diff --git a/blog b/blog deleted file mode 160000 index fe0adef..0000000 --- a/blog +++ /dev/null @@ -1 +0,0 @@ -Subproject commit fe0adef332978e1bf14708d3b9a8c9a070449336 diff --git a/compose.yml b/compose.yml index b76f9ed..30785dd 100644 --- a/compose.yml +++ b/compose.yml @@ -41,10 +41,10 @@ services: - ./etc_wireguard:/etc/wireguard environment: - WG_HOST=wg.riverrooks.dev - - PASSWORD_HASH=$2a$12$PzmNEYtQws9ylYYtr1yojuGJvWUOzmJTxzVSO0svSb9NvOeg1BUcC + # - PASSWORD_HASH=$2a$12$PzmNEYtQws9ylYYtr1yojuGJvWUOzmJTxzVSO0svSb9NvOeg1BUcC - WG_PORT=51820 # WireGuard UDP port - - WG_DEFAULT_DNS=1.1.1.1 - - WG_ALLOWED_IPS=10.8.0.0/24, 172.16.0.0/12 + - WG_DEFAULT_DNS=10.8.0.1 + - WG_ALLOWED_IPS=10.8.0.0/24,172.21.0.10 cap_add: - NET_ADMIN @@ -59,34 +59,41 @@ services: - "51820:51820/udp" networks: traefik: {} - frontend: {} labels: - # since by default containers are disabled, we need to enable them - "traefik.enable=true" - # Set a rule for which hostnames will connect + - "traefik.http.services.wg-easy-svc.loadbalancer.server.port=51821" + - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)" - # declare an antrypoint. Websecure is defined in the traefik.yml file - "traefik.http.routers.wg-easy.entrypoints=websecure" - # declare the certificate resolver. Also defined in traefik.yml file - "traefik.http.routers.wg-easy.tls.certresolver=basic" - # set the port which will be proxied to the address - - "traefik.http.services.wg-easy.loadbalancer.server.port=51821" + - "traefik.http.routers.wg-easy.middlewares=auth" + - "traefik.http.routers.wg-easy.service=wg-easy-svc" + + - "traefik.http.routers.wg-easy-private.rule=Host(`wg.dfnk`)" + - "traefik.http.routers.wg-easy-private.entrypoints=websecure" + - "traefik.http.routers.wg-easy-private.tls=true" + - "traefik.http.routers.wg-easy-private.service=wg-easy-svc" + dns: image: dockurr/dnsmasq container_name: defenk-dns volumes: - ./dnsmasq.conf:/etc/dnsmasq.conf restart: always + network_mode: "service:wg-easy" + depends_on: + - wg-easy networks: # Backend network for docker containers to talk to eachother traefik: name: traefik + driver: bridge external: true + ipam: + config: + - subnet: 172.21.0.0/24 # VPN network for external devices to connect to the server frontend: driver: bridge - ipam: - config: - - subnet: 172.20.0.0/24 diff --git a/dnsmasq.conf b/dnsmasq.conf index 5558d05..687ae8d 100644 --- a/dnsmasq.conf +++ b/dnsmasq.conf @@ -3,7 +3,7 @@ server=1.1.1.1 server=8.8.8.8 # Set custom addresses inside the container -address=/watch.dfnk/10.8.0.3 -adrress=/sol.dfnk/10.8.0.1 -address=/who.dfnk/10.h.0.1 -address=/wg.dfnk/10.8.0.1 +address=/sol.dfnk/172.21.0.10 +address=/who.dfnk/172.21.0.10 +address=/wg.dfnk/172.21.0.10 +address=/traefik.dfnk/172.21.0.10 diff --git a/gitea/docker-compose.yml b/gitea/docker-compose.yml deleted file mode 100644 index edbdf9e..0000000 --- a/gitea/docker-compose.yml +++ /dev/null @@ -1,33 +0,0 @@ -networks: - - gitea: - external: false - traefik: - external: true - -services: - server: - image: docker.gitea.com/gitea:1.24.7 - container_name: gitea - environment: - - USER_UID=1010 - - USER_GID=1010 - restart: always - networks: - - gitea - - traefik - volumes: - - ./data/:/data - - /etc/timezone:/etc/timezone:ro - - /etc/localtime:/etc/localtime:ro - ports: - - "22:22" - labels: - - "traefik.enable=true" - - "traefik.http.routers.gitea.rule=Host(`git.riverrooks.dev`)" - - "traefik.http.routers.gitea.entrypoints=websecure" - - "traefik.http.routers.gitea.tls.certresolver=desecresolver" - # Explicitly tell Traefik to send the web traffic to internal port 3000 - - "traefik.http.services.gitea.loadbalancer.server.port=3000" - # Tell Traefik to exclusively use the 'proxy' network to route traffic - - "traefik.docker.network=traefik" diff --git a/matrix/compose.yml b/matrix/compose.yml deleted file mode 100644 index 01c07f0..0000000 --- a/matrix/compose.yml +++ /dev/null @@ -1,77 +0,0 @@ -services: - synapse-db: - image: postgres:16-alpine - container_name: synapse-db - restart: unless-stopped - environment: - POSTGRES_USER: synapse_user - POSTGRES_PASSWORD: ${SYNAPSE_DB_PASSWORD} - POSTGRES_DB: synapse-db - POSTGRES_INITDB_ARGS: "--locale=C --encoding=UTF8" - volumes: - - ./postgres_data:/var/lib/postgresql/data - networks: - - matrix-net - - synapse: - image: matrixdotorg/synapse:latest - container_name: matrix-synapse - restart: unless-stopped - depends_on: - - synapse-db - volumes: - - ./synapse_data:/data - - ./data:/raw-data - environment: - - SYNAPSE_CONFIG_PATH=/data/homeserver.yaml - # Expose internally or to a reverse proxy. - # If using Traefik, omit ports and use labels instead. - labels: - - "traefik.enable=true" - - - "traefik.http.routers.matrix.entrypoints=websecure" - - "traefik.http.routers.matrix.rule=Host(`matrix.riverrooks.dev`)" - - - "traefik.http.routers.matrix.service=matrix-service" - - "traefik.http.services.matrix-service.loadbalancer.server.port=8008" - - - "traefik.http.routers.matrix.tls=true" - - "traefik.http.routers.matrix.tls.certresolver=basic" - - networks: - - matrix-net - - traefik - matrix-delegation: - image: nginx:alpine - container_name: matrix-delegation - restart: unless-stopped - # 1. Using "|" keeps literal newlines so the script executes perfectly - command: > - /bin/sh -c "mkdir -p /usr/share/nginx/html/.well-known/matrix && echo '{\"m.server\": \"matrix.riverrooks.dev:443\"}' > /usr/share/nginx/html/.well-known/matrix/server && nginx -g 'daemon off;'" - labels: - - "traefik.enable=true" - - "traefik.http.routers.matrix-delegation.rule=Host(`riverrooks.dev`) && PathPrefix(`/.well-known/matrix/server`)" - - "traefik.http.routers.matrix-delegation.entrypoints=websecure" - - "traefik.http.routers.matrix-delegation.tls.certresolver=desecresolver" - # 2. Added the traefik network so Traefik can actually reach this container - networks: - - matrix-net - - traefik - mautrix-gmessages: - image: dock.mau.fi/mautrix/gmessages:latest - container_name: mautrix-gmessages - restart: unless-stopped - volumes: - - ./data:/data - networks: - - matrix-net - depends_on: - - synapse-db - - synapse - - -networks: - matrix-net: - driver: bridge - traefik: - external: true diff --git a/traefik.yml b/traefik.yml index 5199d0a..c0658e1 100644 --- a/traefik.yml +++ b/traefik.yml @@ -11,6 +11,9 @@ providers: network: traefik # Do not expose every container automatically exposedByDefault: false + file: + filename: /etc/traefik/traefik.yml + watch: true entryPoints: web: @@ -28,6 +31,8 @@ entryPoints: allowEncodedSlash: true allowEncodedHash: true # This is crucial for Matrix room aliases! + # Declaring the user list + certificatesResolvers: basic: acme: