remove!(traefik): unused
This commit is contained in:
parent
7482707008
commit
b631f98365
GPG key ID:
67585F0065E261D5
10 changed files with 0 additions and 794 deletions
|
|
@ -1,33 +0,0 @@
|
||||||
Traefik
|
|
||||||
=========
|
|
||||||
|
|
||||||
This will setup a [Traefik](https://docs.traefik.io/v2.0/) server that acts as a dynamic reverse proxy and uses docker labels to route traffic. It also takes care about enabling/renewing Let's Encrypt certificates if specified.
|
|
||||||
|
|
||||||
**Note: If using the IPv6 configuration: When changing the address etc, you will need to manually take care about removing old/unused firewall rules!**
|
|
||||||
|
|
||||||
Requirements
|
|
||||||
------------
|
|
||||||
|
|
||||||
You will need to have docker and docker-compose installed or declared as dependencies with their respective roles.
|
|
||||||
|
|
||||||
Role Variables
|
|
||||||
--------------
|
|
||||||
|
|
||||||
**Please look at the [defaults/main.yml](defaults/main.yml) for all available variables and their description.**
|
|
||||||
|
|
||||||
**Note: Lines that are commented out via `#` are usually still valid/used variables, but they are not defined by default, so they might enable a feature, when uncommenting/defining them!**
|
|
||||||
|
|
||||||
### Global variables, that are used:
|
|
||||||
|
|
||||||
- `docker_package`: Defined by the docker role, this is the package name of docker within your package manager.
|
|
||||||
|
|
||||||
Dependencies
|
|
||||||
------------
|
|
||||||
|
|
||||||
- docker
|
|
||||||
- docker-compose
|
|
||||||
|
|
||||||
License
|
|
||||||
-------
|
|
||||||
|
|
||||||
GPL-3.0-only
|
|
||||||
|
|
@ -1,132 +0,0 @@
|
||||||
---
|
|
||||||
# Default variables for the traefik role
|
|
||||||
|
|
||||||
# Infrastructure
|
|
||||||
# Ansible instructions to deploy the infrastructure
|
|
||||||
# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern
|
|
||||||
# Copyright (C) 2020 Saibotk
|
|
||||||
#
|
|
||||||
# This program is free software: you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, version 3 of the License.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
# The install locations
|
|
||||||
traefik_install_location: /srv/traefik
|
|
||||||
traefik_acme_location: "{{ traefik_install_location }}/acme"
|
|
||||||
traefik_config_location: "{{ traefik_install_location }}/dynamic_conf"
|
|
||||||
|
|
||||||
# The traefik/dockersocketproxy version to be used
|
|
||||||
# renovate: depName=docker.io/library/traefik
|
|
||||||
traefik_version: v2.11.13
|
|
||||||
# renovate: depName=quay.io/sheogorath/docker-socket-proxy
|
|
||||||
traefik_dockersocketproxy_version: "2.3"
|
|
||||||
|
|
||||||
# The domain for the traefik debug dashboard (only shown if the dashboard auth variable is defined)
|
|
||||||
traefik_dashboard_domain: "traefik.example.com"
|
|
||||||
|
|
||||||
# A basic auth users string (see https://docs.traefik.io/v2.0/middlewares/basicauth/)
|
|
||||||
# traefik_dashboard_auth: ''
|
|
||||||
|
|
||||||
# The email to use for letencrypt certificate requests
|
|
||||||
traefik_letsencrypt_email: no-reply@example.com
|
|
||||||
|
|
||||||
# The proxy network name and the bridge name (you usually do not touch these)
|
|
||||||
# ! Note these are used globally, as every container that wants to use traefik,
|
|
||||||
# ! has to be reachable for traefik and all containers, routed with traefik, are connected to the proxy network.
|
|
||||||
proxy_network: proxy # noqa var-naming[no-role-prefix]
|
|
||||||
traefik_docker_bridge_name: docker-proxy
|
|
||||||
|
|
||||||
# Traefik IPv6 settings
|
|
||||||
# Enabling these will lead to traefik being reachable via the specified IPv6 address.
|
|
||||||
# Without any special handling of IPv6, the containers may still be reached via IPv6 but may use the docker internal IPv4 proxy,
|
|
||||||
# which results in the containers only seeing clients connecting with the internal network IPv4 gateway address.
|
|
||||||
traefik_ipv6:
|
|
||||||
enabled: false
|
|
||||||
# This controls, if iptable rules should be deployed, to forward incoming traffic from 80/443 with a destination of the specified IP (traefik's IP).
