From f1e55131d90505b4060a722f37637b1e2ac63b92 Mon Sep 17 00:00:00 2001 From: "Urko." Date: Mon, 25 Dec 2023 10:00:11 +0100 Subject: [PATCH] fix: docke swarm stack --- docker-stack.yml | 142 +++++++++++++++++------------------------------ 1 file changed, 52 insertions(+), 90 deletions(-) diff --git a/docker-stack.yml b/docker-stack.yml index cec982f..e382a37 100644 --- a/docker-stack.yml +++ b/docker-stack.yml @@ -1,109 +1,71 @@ ---- version: "3.7" services: traefik: image: traefik:v2.9.1 networks: - ocis-net: - aliases: - - ${OCIS_DOMAIN:-ocis.owncloud.test} + - web command: - - "--log.level=${TRAEFIK_LOG_LEVEL:-ERROR}" - # letsencrypt configuration - - "--certificatesResolvers.http.acme.email=${TRAEFIK_ACME_MAIL:-example@example.org}" - - "--certificatesResolvers.http.acme.storage=/certs/acme.json" - - "--certificatesResolvers.http.acme.httpChallenge.entryPoint=http" - # enable dashboard - - "--api.dashboard=true" - # define entrypoints - - "--entryPoints.http.address=:80" - - "--entryPoints.http.http.redirections.entryPoint.to=https" - - "--entryPoints.http.http.redirections.entryPoint.scheme=https" - - "--entryPoints.https.address=:443" - # docker provider (get configuration from container labels) - - "--providers.docker.endpoint=unix:///var/run/docker.sock" - - "--providers.docker.exposedByDefault=false" - # access log - - "--accessLog=true" - - "--accessLog.format=json" - - "--accessLog.fields.headers.names.X-Request-Id=keep" + - --log.level=INFO + - --api.dashboard=true + - --api.insecure=false + - --providers.docker=true + - --providers.docker.swarmMode=true + - --providers.docker.exposedByDefault=false + - --entrypoints.web.address=:80 + - --entrypoints.websecure.address=:443 + - --certificatesresolvers.mytlschallenge.acme.tlschallenge=true + - --certificatesresolvers.mytlschallenge.acme.email=${TRAEFIK_ACME_MAIL} + - --certificatesresolvers.mytlschallenge.acme.storage=/letsencrypt/acme.json ports: - "80:80" - "443:443" volumes: - - "/var/run/docker.sock:/var/run/docker.sock:ro" - - "certs:/certs" - labels: - - "traefik.enable=${TRAEFIK_DASHBOARD:-false}" - - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS:-admin:$$apr1$$4vqie50r$$YQAmQdtmz5n9rEALhxJ4l.}" # defaults to admin:admin - - "traefik.http.routers.traefik.entrypoints=https" - - "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN:-traefik.owncloud.test}`)" - - "traefik.http.routers.traefik.middlewares=traefik-auth" - - "traefik.http.routers.traefik.tls.certresolver=http" - - "traefik.http.routers.traefik.service=api@internal" - logging: - driver: "local" - restart: always + - /var/run/docker.sock:/var/run/docker.sock:ro + - traefik_certs:/letsencrypt + deploy: + labels: + - traefik.enable=true + - traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN}`) + - traefik.http.routers.traefik.service=api@internal + - traefik.http.routers.traefik.entrypoints=websecure + - traefik.http.routers.traefik.tls.certresolver=mytlschallenge + placement: + constraints: + - node.role==manager + restart_policy: + condition: on-failure ocis: - image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest} + image: owncloud/ocis:${OCIS_DOCKER_TAG} networks: - ocis-net: - entrypoint: - - /bin/sh - # run ocis init to initialize a configuration file with random secrets - # it will fail on subsequent runs, because the config file already exists - # therefore we ignore the error and then start the ocis server - command: ["-c", "ocis init || true; ocis server"] + - web environment: - OCIS_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test} - OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL:-info} - OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}" - PROXY_TLS: "false" # do not use SSL between Traefik and oCIS - # make settings service available to oCIS Hello + OCIS_URL: https://${OCIS_DOMAIN} + OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL} + OCIS_LOG_COLOR: ${OCIS_LOG_COLOR} + PROXY_TLS: "false" SETTINGS_GRPC_ADDR: 0.0.0.0:9191 - # INSECURE: needed if oCIS / Traefik is using self generated certificates - OCIS_INSECURE: "${INSECURE:-false}" - # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect) - PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}" - # admin user password - IDM_ADMIN_PASSWORD: "${ADMIN_PASSWORD:-admin}" # this overrides the admin password from the configuration file - # demo users - IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}" - # password policies - OCIS_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: "banned-password-list.txt" + OCIS_INSECURE: ${OCIS_INSECURE} + PROXY_ENABLE_BASIC_AUTH: ${PROXY_ENABLE_BASIC_AUTH} + IDM_ADMIN_PASSWORD: ${ADMIN_PASSWORD} + IDM_CREATE_DEMO_USERS: ${DEMO_USERS} volumes: - - ./config/ocis/banned-password-list.txt:/etc/ocis/banned-password-list.txt - - ./config/ocis/proxy.yaml:/etc/ocis/proxy.yaml - - ./config/ocis/web.yaml:/etc/ocis/web.yaml - - ocis-config:/etc/ocis - - ocis-data:/var/lib/ocis - labels: - - "traefik.enable=true" - - "traefik.http.routers.ocis.entrypoints=https" - - "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN:-ocis.owncloud.test}`)" - - "traefik.http.routers.ocis.tls.certresolver=http" - - "traefik.http.routers.ocis.service=ocis" - - "traefik.http.services.ocis.loadbalancer.server.port=9200" - logging: - driver: "local" - restart: always - - ocis-hello: - image: owncloud/ocis-hello:${OCIS_HELLO_DOCKER_TAG:-latest} - networks: - ocis-net: - environment: - OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL:-info} - logging: - driver: "local" - restart: always - -volumes: - certs: - ocis-config: - ocis-data: + - ./config/ocis:/etc/ocis + - ocis_data:/var/lib/ocis + deploy: + labels: + - traefik.enable=true + - traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`) + - traefik.http.routers.ocis.entrypoints=websecure + - traefik.http.routers.ocis.tls.certresolver=mytlschallenge + restart_policy: + condition: on-failure networks: - ocis-net: \ No newline at end of file + web: + external: true + +volumes: + traefik_certs: + ocis_data: