http.routers.api.tls=true"
|
|
- "traefik.http.routers.api.tls.certresolver=main"
|
|
- "traefik.http.routers.api.service=api@internal"
|
|
- "traefik.http.services.dummy.loadbalancer.server.port=9999"
|
|
|
|
# uncomment this to enable forward authentication on the traefik api/dashboard
|
|
#- "traefik.http.routers.api.middlewares=forward-auth"
|
|
placement:
|
|
constraints: [node.role == manager]
|
|
|
|
networks:
|
|
traefik_public:
|
|
external: true |