traefik working

.gitignore

@@ -1,3 +1,3 @@
 gitea/data/*
-letsencrypt/acme.json
+letsencrypt/*
 etc_wireguard/*

compose.yml

@@ -1,4 +1,3 @@
-# compose.yml
 # Primary compose file, used to manage the traefik and other network related modules
 # Other compose files to be run named and used my service
 services:
@@ -10,11 +9,29 @@ services:
       - "80:80"
       - "443:443"
     volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock"
+      - "/var/run/docker.sock:/var/run/docker.sock" # running as root TODO need to make new user
       - "./letsencrypt:/letsencrypt"
       - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
     networks:
-      - traefik
+      traefik:
+        ipv4_address: 172.21.0.10
+    labels:
+      - "traefik.enable=true"
+
+      - "traefik.http.routers.dashboard.rule=Host(`traefik.riverrooks.dev`)"
+      - "traefik.http.routers.dashboard.entrypoints=websecure"
+      - "traefik.http.routers.dashboard.service=api@internal"
+
+      - "traefik.http.routers.dashboard.tls=true"
+      - "traefik.http.routers.dashboard.tls.certresolver=basic"
+
+
+      #  MIDDLEWARE
+      #  enable auth MIDDLEWARE
+      - "traefik.http.routers.dashboard.middlewares=auth"
+      #  define auth type and traffic
+      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$cnS8Mv7V$$djacpseKy6M4.XbgG4kgb1"
+
   wg-easy:
     image: ghcr.io/wg-easy/wg-easy
     container_name: wg-easy
@@ -27,7 +44,7 @@ services:
       
       # Optional settings
       - WG_PORT=51820                 # WireGuard UDP port
-      - WG_DEFAULT_DNS=1.1.1.1
+      - WG_DEFAULT_DNS=dns
       - WG_ALLOWED_IPS=10.8.0.0/24
       
     cap_add:
@@ -41,9 +58,10 @@ services:
     # The Web UI (51821) is handled by Traefik labels instead.
     ports:
       - "51820:51820/udp"
-
     networks:
-      - traefik
+      traefik: {}
+      dfnk:
+        ipv4_address: 10.8.0.2
 
     labels:
         # since by default containers are disabled, we need to enable them
@@ -53,10 +71,22 @@ services:
         # declare an antrypoint. Websecure is defined in the traefik.yml file
         - "traefik.http.routers.wg-easy.entrypoints=websecure"
         # declare the certificate resolver. Also defined in traefik.yml file
-        - "traefik.http.routers.wg-easy.tls.certresolver=basic-letsencrypt"
+        - "traefik.http.routers.wg-easy.tls.certresolver=basic"
         # set the port which will be proxied to the address
         - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
+  dns:
+    image: dockurr/dnsmasq
+    container_name: defenk-dns
+    volumes:
+    - ./dnsmasq.conf:/etc/dnsmasq.conf
+    restart: always
 
 networks:
   traefik:
+    name: traefik
     external: true
+  dfnk:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 10.8.0.0/24

dnsmasq.conf

@@ -0,0 +1,9 @@
+# forward default traffic
+server=1.1.1.1
+server=8.8.8.8
+
+# Set custom addresses inside the container
+address=/watch.dfnk/10.8.0.3
+adrress=/sol.dfnk/10.8.0.1
+address=/who.dfnk/10.h.0.1
+address=/wg.dfnk/10.8.0.1

traefik.yml

@@ -25,7 +25,7 @@ entryPoints:
     address: ":443"
 
 certificatesResolvers:
-  myresolver:
+  basic:
     acme:
       email: web-admin@riverrooks.art
       storage: /letsencrypt/acme.json

wg-easy/compose.yml

@@ -1,40 +0,0 @@
-services:
-  wg-easy:
-    image: ghcr.io/wg-easy/wg-easy
-    container_name: wg-easy
-    restart: unless-stopped
-    volumes:
-      - ./etc_wireguard:/etc/wireguard
-    environment:
-      # Required settings
-      - WG_HOST=wg.riverrooks.dev
-      
-      # Optional settings
-      - WG_PORT=51820                 # WireGuard UDP port
-      - WG_DEFAULT_DNS=1.1.1.1
-      - WG_ALLOWED_IPS=10.8.0.0/24
-      
-    cap_add:
-      - NET_ADMIN
-      - SYS_MODULE
-    sysctls:
-      - net.ipv4.conf.all.src_valid_mark=1
-      - net.ipv4.ip_forward=1
-
-    # Ports: We map the VPN port (UDP) directly to the host.
-    # The Web UI (51821) is handled by Traefik labels instead.
-    ports:
-      - "51820:51820/udp"
-
-    networks:
-      - traefik
-
-    labels:
-        - "traefik.enable=true"
-        - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
-        - "traefik.http.routers.wg-easy.entrypoints=websecure"
-        - "traefik.http.routers.wg-easy.tls.certresolver=myresolver"
-        - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
-networks:
-  traefik:
-    external: true

whoami.yml

@@ -1,13 +1,25 @@
+# whoami.yml works as a nice tester to check if the network is exposed
 services:
   whoami:
       image: traefik/whoami
-      container_name: whoami
+      container_name: whoami-public
       restart: unless-stopped
       labels:
         - "traefik.enable=true"
-        - "traefik.http.routers.whoami.rule=Host(`whoami.riverrooks.dev`) || Host(`whoami.riverrooks.art`) || Host(`10.8.0.1`)"
+        - "traefik.http.routers.whoami.rule=Host(`whoami.riverrooks.dev`) || Host(`whoami.riverrooks.art`)"
         - "traefik.http.routers.whoami.entrypoints=websecure"
-        - "traefik.http.routers.whoami.tls.certresolver=basic-letsencrypt"
+        - "traefik.http.routers.whoami.tls.certresolver=basic"
+      networks:
+        - traefik
+  whoami-defenk:
+      image: traefik/whoami
+      container_name: whoami-vpn
+      restart: unless-stopped
+      # labels:
+        # - "traefik.enable=true"
+        # - "traefik.http.routers.whoami.rule=Host(`10.8.0.1`)"
+        # - "traefik.http.routers.whoami.entrypoints=websecure"
+        # # - "traefik.http.routers.whoami.tls.certresolver=basic"
       networks:
         - traefik