|
|
||||||
# TL;DR: Should IPv6 traffic be forwarded/allowed to traefik.
|
|
||||||
firewall_rules_enabled: false
|
|
||||||
# The subnet that should be used. Usually has to have a size of at least `/80`
|
|
||||||
# (see https://web.archive.org/web/20181113104036/https://docs.docker.com/v17.06/engine/userguide/networking/default_network/ipv6/#docker-ipv6-cluster)
|
|
||||||
subnet: "{{ ansible_default_ipv6.address | ipsubnet(64) | ipsubnet(80, 51966) }}"
|
|
||||||
# The traefik container will use this static address, unless you explicitly use `{{ omit }}`
|
|
||||||
ip_addr: "{{ ansible_default_ipv6.address | ipsubnet(64) | ipsubnet(80, 51966) | ansible.utils.ipaddr('2') | ansible.utils.ipaddr('address') }}"
|
|
||||||
# The name of the special ipv6 network which will be created and added to the traefik container
|
|
||||||
name: traefik_ipv6
|
|
||||||
|
|
||||||
# Should a general https redirect middleware be enabled for all hosts on the web endpoint?
|
|
||||||
traefik_https_redirect_all: true
|
|
||||||
|
|
||||||
# Should the letsencrypt certresolver be enabled/defined?
|
|
||||||
# Useful eg. for local testing/LAN setups
|
|
||||||
traefik_https_letsencrypt_enabled: true
|
|
||||||
|
|
||||||
# Extra configuration (dynamic) via a config file
|
|
||||||
# This has to be used, because setting default TLS configs etc. cannot be done via labels/commandline parameters
|
|
||||||
# This will by default set the minimum TLS version to v1.2 and only enable a few secure ciphers
|
|
||||||
traefik_dynamic_conf:
|
|
||||||
tls:
|
|
||||||
options:
|
|
||||||
default:
|
|
||||||
minVersion: "VersionTLS12"
|
|
||||||
sniStrict: true # Can be disabled for local testing, which will lead to traefik serving it's default certificate if none can be found
|
|
||||||
cipherSuites:
|
|
||||||
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
|
||||||
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
|
||||||
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|
|
||||||
|
|
||||||
# This config allows to add new entrypoints to traefik which are also automatically exposed / the port is automatically allocated.
|
|
||||||
# Can be used in cases where traefik needs to be used as a proxy because of the certificates it holds. Eg. gitlab registry on the
|
|
||||||
# same domain, where we want to use the existing certificate for the registry too.
|
|
||||||
#
|
|
||||||
# Example entry:
|
|
||||||
# - name: gitlabregistry
|
|
||||||
# port: 5050
|
|
||||||
traefik_additional_entrypoints: []
|
|
||||||
|
|
||||||
# Enables debug log level
|
|
||||||
traefik_debug: false
|
|
||||||
|
|
||||||
# Should traefik log access?
|
|
||||||
traefik_access_log_enabled: false
|
|
||||||
|
|
||||||
# Optional environment variables that should be added (key value pairs)
|
|
||||||
traefik_options: {}
|
|
||||||
|
|
||||||
# Enables the tor container, to allow reaching traefik via an onion address/the tor network
|
|
||||||
traefik_tor_enabled: false
|
|
||||||
|
|
||||||
# The tor container version
|
|
||||||
traefik_tor_version: 0.4
|
|
||||||
|
|
||||||
# The tor container volume locations
|
|
||||||
traefik_tor_location: "{{ traefik_install_location }}/tor"
|
|
||||||
traefik_tor_data_location: "{{ traefik_tor_location }}/data"
|
|
||||||
traefik_tor_config_location: "{{ traefik_tor_location }}/config"
|
|
||||||
|
|
||||||
# Enables the acmedumper, to extract the certificates from traefik
|
|
||||||
traefik_acmedumper_enabled: false
|
|
||||||
|
|
||||||
# The acmedumper container version
|
|
||||||
traefik_acmedumper_version: "2.7.0"
|
|
||||||
traefik_acmedumper_image_version: "v{{ traefik_acmedumper_version }}"
|
|
||||||
|
|
||||||
# The acmedumper output location
|
|
||||||
traefik_acmedumper_location: "{{ traefik_install_location }}/certs"
|
|
||||||
|
|
||||||
# Enable or disable selinux handling
|
|
||||||
traefik_selinux_enabled: true
|
|
||||||
|
|
||||||
# The SELinux levels for tor/traefiks folders/container
|
|
||||||
traefik_selinux_level: "{{ omit }}"
|
|
||||||
traefik_tor_selinux_level: "{{ omit }}"
|
|
||||||
|
|
||||||
# Enable or disable firewalld handling (Allowing HTTP/HTTPS and trusting the docker network if necessary)
|
|
||||||
traefik_firewalld_enabled: true
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
SocksPort 0
|
|
||||||
HiddenServiceDir /data/traefik
|
|
||||||
HiddenServicePort 80 proxy:80
|
|
||||||
HiddenServicePort 443 proxy:443
|
|
||||||
HiddenServiceNonAnonymousMode 1
|
|
||||||
HiddenServiceSingleHopMode 1
|
|
||||||
SafeLogging 1
|
|
||||||
|
|
@ -1,26 +0,0 @@
|
||||||
---
|
|
||||||
# Handlers file for the traefik role
|
|
||||||
|
|
||||||
# Infrastructure
|
|
||||||
# Ansible instructions to deploy the infrastructure
|
|
||||||
# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern
|
|
||||||
#
|
|
||||||
# This program is free software: you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, version 3 of the License.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
- name: Restart tor proxy
|
|
||||||
ansible.builtin.command: "docker-compose restart tor"
|
|
||||||
args:
|
|
||||||
chdir: "{{ traefik_install_location }}"
|
|
||||||
register: compose_output
|
|
||||||
changed_when: compose_output.rc != 0
|
|
||||||
become: true
|
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
galaxy_info:
|
|
||||||
author: saibotk
|
|
||||||
description: "Installs traefik via docker with optional tor access and acmedumper."
|
|
||||||
license: GPL-3.0-only
|
|
||||||
min_ansible_version: "2.9"
|
|
||||||
standalone: true
|
|
||||||
|
|
||||||
platforms:
|
|
||||||
- name: EL
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: GenericUNIX
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: Fedora
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: opensuse
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: GenericBSD
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: FreeBSD
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: Ubuntu
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: SLES
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: GenericLinux
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
- name: Debian
|
|
||||||
versions:
|
|
||||||
- all
|
|
||||||
|
|
||||||
galaxy_tags: []
|
|
||||||
|
|
||||||
dependencies:
|
|
||||||
- role: docker
|
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
---
|
|
||||||
# Tasks file traefik/acmedumper for the traefik role
|
|
||||||
|
|
||||||
# Infrastructure
|
|
||||||
# Ansible instructions to deploy the infrastructure
|
|
||||||
# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern
|
|
||||||
#
|
|
||||||
# This program is free software: you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, version 3 of the License.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
- name: Update default SELinux contexts for acme-dumper
|
|
||||||
community.general.sefcontext:
|
|
||||||
target: '{{ item }}(/.*)?'
|
|
||||||
setype: "container_file_t"
|
|
||||||
selevel: "{{ traefik_selinux_level | default(omit) }}"
|
|
||||||
state: present
|
|
||||||
with_items:
|
|
||||||
- "{{ traefik_acmedumper_location }}"
|
|
||||||
when:
|
|
||||||
- traefik_selinux_enabled
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Create data directory for acme-dumper
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ item }}"
|
|
||||||
state: directory
|
|
||||||
mode: '0750'
|
|
||||||
owner: 'root'
|
|
||||||
group: 'root'
|
|
||||||
setype: "container_file_t"
|
|
||||||
selevel: "{{ traefik_selinux_level | default(omit) }}"
|
|
||||||
with_items:
|
|
||||||
- "{{ traefik_acmedumper_location }}"
|
|
||||||
become: true
|
|
||||||
|
|
@ -1,224 +0,0 @@
|
||||||
---
|
|
||||||
# Tasks file for the traefik role
|
|
||||||
|
|
||||||
# Infrastructure
|
|
||||||
# Ansible instructions to deploy the infrastructure
|
|
||||||
# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern
|
|
||||||
# Copyright (C) 2020 Alexander Wellbrock
|
|
||||||
# Copyright (C) 2020 Saibotk
|
|
||||||
#
|
|
||||||
# This program is free software: you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, version 3 of the License.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
- name: Update default SELinux contexts
|
|
||||||
community.general.sefcontext:
|
|
||||||
target: "{{ item }}(/.*)?"
|
|
||||||
setype: "container_file_t"
|
|
||||||
selevel: "{{ traefik_selinux_level }}"
|
|
||||||
state: present
|
|
||||||
with_items:
|
|
||||||
- "{{ traefik_acme_location }}"
|
|
||||||
- "{{ traefik_config_location }}"
|
|
||||||
when:
|
|
||||||
- traefik_selinux_enabled
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Create install directory
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ item }}"
|
|
||||||
state: directory
|
|
||||||
mode: "0700"
|
|
||||||
owner: "root"
|
|
||||||
group: "root"
|
|
||||||
with_items:
|
|
||||||
- "{{ traefik_install_location }}"
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Create data directory
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ item }}"
|
|
||||||
state: directory
|
|
||||||
mode: "0700"
|
|
||||||
owner: "root"
|
|
||||||
group: "root"
|
|
||||||
setype: "container_file_t"
|
|
||||||
selevel: "{{ traefik_selinux_level }}"
|
|
||||||
with_items:
|
|
||||||
- "{{ traefik_acme_location }}"
|
|
||||||
- "{{ traefik_config_location }}"
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Include configs for Tor
|
|
||||||
ansible.builtin.include_tasks: tor.yml
|
|
||||||
when: traefik_tor_enabled | bool
|
|
||||||
|
|
||||||
- name: Include configs for acme-dumper
|
|
||||||
ansible.builtin.include_tasks: acmedumper.yml
|
|
||||||
when: traefik_acmedumper_enabled | bool
|
|
||||||
|
|
||||||
- name: Create proxy network
|
|
||||||
community.docker.docker_network:
|
|
||||||
name: "{{ proxy_network }}"
|
|
||||||
driver_options:
|
|
||||||
com.docker.network.bridge.name: "{{ traefik_docker_bridge_name }}"
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Create ipv6 frontend network
|
|
||||||
community.docker.docker_network:
|
|
||||||
name: "{{ traefik_ipv6.name }}"
|
|
||||||
enable_ipv6: true
|
|
||||||
ipam_config:
|
|
||||||
- subnet: "{{ traefik_ipv6.subnet }}"
|
|
||||||
become: true
|
|
||||||
when:
|
|
||||||
- traefik_ipv6 is defined
|
|
||||||
- traefik_ipv6.enabled
|
|
||||||
|
|
||||||
- name: Gather the package facts
|
|
||||||
ansible.builtin.package_facts:
|
|
||||||
manager: auto
|
|
||||||
|
|
||||||
# This step is only needed in docker < 20.10, as docker does this by default now
|
|
||||||
- name: Trust our proxy network
|
|
||||||
ansible.posix.firewalld:
|
|
||||||
zone: trusted
|
|
||||||
interface: "{{ traefik_docker_bridge_name }}"
|
|
||||||
permanent: true
|
|
||||||
immediate: true
|
|
||||||
state: enabled
|
|
||||||
become: true
|
|
||||||
tags:
|
|
||||||
- firewall
|
|
||||||
when:
|
|
||||||
- traefik_firewalld_enabled
|
|
||||||
- docker_package in ansible_facts.packages
|
|
||||||
- ansible_facts.packages[docker_package][0].version is version('20.10', '<')
|
|
||||||
|
|
||||||
- name: Deploy dynamic_conf.yml
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: dynamic_conf.yml
|
|
||||||
dest: "{{ traefik_config_location }}/dynamic_conf.yml"
|
|
||||||
owner: "root"
|
|
||||||
group: "root"
|
|
||||||
mode: "0600"
|
|
||||||
setype: "container_file_t"
|
|
||||||
selevel: "{{ traefik_selinux_level }}"
|
|
||||||
become: true
|
|
||||||
when:
|
|
||||||
- traefik_dynamic_conf != omit
|
|
||||||
|
|
||||||
- name: Deploy docker-compose.yml
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: docker-compose.yml
|
|
||||||
dest: "{{ traefik_install_location }}/docker-compose.yml"
|
|
||||||
mode: "0600"
|
|
||||||
owner: "root"
|
|
||||||
group: "root"
|
|
||||||
validate: docker compose -f %s config -q
|
|
||||||
tags:
|
|
||||||
- docker
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Compose traefik
|
|
||||||
community.docker.docker_compose_v2:
|
|
||||||
state: present
|
|
||||||
project_src: "{{ traefik_install_location }}"
|
|
||||||
pull: always
|
|
||||||
remove_orphans: true
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Read tor hostname
|
|
||||||
ansible.builtin.slurp:
|
|
||||||
src: "{{ traefik_tor_data_location }}/traefik/hostname"
|
|
||||||
register: proxy_hiddenservice # noqa: var-naming[no-role-prefix]
|
|
||||||
become: true
|
|
||||||
when: traefik_tor_enabled | bool
|
|
||||||
|
|
||||||
- name: Allow access to services
|
|
||||||
ansible.posix.firewalld:
|
|
||||||
service: "{{ item }}"
|
|
||||||
permanent: true
|
|
||||||
state: enabled
|
|
||||||
with_items:
|
|
||||||
- http
|
|
||||||
- https
|
|
||||||
become: true
|
|
||||||
when:
|
|
||||||
- traefik_firewalld_enabled
|
|
||||||
tags:
|
|
||||||
- firewall
|
|
||||||
|
|
||||||
# NOTE: This rule does not care about new / old ip values, so removal must be made by hand!
|
|
||||||
- name: Configure firewalld to allow IPv6 traffic for HTTP/HTTPS
|
|
||||||
ansible.builtin.command:
|
|
||||||
argv:
|
|
||||||
- firewall-cmd
|
|
||||||
- --direct
|
|
||||||
- --add-rule
|
|
||||||
- ipv6
|
|
||||||
- filter
|
|
||||||
- FORWARD
|
|
||||||
- 0
|
|
||||||
- -p
|
|
||||||
- tcp
|
|
||||||
- --destination
|
|
||||||
- "{{ traefik_ipv6.ip_addr | default('2001:db8::') | ansible.utils.ipaddr('address') }}/128" # noqa: jinja[invalid]
|
|
||||||
- --dport
|
|
||||||
- "{{ item }}"
|
|
||||||
- -j
|
|
||||||
- ACCEPT
|
|
||||||
register: traefik_firewalld_direct_result
|
|
||||||
become: true
|
|
||||||
changed_when: '"ALREADY_ENABLED" not in traefik_firewalld_direct_result.stderr'
|
|
||||||
notify: restart docker
|
|
||||||
with_items:
|
|
||||||
- 80
|
|
||||||
- 443
|
|
||||||
when:
|
|
||||||
- traefik_firewalld_enabled
|
|
||||||
- traefik_ipv6 is defined
|
|
||||||
- traefik_ipv6.enabled
|
|
||||||
- traefik_ipv6.ip_addr is defined
|
|
||||||
- traefik_ipv6.firewall_rules_enabled is defined and traefik_ipv6.firewall_rules_enabled
|
|
||||||
|
|
||||||
# NOTE: This rule does not care about new / old ip values, so removal must be made by hand!
|
|
||||||
- name: Configure firewalld to allow IPv6 traffic for HTTP/HTTPS
|
|
||||||
ansible.builtin.command:
|
|
||||||
argv:
|
|
||||||
- firewall-cmd
|
|
||||||
- --permanent
|
|
||||||
- --direct
|
|
||||||
- --add-rule
|
|
||||||
- ipv6
|
|
||||||
- filter
|
|
||||||
- FORWARD
|
|
||||||
- 0
|
|
||||||
- -p
|
|
||||||
- tcp
|
|
||||||
- --destination
|
|
||||||
- "{{ traefik_ipv6.ip_addr | default('2001:db8::') | ansible.utils.ipaddr('address') }}/128" # noqa: jinja[invalid]
|
|
||||||
- --dport
|
|
||||||
- "{{ item }}"
|
|
||||||
- -j
|
|
||||||
- ACCEPT
|
|
||||||
register: traefik_firewalld_direct_permanent_result
|
|
||||||
become: true
|
|
||||||
changed_when: '"ALREADY_ENABLED" not in traefik_firewalld_direct_permanent_result.stderr'
|
|
||||||
with_items:
|
|
||||||
- 80
|
|
||||||
- 443
|
|
||||||
when:
|
|
||||||
- traefik_firewalld_enabled
|
|
||||||
- traefik_ipv6 is defined
|
|
||||||
- traefik_ipv6.enabled
|
|
||||||
- traefik_ipv6.ip_addr is defined
|
|
||||||
- traefik_ipv6.firewall_rules_enabled is defined and traefik_ipv6.firewall_rules_enabled
|
|
||||||
|
|
@ -1,81 +0,0 @@
|
||||||
---
|
|
||||||
# Tasks file traefik/tor for the traefik role
|
|
||||||
|
|
||||||
# Infrastructure
|
|
||||||
# Ansible instructions to deploy the infrastructure
|
|
||||||
# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern
|
|
||||||
# Copyright (C) 2020 Alexander Wellbrock
|
|
||||||
#
|
|
||||||
# This program is free software: you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, version 3 of the License.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
- name: Update default SELinux contexts tor
|
|
||||||
community.general.sefcontext:
|
|
||||||
target: '{{ item }}(/.*)?'
|
|
||||||
setype: "container_file_t"
|
|
||||||
selevel: "{{ traefik_tor_selinux_level | default(omit) }}"
|
|
||||||
state: present
|
|
||||||
with_items:
|
|
||||||
- "{{ traefik_tor_data_location }}"
|
|
||||||
- "{{ traefik_tor_config_location }}"
|
|
||||||
when:
|
|
||||||
- traefik_selinux_enabled
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Create install directory
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ item }}"
|
|
||||||
state: directory
|
|
||||||
mode: '0700'
|
|
||||||
owner: 'root'
|
|
||||||
group: 'root'
|
|
||||||
with_items:
|
|
||||||
- "{{ traefik_tor_location }}"
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Create data directory
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ item }}"
|
|
||||||
state: directory
|
|
||||||
mode: '0700'
|
|
||||||
owner: '994'
|
|
||||||
group: '994'
|
|
||||||
setype: "container_file_t"
|
|
||||||
selevel: "{{ traefik_tor_selinux_level | default(omit) }}"
|
|
||||||
with_items:
|
|
||||||
- "{{ traefik_tor_data_location }}"
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Create config directory
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ item }}"
|
|
||||||
state: directory
|
|
||||||
setype: "container_file_t"
|
|
||||||
selevel: "{{ traefik_tor_selinux_level | default(omit) }}"
|
|
||||||
mode: '0750'
|
|
||||||
owner: 'root'
|
|
||||||
group: 'root'
|
|
||||||
with_items:
|
|
||||||
- "{{ traefik_tor_config_location }}"
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Setup tor config
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: traefik-tor.conf
|
|
||||||
dest: "{{ traefik_tor_config_location }}/traefik.conf"
|
|
||||||
setype: "container_file_t"
|
|
||||||
selevel: "{{ traefik_tor_selinux_level | default(omit) }}"
|
|
||||||
mode: '0644'
|
|
||||||
owner: 'root'
|
|
||||||
group: 'root'
|
|
||||||
notify: Restart tor proxy
|
|
||||||
become: true
|
|
||||||
|
|
@ -1,201 +0,0 @@
|
||||||
{{ ansible_managed | comment }}
|
|
||||||
|
|
||||||
# Infrastructure
|
|
||||||
# Ansible instructions to deploy the infrastructure
|
|
||||||
# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern
|
|
||||||
# Copyright (C) 2020 Saibotk
|
|
||||||
#
|
|
||||||
# This program is free software: you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, version 3 of the License.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
version: '2'
|
|
||||||
services:
|
|
||||||
dockersocket:
|
|
||||||
image: quay.io/sheogorath/docker-socket-proxy:{{ traefik_dockersocketproxy_version }}
|
|
||||||
mem_limit: 16mb
|
|
||||||
memswap_limit: 32mb
|
|
||||||
security_opt:
|
|
||||||
- "label:disable"
|
|
||||||
read_only: true
|
|
||||||
tmpfs:
|
|
||||||
- /run/:size=32K
|
|
||||||
environment:
|
|
||||||
- "CONTAINERS=1"
|
|
||||||
- "LOG_LEVEL=notice"
|
|
||||||
volumes:
|
|
||||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
|
||||||
networks:
|
|
||||||
socket:
|
|
||||||
restart: always
|
|
||||||
|
|
||||||
{% if traefik_tor_enabled %}
|
|
||||||
tor:
|
|
||||||
image: quay.io/sheogorath/tor:{{ traefik_tor_version }}
|
|
||||||
mem_limit: 64mb
|
|
||||||
memswap_limit: 128mb
|
|
||||||
read_only: true
|
|
||||||
depends_on:
|
|
||||||
- proxy
|
|
||||||
security_opt:
|
|
||||||
- no-new-privileges
|
|
||||||
{% if traefik_tor_selinux_level != omit %}
|
|
||||||
- label=level:{{ traefik_tor_selinux_level }}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
tmpfs:
|
|
||||||
- /var/lib/tor/.tor:size=10M,uid=994,gid=994,mode=1700
|
|
||||||
volumes:
|
|
||||||
- "{{ traefik_tor_data_location }}:/data"
|
|
||||||
- "{{ traefik_tor_config_location }}:/etc/torrc.d/:ro"
|
|
||||||
networks:
|
|
||||||
tor_internal:
|
|
||||||
tor_external:
|
|
||||||
restart: always
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
proxy:
|
|
||||||
image: docker.io/library/traefik:{{ traefik_version }}
|
|
||||||
cpu_shares: 3072
|
|
||||||
mem_limit: 256mb
|
|
||||||
memswap_limit: 512mb
|
|
||||||
read_only: true
|
|
||||||
restart: always
|
|
||||||
labels:
|
|
||||||
- "traefik.enable=true"
|
|
||||||
{% if traefik_https_redirect_all %}
|
|
||||||
- "traefik.http.routers.http_catchall.rule=HostRegexp(`{any:.+}`)"
|
|
||||||
- "traefik.http.routers.http_catchall.entrypoints=web"
|
|
||||||
- "traefik.http.routers.http_catchall.middlewares=https_redirect"
|
|
||||||
{% endif %}
|
|
||||||
- "traefik.http.middlewares.https_redirect.redirectscheme.scheme=https"
|
|
||||||
- "traefik.http.middlewares.https_redirect.redirectscheme.permanent=true"
|
|
||||||
- "traefik.http.middlewares.compress.compress=true"
|
|
||||||
{% if traefik_dashboard_auth is defined %}
|
|
||||||
- "traefik.http.routers.api.rule=Host(`{{ traefik_dashboard_domain }}`)"
|
|
||||||
- "traefik.http.routers.api.service=api@internal"
|
|
||||||
- "traefik.http.routers.api.middlewares=traefikauth"
|
|
||||||
- "traefik.http.middlewares.traefikauth.basicauth.users={{ traefik_dashboard_auth }}"
|
|
||||||
{% endif %}
|
|
||||||
depends_on:
|
|
||||||
- dockersocket
|
|
||||||
{% if traefik_selinux_level != omit %}
|
|
||||||
security_opt:
|
|
||||||
- label=level:{{ traefik_selinux_level }}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
ports:
|
|
||||||
- "80:80"
|
|
||||||
- "443:443"
|
|
||||||
{% for entrypoint in traefik_additional_entrypoints %}
|
|
||||||
- "{{ entrypoint.port }}:{{ entrypoint.port }}"
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
- "{{ traefik_acme_location }}:/etc/traefik/acme"
|
|
||||||
{% if traefik_dynamic_conf != omit %}
|
|
||||||
- "{{ traefik_config_location }}:/etc/traefik/dynamic_conf:ro"
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
command:
|
|
||||||
- "--entryPoints.web.address=:80"
|
|
||||||
- "--entryPoints.websecure.address=:443"
|
|
||||||
{% for entrypoint in traefik_additional_entrypoints %}
|
|
||||||
- "--entryPoints.{{ entrypoint.name }}.address=:{{ entrypoint.port }}"
|
|
||||||
{% endfor %}
|
|
||||||
- "--accesslog={{ traefik_access_log_enabled | bool | lower }}"
|
|
||||||
{% if traefik_dynamic_conf != omit %}
|
|
||||||
- "--providers.file.directory=/etc/traefik/dynamic_conf"
|
|
||||||
- "--providers.file.watch=true"
|
|
||||||
{% endif %}
|
|
||||||
- "--providers.docker=true"
|
|
||||||
- "--providers.docker.endpoint=tcp://dockersocket:2375"
|
|
||||||
- "--providers.docker.exposedByDefault=false"
|
|
||||||
{% if traefik_https_letsencrypt_enabled %}
|
|
||||||
- "--certificatesResolvers.letsencrypt_http.acme.email={{ traefik_letsencrypt_email }}"
|
|
||||||
- "--certificatesResolvers.letsencrypt_http.acme.storage=/etc/traefik/acme/acme.json"
|
|
||||||
- "--certificatesResolvers.letsencrypt_http.acme.httpChallenge.entrypoint=web"
|
|
||||||
{% endif %}
|
|
||||||
{% if traefik_debug %}
|
|
||||||
- "--log.level=DEBUG"
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
networks:
|
|
||||||
{{ proxy_network }}:
|
|
||||||
{% if traefik_aliases is defined %}
|
|
||||||
aliases:
|
|
||||||
{% for alias in traefik_aliases %}
|
|
||||||
- "{{ alias }}"
|
|
||||||
{% endfor %}
|
|
||||||
{% endif %}
|
|
||||||
socket:
|
|
||||||
{% if traefik_tor_enabled %}
|
|
||||||
tor_internal:
|
|
||||||
{% endif %}
|
|
||||||
{% if traefik_ipv6.enabled %}
|
|
||||||
{{ traefik_ipv6.name }}:
|
|
||||||
{% if traefik_ipv6.ip_addr != omit %}
|
|
||||||
ipv6_address: {{ traefik_ipv6.ip_addr | ansible.utils.ipaddr('address') }}
|
|
||||||
{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if traefik_options | length > 0 %}
|
|
||||||
environment:
|
|
||||||
{% for key, value in traefik_options.items() %}
|
|
||||||
- "{{ key }}={{ value }}"
|
|
||||||
{% endfor %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if traefik_acmedumper_enabled %}
|
|
||||||
acme-dumper:
|
|
||||||
image: docker.io/ldez/traefik-certs-dumper:{{ traefik_acmedumper_image_version }}
|
|
||||||
read_only: true
|
|
||||||
mem_limit: 64mb
|
|
||||||
memswap_limit: 128mb
|
|
||||||
network_mode: none
|
|
||||||
security_opt:
|
|
||||||
- no-new-privileges
|
|
||||||
{% if traefik_selinux_level != omit %}
|
|
||||||
- label=level:{{ traefik_selinux_level }}
|
|
||||||
{% endif %}
|
|
||||||
cap_drop:
|
|
||||||
- all
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
- "{{ traefik_acme_location }}:/etc/traefik/acme:ro"
|
|
||||||
- "{{ traefik_acmedumper_location }}:/export"
|
|
||||||
command:
|
|
||||||
- "file"
|
|
||||||
- "--domain-subdir"
|
|
||||||
- "--crt-ext=.pem"
|
|
||||||
- "--key-ext=.pem"
|
|
||||||
- "--crt-name=fullchain"
|
|
||||||
- "--key-name=privkey"
|
|
||||||
- "--source=/etc/traefik/acme/acme-v2.json"
|
|
||||||
- "--dest=/export"
|
|
||||||
- "--version=v2"
|
|
||||||
- "--watch"
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
networks:
|
|
||||||
{{ proxy_network }}:
|
|
||||||
external: true
|
|
||||||
socket:
|
|
||||||
internal: true
|
|
||||||
{% if traefik_tor_enabled %}
|
|
||||||
tor_internal:
|
|
||||||
internal: true
|
|
||||||
tor_external:
|
|
||||||
{% endif %}
|
|
||||||
{% if traefik_ipv6.enabled %}
|
|
||||||
{{ traefik_ipv6.name }}:
|
|
||||||
external: true
|
|
||||||
{% endif %}
|
|
||||||
|
|
@ -1,4 +0,0 @@
|
||||||
{{ ansible_managed | comment }}
|
|
||||||
# Dynamic configuration
|
|
||||||
|
|
||||||
{{ traefik_dynamic_conf | to_nice_yaml(indent=2) }}
|
|
||||||
Loading…
Add table
Reference in a new issue