udpated traefik with fallback proxy to the datacenter

access path

.gitignore

@@ -1,3 +1,5 @@
 gitea/data/*
-letsencrypt/acme.json
+letsencrypt/*
 etc_wireguard/*
+matrix/synapse_data/*
+matrix/.env

compose.yml

@@ -1,62 +1,77 @@
-# compose.yml
 # Primary compose file, used to manage the traefik and other network related modules
 # Other compose files to be run named and used my service
+
 services:
-  traefik: # This is the proxy for all other services. Using labels it dynamically secures reverse proxies to other containters
-    image: traefik:v3.6
-    container_name: traefik
-    restart: unless-stopped
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock"
-      - "./letsencrypt:/letsencrypt"
-      - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
-    networks:
-      - traefik
   wg-easy:
-    image: ghcr.io/wg-easy/wg-easy
-    container_name: wg-easy
+    image: ghcr.io/wg-easy/wg-easy:15
+    container_name: wireguard
     restart: unless-stopped
     volumes:
       - ./etc_wireguard:/etc/wireguard
     environment:
-      # Required settings
-      - WG_HOST=wg.riverrooks.dev
-      
-      # Optional settings
-      - WG_PORT=51820                 # WireGuard UDP port
-      - WG_DEFAULT_DNS=1.1.1.1
-      - WG_ALLOWED_IPS=10.8.0.0/24
-      
+      - PORT=51821
+      - INSECURE=true
     cap_add:
       - NET_ADMIN
       - SYS_MODULE
     sysctls:
       - net.ipv4.conf.all.src_valid_mark=1
       - net.ipv4.ip_forward=1
-
-    # Ports: We map the VPN port (UDP) directly to the host.
-    # The Web UI (51821) is handled by Traefik labels instead.
     ports:
+      - "80:80"
+      - "443:443"
       - "51820:51820/udp"
-
     networks:
-      - traefik
-
+      - backend
+    dns:
+      - 1.1.1.1
+      - 8.8.8.8
     labels:
-        # since by default containers are disabled, we need to enable them
-        - "traefik.enable=true"
-        # Set a rule for which hostnames will connect
-        - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
-        # declare an antrypoint. Websecure is defined in the traefik.yml file
-        - "traefik.http.routers.wg-easy.entrypoints=websecure"
-        # declare the certificate resolver. Also defined in traefik.yml file
-        - "traefik.http.routers.wg-easy.tls.certresolver=basic-letsencrypt"
-        # set the port which will be proxied to the address
-        - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
+      - "traefik.enable=true"
+      - "traefik.http.services.wg-easy-svc.loadbalancer.server.port=51821"
+
+      # Configuration for public access with auth middleware
+      - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
+      - "traefik.http.routers.wg-easy.entrypoints=websecure"
+      - "traefik.http.routers.wg-easy.tls.certresolver=basic"
+      - "traefik.http.routers.wg-easy.middlewares=auth"
+      - "traefik.http.routers.wg-easy.service=wg-easy-svc"
+      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$cnS8Mv7V$$djacpseKy6M4.XbgG4kgb1"
+
+      # configured for private access with no auth
+      - "traefik.http.routers.wg-easy-private.rule=Host(`wg.dfnk`)"
+      - "traefik.http.routers.wg-easy-private.entrypoints=websecure"
+      # No certresolver here, will mess with browsers
+      - "traefik.http.routers.wg-easy-private.tls=true"
+      - "traefik.http.routers.wg-easy-private.service=wg-easy-svc"
+
+  traefik: # This is the proxy for all other services. Using labels it dynamically secures reverse proxies to other containters
+    image: traefik:v3.6
+    container_name: traefik
+    restart: unless-stopped
+    network_mode: "service:wg-easy"
+    depends_on:
+      - wg-easy
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock" # running as root TODO need to make new user
+      - "./letsencrypt:/letsencrypt"
+      - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
+      - "./dynamic.yml:/etc/traefik/dynamic.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
+    environment:
+      - DESEC_TOKEN=RnKb69i8npX4HyvLr25NnQ1p25Kr
+      - LEGO_DISABLE_CNAME_SUPPORT=true
+  dns:
+    image: dockurr/dnsmasq
+    container_name: defenk-dns
+    volumes:
+      - ./dnsmasq.conf:/etc/dnsmasq.conf
+    restart: always
+    network_mode: "service:wg-easy"
+    depends_on:
+      - wg-easy
 
 networks:
-  traefik:
-    external: true
+  # Backend network for docker containers to talk to eachother
+  backend:
+    name: backend
+    driver: bridge

dnsmasq.conf

@@ -0,0 +1,8 @@
+# forward default traffic
+server=1.1.1.1
+server=8.8.8.8
+
+# Set custom addresses inside the container
+address=/.dfnk/10.8.0.1
+address=/proxmox.dfnk/10.8.0.2
+address=/media.dfnk/192.168.1.35

dynamic.yml

@@ -0,0 +1,31 @@
+http:
+  routers:
+    media-fallback-public:
+      # rule: "HostRegexp(`{host:.+}`)" 
+      # rule: "Host(`whoami1.riverrooks.dev`)"
+      # rule: "Host(`*.riverrooks.dev`)"
+      rule: 'HostRegexp(`^[a-z0-9-]+\.riverrooks\.dev$`)'
+      priority: 1
+      entrypoints:
+        - websecure
+      service: remote-traefik-svc
+      tls:
+        certResolver: desecresolver # Here the VPS terminates TLS
+        domains:
+          - main: "riverrooks.dev"
+            sans:
+              - "*.riverrooks.dev"
+
+    media-fallback-private:
+      rule: 'HostRegexp(`^[a-z0-9-]+\.dfnk$`)'
+      priority: 1
+      entrypoints:
+        - websecure
+      service: remote-traefik-svc
+      tls: {}
+
+  services:
+    remote-traefik-svc:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:80"

dynamic.yml.bkp

@@ -0,0 +1,211 @@
+http:
+  routers:
+    traefik-dashboard:
+      rule: "Host(`traefik.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "api@internal"
+      tls: {}
+    proxmox-main:
+      rule: "Host(`prox.dfnk`)"
+      entrypoints: 
+        - "websecure"
+      service: "proxmox-main-service"
+      tls: {}
+    jellyfin-private:
+      rule: "Host(`watch.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "jellyfin-main-service"
+      tls: {}
+    jellyfin-public:
+      rule: "Host(`watch.riverrooks.dev`)"
+      entrypoints:
+        - "websecure"
+      service: "jellyfin-main-service"
+      tls:
+        certResolver: "basic"
+    homepage:
+      rule: "Host(`home.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "homepage-main-service"
+      tls: {}
+    qbittorrent:
+      rule: "Host(`tor.dfnk`)"
+      entrypoints:
+        - "websecure"
+      tls: {}
+      service: "qbittorrent-main-service"
+    seer:
+      rule: "Host(`seer.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "seer-main-service"
+      tls: {}
+    radarr:
+      rule: "Host(`radarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "radarr-main-service"
+      tls: {}
+    sonarr:
+      rule: "Host(`sonarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "sonarr-main-service"
+      tls: {}
+    lidarr:
+      rule: "Host(`lidarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "lidarr-main-service"
+      tls: {}
+    readarr:
+      rule: "Host(`readarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "readarr-main-service"
+      tls: {}
+    prowlarr:
+      rule: "Host(`prowlarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "prowlarr-main-service"
+      tls: {}
+    bazarr:
+      rule: "Host(`bazarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "bazarr-main-service"
+      tls: {}
+    dockge:
+      rule: "Host(`dockge.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "dockge-main-service"
+      tls: {}
+    uptime:
+      rule: "Host(`uptime.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "uptime-main-service"
+      tls: {}
+    files:
+      rule: "Host(`files.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "filebrowser-main-service"
+      tls: {}
+    truenas:
+      rule: "Host(`truenas.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "truenas-main-service"
+      tls: {}
+    soulseek:
+      rule: "Host(`slsk.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "soulseek-main-service"
+      tls: {}
+    navidrome:
+      rule: "Host(`music.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "navidrome-main-service"
+      tls: {}
+    navidrome-public:
+      rule: "Host(`music.riverrooks.dev`)"
+      entrypoints:
+        - "websecure"
+      service: "navidrome-main-service"
+      tls:
+        certResolver: "basic"
+
+  services:
+    proxmox-main-service:
+      loadbalancer:
+        servers:
+          - url: "https://10.8.0.2:8006"
+        serversTransport: "insecure-backend"
+    jellyfin-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:8096"
+    qbittorrent-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:8080"
+    homepage-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:3000"
+    radarr-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:7878"
+    seer-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:5055"
+    sonarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:8989"
+    lidarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:8686"
+        # serversTransport: "insecure-backend"
+    readarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:8787"
+        # serversTransport: "insecure-backend"
+    bazarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:6767"
+        # serversTransport: "insecure-backend"
+    prowlarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:9696"
+        # serversTransport: "insecure-backend"
+    dockge-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:5001"
+        # serversTransport: "insecure-backend"
+    filebrowser-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:8085"
+        # serversTransport: "insecure-backend"
+    uptime-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:3002"
+    truenas-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.34"
+        # serversTransport: "insecure-backend"
+    soulseek-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:5030"
+    navidrome-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:4533"
+
+  serversTransports:
+    insecure-backend:
+      insecureSkipVerify: true
+
+tls:
+  certificates:
+    - certFile: /letsencrypt/_wildcard.dfnk.pem
+      keyFile: /letsencrypt/_wildcard.dfnk-key.pem

gitea/docker-compose.yml

@@ -1,33 +0,0 @@
-networks:
-
-  gitea:
-    external: false
-  traefik:
-    external: true
-
-services:
-  server:
-    image: docker.gitea.com/gitea:1.24.7
-    container_name: gitea
-    environment:
-      - USER_UID=1010
-      - USER_GID=1010
-    restart: always
-    networks:
-      - gitea
-      - traefik
-    volumes:
-      - ./data/:/data
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-    ports:
-      - "22:22"
-    labels:
-        - "traefik.enable=true"
-        - "traefik.http.routers.gitea.rule=Host(`git.riverrooks.dev`)"
-        - "traefik.http.routers.gitea.entrypoints=websecure"
-        - "traefik.http.routers.gitea.tls.certresolver=myresolver"
-        # Explicitly tell Traefik to send the web traffic to internal port 3000
-        - "traefik.http.services.gitea.loadbalancer.server.port=3000"
-        # Tell Traefik to exclusively use the 'proxy' network to route traffic
-        - "traefik.docker.network=traefik"

traefik.yml

@@ -1,5 +1,6 @@
 # traefik.yml
 # yml file to define traefik global settings. Individual containers get lables to define their own settings
+# Static config file loaded on boot, [[dynamic.yml]] has the dynamic config for container routing
 
 api:
   dashboard: true
@@ -11,6 +12,9 @@ providers:
     network: traefik
     # Do not expose every container automatically
     exposedByDefault: false
+  file:
+    filename: /etc/traefik/dynamic.yml
+    watch: true
 
 entryPoints:
   web:
@@ -23,11 +27,28 @@ entryPoints:
           scheme: https
   websecure:
     address: ":443"
+    http:
+      encodedCharacters:
+        allowEncodedSlash: true
+        allowEncodedHash: true  # This is crucial for Matrix room aliases!
+
+        # Declaring the user list
 
 certificatesResolvers:
-  myresolver:
+  basic:
     acme:
       email: web-admin@riverrooks.art
       storage: /letsencrypt/acme.json
       # Use the TLS challenge for domain verification
       tlsChallenge: {}
+  desecresolver:
+    # TODO fix desecresolver  and dns cert partitioning
+    acme:
+      email: web-admin@riverrooks.art
+      storage: /letsencrypt/acme.json
+      dnsChallenge:
+        provider: desec
+        delayBeforeCheck: 15
+        resolvers:
+          - "1.1.1.1:53"
+          - "8.8.8.8:53"

wg-easy/compose.yml

@@ -1,40 +0,0 @@
-services:
-  wg-easy:
-    image: ghcr.io/wg-easy/wg-easy
-    container_name: wg-easy
-    restart: unless-stopped
-    volumes:
-      - ./etc_wireguard:/etc/wireguard
-    environment:
-      # Required settings
-      - WG_HOST=wg.riverrooks.dev
-      
-      # Optional settings
-      - WG_PORT=51820                 # WireGuard UDP port
-      - WG_DEFAULT_DNS=1.1.1.1
-      - WG_ALLOWED_IPS=10.8.0.0/24
-      
-    cap_add:
-      - NET_ADMIN
-      - SYS_MODULE
-    sysctls:
-      - net.ipv4.conf.all.src_valid_mark=1
-      - net.ipv4.ip_forward=1
-
-    # Ports: We map the VPN port (UDP) directly to the host.
-    # The Web UI (51821) is handled by Traefik labels instead.
-    ports:
-      - "51820:51820/udp"
-
-    networks:
-      - traefik
-
-    labels:
-        - "traefik.enable=true"
-        - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
-        - "traefik.http.routers.wg-easy.entrypoints=websecure"
-        - "traefik.http.routers.wg-easy.tls.certresolver=myresolver"
-        - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
-networks:
-  traefik:
-    external: true

whoami.yml

@@ -1,16 +1,20 @@
+# whoami.yml works as a nice tester to check if the network is exposed
 services:
   whoami:
       image: traefik/whoami
-      container_name: whoami
+      container_name: whoami-public
       restart: unless-stopped
       labels:
         - "traefik.enable=true"
-        - "traefik.http.routers.whoami.rule=Host(`whoami.riverrooks.dev`) || Host(`whoami.riverrooks.art`) || Host(`10.8.0.1`)"
+        - "traefik.http.routers.whoami.rule=Host(`whoami.riverrooks.dev`) || Host(`whoami.riverrooks.art`)"
         - "traefik.http.routers.whoami.entrypoints=websecure"
-        - "traefik.http.routers.whoami.tls.certresolver=basic-letsencrypt"
+        - "traefik.http.routers.whoami.tls.certresolver=basic"
+
+        - "traefik.http.routers.whoami-private.rule=Host(`whoami.dfnk`)"
+        - "traefik.http.routers.whoami-private.entrypoints=websecure"
+        - "traefik.http.routers.whoami-private.tls=true"
       networks:
         - traefik
-
 networks:
   traefik:
     external: true