diff --git a/compose.yml b/compose.yml index 247cd80..8e9fc14 100644 --- a/compose.yml +++ b/compose.yml @@ -1,41 +1,10 @@ # Primary compose file, used to manage the traefik and other network related modules # Other compose files to be run named and used my service -services: - traefik: # This is the proxy for all other services. Using labels it dynamically secures reverse proxies to other containters - image: traefik:v3.6 - container_name: traefik - restart: unless-stopped - dns: - - 1.1.1.1 - - 8.8.8.8 - ports: - - "80:80" - - "443:443" - volumes: - - "/var/run/docker.sock:/var/run/docker.sock" # running as root TODO need to make new user - - "./letsencrypt:/letsencrypt" - - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings - environment: - - DESEC_TOKEN=RnKb69i8npX4HyvLr25NnQ1p25Kr - - LEGO_DISABLE_CNAME_SUPPORT=true - networks: - traefik: - ipv4_address: 172.21.0.10 - labels: - - "traefik.enable=true" - - "traefik.http.routers.dashboard.rule=Host(`traefik.riverrooks.dev`)" - - "traefik.http.routers.dashboard.entrypoints=websecure" - - "traefik.http.routers.dashboard.service=api@internal" - - "traefik.http.routers.dashboard.tls=true" - - "traefik.http.routers.dashboard.tls.certresolver=basic" - # enable auth MIDDLEWARE - - "traefik.http.routers.dashboard.middlewares=auth" - # define auth type and traffic - - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$cnS8Mv7V$$djacpseKy6M4.XbgG4kgb1" +services: wg-easy: - image: ghcr.io/wg-easy/wg-easy - container_name: wg-easy + image: ghcr.io/wg-easy/wg-easy:latest + container_name: wireguard restart: unless-stopped volumes: - ./etc_wireguard:/etc/wireguard @@ -44,45 +13,73 @@ services: # - PASSWORD_HASH=$2a$12$PzmNEYtQws9ylYYtr1yojuGJvWUOzmJTxzVSO0svSb9NvOeg1BUcC - WG_PORT=51820 # WireGuard UDP port - WG_DEFAULT_DNS=10.8.0.1 - - WG_ALLOWED_IPS=10.8.0.0/24,172.21.0.10 - + - WG_ALLOWED_IPS=10.8.0.0/24,172.21.0.10,192.168.1.0/24 cap_add: - NET_ADMIN - SYS_MODULE sysctls: - net.ipv4.conf.all.src_valid_mark=1 - net.ipv4.ip_forward=1 - - # Ports: We map the VPN port (UDP) directly to the host. - # The Web UI (51821) is handled by Traefik labels instead. ports: - - "51820:51820/udp" + - "80:80" + - "443:443" + - "51820:51820/udp" #webui networks: - traefik: {} - + - backend labels: - - "traefik.enable=true" - - "traefik.http.services.wg-easy-svc.loadbalancer.server.port=51821" + - "traefik.enable=true" + - "traefik.http.services.wg-easy-svc.loadbalancer.server.port=51821" - # Configuration for public access with auth middleware - - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)" - - "traefik.http.routers.wg-easy.entrypoints=websecure" - - "traefik.http.routers.wg-easy.tls.certresolver=basic" - - "traefik.http.routers.wg-easy.middlewares=auth" - - "traefik.http.routers.wg-easy.service=wg-easy-svc" + # Configuration for public access with auth middleware + - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)" + - "traefik.http.routers.wg-easy.entrypoints=websecure" + - "traefik.http.routers.wg-easy.tls.certresolver=basic" + - "traefik.http.routers.wg-easy.middlewares=auth" + - "traefik.http.routers.wg-easy.service=wg-easy-svc" + - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$cnS8Mv7V$$djacpseKy6M4.XbgG4kgb1" - # configured for private access with no auth - - "traefik.http.routers.wg-easy-private.rule=Host(`wg.dfnk`)" - - "traefik.http.routers.wg-easy-private.entrypoints=websecure" - # No certresolver here, will mess with browsers - - "traefik.http.routers.wg-easy-private.tls=true" - - "traefik.http.routers.wg-easy-private.service=wg-easy-svc" + # configured for private access with no auth + - "traefik.http.routers.wg-easy-private.rule=Host(`wg.dfnk`)" + - "traefik.http.routers.wg-easy-private.entrypoints=websecure" + # No certresolver here, will mess with browsers + - "traefik.http.routers.wg-easy-private.tls=true" + - "traefik.http.routers.wg-easy-private.service=wg-easy-svc" + traefik: # This is the proxy for all other services. Using labels it dynamically secures reverse proxies to other containters + image: traefik:v3.6 + container_name: traefik + restart: unless-stopped + network_mode: "service:wg-easy" + depends_on: + - wg-easy + # Unsure if I need DNS + # dns: + # - 1.1.1.1 + # - 8.8.8.8 + volumes: + - "/var/run/docker.sock:/var/run/docker.sock" # running as root TODO need to make new user + - "./letsencrypt:/letsencrypt" + - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings + - "./dynamic.yml:/etc/traefik/dynamic.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings + environment: + - DESEC_TOKEN=RnKb69i8npX4HyvLr25NnQ1p25Kr + - LEGO_DISABLE_CNAME_SUPPORT=true + # labels: + # - "traefik.enable=true" + # - "traefik.http.routers.dashboard.rule=Host(`traefik.riverrooks.dev`)" + # - "traefik.http.routers.dashboard.entrypoints=websecure" + # - "traefik.http.routers.dashboard.service=api@internal" + # - "traefik.http.routers.dashboard.tls=true" + # # - "traefik.http.routers.dashboard.tls.certresolver=basic" + # - "traefik.http.dashboard.loadbalancer.server.port=51821" + # # enable auth MIDDLEWARE + # - "traefik.http.routers.dashboard.middlewares=auth" + # # define auth type and traffic dns: image: dockurr/dnsmasq container_name: defenk-dns volumes: - - ./dnsmasq.conf:/etc/dnsmasq.conf + - ./dnsmasq.conf:/etc/dnsmasq.conf restart: always network_mode: "service:wg-easy" depends_on: @@ -90,13 +87,6 @@ services: networks: # Backend network for docker containers to talk to eachother - traefik: - name: traefik - driver: bridge - external: true - ipam: - config: - - subnet: 172.21.0.0/24 - # VPN network for external devices to connect to the server - frontend: + backend: + name: backend driver: bridge diff --git a/dnsmasq.conf b/dnsmasq.conf index d488ec1..e98bb15 100644 --- a/dnsmasq.conf +++ b/dnsmasq.conf @@ -3,5 +3,6 @@ server=1.1.1.1 server=8.8.8.8 # Set custom addresses inside the container -address=/.dfnk/172.21.0.10 +address=/.dfnk/10.8.0.1 address=/proxmox.dfnk/10.8.0.4 +address=/media.dfnk/192.168.1.35 diff --git a/traefik.yml b/traefik.yml index c0658e1..773b269 100644 --- a/traefik.yml +++ b/traefik.yml @@ -12,7 +12,7 @@ providers: # Do not expose every container automatically exposedByDefault: false file: - filename: /etc/traefik/traefik.yml + filename: /etc/traefik/dynamic.yml watch: true entryPoints: