From f79da7995a1b4896fbec0dc9024a5ea6d072b094 Mon Sep 17 00:00:00 2001 From: m1k1o Date: Fri, 12 Mar 2021 10:47:34 +0100 Subject: [PATCH] add HTTPS. --- .env.example | 4 +- README.md | 29 +++++++++--- docker-compose.yml => docker-compose.http.yml | 6 +-- docker.compose.yml | 44 +++++++++++++++++++ traefik/.gitignore | 2 + traefik/config/middlewares.yml | 10 +++++ traefik/config/routers.yml | 9 ++++ traefik/config/tls.yml | 11 +++++ traefik/traefik.yml | 22 ++++++++++ 9 files changed, 125 insertions(+), 12 deletions(-) rename docker-compose.yml => docker-compose.http.yml (89%) create mode 100644 docker.compose.yml create mode 100644 traefik/.gitignore create mode 100644 traefik/config/middlewares.yml create mode 100644 traefik/config/routers.yml create mode 100644 traefik/config/tls.yml create mode 100644 traefik/traefik.yml diff --git a/.env.example b/.env.example index c4d9642..be6d773 100644 --- a/.env.example +++ b/.env.example @@ -2,8 +2,8 @@ NEKO_ROOMS_EPR=59000-59049 NEKO_ROOMS_NAT1TO1=192.168.1.20 NEKO_ROOMS_TRAEFIK_DOMAIN=neko-rooms.server.lan -NEKO_ROOMS_TRAEFIK_ENTRYPOINT=web +NEKO_ROOMS_TRAEFIK_ENTRYPOINT=websecure NEKO_ROOMS_TRAEFIK_NETWORK=neko-rooms-traefik -NEKO_ROOMS_TRAEFIK_PORT=8080 +NEKO_ROOMS_TRAEFIK_CERTRESOLVER=lets-encrypt TZ=Europe/Vienna diff --git a/README.md b/README.md index 76b2342..47d2953 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,10 @@ Simple room management system for [n.eko](https://github.com/m1k1o/neko). You need to have installed `Docker` and `docker-compose`. +You can watch this installation video provided by *Dr R1ck*: + +https://www.youtube.com/watch?v=cCmnw-pq0gA + ### Step 1 Copy `.env.example` to `.env` and customize. @@ -16,22 +20,33 @@ cp .env.example .env ### Step 2 -Run start docker compose stack. +Create `usersfile` with your users: ```bash -docker-compose up -d +touch traefik/usersfile ``` -### Stop 3 +And add as many users as you like: -Use `OpenApi.yml` and send commands to your new controller. +```bash +echo $(htpasswd -nb user password) >> traefik/usersfile +``` -## WARNING +### Step 3 -This project is WIP, n.eko is not wokring on custom `/paths/`, because all static files are loaded from `/`. This needs to be fixed in upstream repository to have this instane working. +Create `acme.json` + +```bash +touch traefik/acme.json +chmod 600 traefik/acme.json +``` + +Update your email in `traefik/traefik.yml`. ### Roadmap: - - [ ] add authentication provider for API - [x] add GUI + - [x] add HTTPS support + - [x] add authentication provider for traefik + - [ ] add bearer token to for API - [ ] add docker ssh / tcp support - [ ] add docker swarm support diff --git a/docker-compose.yml b/docker-compose.http.yml similarity index 89% rename from docker-compose.yml rename to docker-compose.http.yml index a8ad0fb..b0a09be 100644 --- a/docker-compose.yml +++ b/docker-compose.http.yml @@ -15,9 +15,9 @@ services: - "--providers.docker.watch=true" - "--providers.docker.exposedbydefault=false" - "--providers.docker.network=${NEKO_ROOMS_TRAEFIK_NETWORK}" - - "--entrypoints.${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}.address=:${NEKO_ROOMS_TRAEFIK_PORT}" + - "--entrypoints.${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}.address=:${APP_PORT-8080}" ports: - - "${NEKO_ROOMS_TRAEFIK_PORT}:${NEKO_ROOMS_TRAEFIK_PORT}" + - "${APP_PORT-8080}:${APP_PORT-8080}" volumes: - "/var/run/docker.sock:/var/run/docker.sock:ro" @@ -30,7 +30,7 @@ services: - "NEKO_ROOMS_TRAEFIK_DOMAIN" - "NEKO_ROOMS_TRAEFIK_ENTRYPOINT" - "NEKO_ROOMS_TRAEFIK_NETWORK" - - "NEKO_ROOMS_TRAEFIK_PORT" + - "NEKO_ROOMS_TRAEFIK_PORT=${APP_PORT-8080}" volumes: - "/var/run/docker.sock:/var/run/docker.sock" labels: diff --git a/docker.compose.yml b/docker.compose.yml new file mode 100644 index 0000000..236c346 --- /dev/null +++ b/docker.compose.yml @@ -0,0 +1,44 @@ +version: "3.7" + +networks: + default: + attachable: "true" + name: "${NEKO_ROOMS_TRAEFIK_NETWORK}" + +services: + traefik: + image: "traefik" + restart: unless-stopped + environment: + - "TZ" + ports: + - "80:80" + - "443:443" + volumes: + - "/var/run/docker.sock:/var/run/docker.sock:ro" + - "./traefik/traefik.yml:/etc/traefik/traefik.yml:ro" + - "./traefik/usersfile:/usersfile:ro" + - "./traefik/acme.json:/acme.json" + - "./traefik/config:/config" + + neko-rooms: + build: "./" + restart: unless-stopped + environment: + - "TZ" + - "NEKO_ROOMS_EPR" + - "NEKO_ROOMS_NAT1TO1" + - "NEKO_ROOMS_TRAEFIK_DOMAIN" + - "NEKO_ROOMS_TRAEFIK_ENTRYPOINT" + - "NEKO_ROOMS_TRAEFIK_CERTRESOLVER" + - "NEKO_ROOMS_TRAEFIK_NETWORK" + volumes: + - "/var/run/docker.sock:/var/run/docker.sock" + labels: + - "traefik.enable=true" + - "traefik.http.services.neko-rooms-frontend.loadbalancer.server.port=8080" + - "traefik.http.routers.neko-rooms.entrypoints=${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}" + - "traefik.http.routers.neko-rooms.rule=Host(`${NEKO_ROOMS_TRAEFIK_DOMAIN}`)" + - "traefik.http.routers.neko-rooms.tls=true" + - "traefik.http.routers.neko-rooms.tls.certresolver=${NEKO_ROOMS_TRAEFIK_CERTRESOLVER}" + - "traefik.http.routers.neko-rooms.middlewares=basicauth@file" diff --git a/traefik/.gitignore b/traefik/.gitignore new file mode 100644 index 0000000..5bb5625 --- /dev/null +++ b/traefik/.gitignore @@ -0,0 +1,2 @@ +acme.json +usersfile diff --git a/traefik/config/middlewares.yml b/traefik/config/middlewares.yml new file mode 100644 index 0000000..4ee9fa3 --- /dev/null +++ b/traefik/config/middlewares.yml @@ -0,0 +1,10 @@ +http: + middlewares: + basicauth: + basicAuth: + usersFile: "/usersfile" + + httpsredirect: + redirectScheme: + scheme: https + permanent: true diff --git a/traefik/config/routers.yml b/traefik/config/routers.yml new file mode 100644 index 0000000..1e3e2a4 --- /dev/null +++ b/traefik/config/routers.yml @@ -0,0 +1,9 @@ +http: + routers: + redirecttohttps: + entryPoints: + - "web" + middlewares: + - "httpsredirect" + rule: "HostRegexp(`{host:.+}`)" + service: "noop@internal" diff --git a/traefik/config/tls.yml b/traefik/config/tls.yml new file mode 100644 index 0000000..f49213e --- /dev/null +++ b/traefik/config/tls.yml @@ -0,0 +1,11 @@ +tls: + options: + default: + minVersion: VersionTLS12 + cipherSuites: + - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 diff --git a/traefik/traefik.yml b/traefik/traefik.yml new file mode 100644 index 0000000..dc2a74d --- /dev/null +++ b/traefik/traefik.yml @@ -0,0 +1,22 @@ +entryPoints: + web: + address: ":80" + websecure: + address: ":443" + +providers: + file: + directory: "/config" + docker: + endpoint: "unix:///var/run/docker.sock" + network: traefik + watch: true + exposedByDefault: false + +certificatesResolvers: + lets-encrypt: + acme: + email: youname@example.com + storage: /acme.json + httpChallenge: + entryPoint: web