add HTTPS.

.env.example

@@ -2,8 +2,8 @@ NEKO_ROOMS_EPR=59000-59049
 NEKO_ROOMS_NAT1TO1=192.168.1.20
 
 NEKO_ROOMS_TRAEFIK_DOMAIN=neko-rooms.server.lan
-NEKO_ROOMS_TRAEFIK_ENTRYPOINT=web
+NEKO_ROOMS_TRAEFIK_ENTRYPOINT=websecure
 NEKO_ROOMS_TRAEFIK_NETWORK=neko-rooms-traefik
-NEKO_ROOMS_TRAEFIK_PORT=8080
+NEKO_ROOMS_TRAEFIK_CERTRESOLVER=lets-encrypt
 
 TZ=Europe/Vienna

README.md

@@ -6,6 +6,10 @@ Simple room management system for [n.eko](https://github.com/m1k1o/neko).
 
 You need to have installed `Docker` and `docker-compose`.
 
+You can watch this installation video provided by *Dr R1ck*:
+
+https://www.youtube.com/watch?v=cCmnw-pq0gA
+
 ### Step 1
 
 Copy `.env.example` to `.env` and customize.
@@ -16,22 +20,33 @@ cp .env.example .env
 
 ### Step 2
 
-Run start docker compose stack.
+Create `usersfile` with your users:
 
 ```bash
-docker-compose up -d
+touch traefik/usersfile
 ```
 
-### Stop 3
+And add as many users as you like:
 
-Use `OpenApi.yml` and send commands to your new controller.
+```bash
+echo $(htpasswd -nb user password) >> traefik/usersfile
+```
 
-## WARNING
+### Step 3
 
-This project is WIP, n.eko is not wokring on custom `/paths/`, because all static files are loaded from `/`. This needs to be fixed in upstream repository to have this instane working.
+Create `acme.json`
+
+```bash
+touch traefik/acme.json
+chmod 600 traefik/acme.json
+```
+
+Update your email in `traefik/traefik.yml`.
 
 ### Roadmap:
- - [ ] add authentication provider for API
  - [x] add GUI
+ - [x] add HTTPS support
+ - [x] add authentication provider for traefik
+ - [ ] add bearer token to for API
  - [ ] add docker ssh / tcp support
  - [ ] add docker swarm support

docker-compose.http.yml

@@ -15,9 +15,9 @@ services:
       - "--providers.docker.watch=true"
       - "--providers.docker.exposedbydefault=false"
       - "--providers.docker.network=${NEKO_ROOMS_TRAEFIK_NETWORK}"
-      - "--entrypoints.${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}.address=:${NEKO_ROOMS_TRAEFIK_PORT}"
+      - "--entrypoints.${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}.address=:${APP_PORT-8080}"
     ports:
-      - "${NEKO_ROOMS_TRAEFIK_PORT}:${NEKO_ROOMS_TRAEFIK_PORT}"
+      - "${APP_PORT-8080}:${APP_PORT-8080}"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
 
@@ -30,7 +30,7 @@ services:
       - "NEKO_ROOMS_TRAEFIK_DOMAIN"
       - "NEKO_ROOMS_TRAEFIK_ENTRYPOINT"
       - "NEKO_ROOMS_TRAEFIK_NETWORK"
-      - "NEKO_ROOMS_TRAEFIK_PORT"
+      - "NEKO_ROOMS_TRAEFIK_PORT=${APP_PORT-8080}"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock"
     labels:

docker.compose.yml

@@ -0,0 +1,44 @@
+version: "3.7"
+
+networks:
+  default:
+    attachable: "true"
+    name: "${NEKO_ROOMS_TRAEFIK_NETWORK}"
+
+services:
+  traefik:
+    image: "traefik"
+    restart: unless-stopped
+    environment:
+      - "TZ"
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "./traefik/traefik.yml:/etc/traefik/traefik.yml:ro"
+      - "./traefik/usersfile:/usersfile:ro"
+      - "./traefik/acme.json:/acme.json"
+      - "./traefik/config:/config"
+
+  neko-rooms:
+    build: "./"
+    restart: unless-stopped
+    environment:
+      - "TZ"
+      - "NEKO_ROOMS_EPR"
+      - "NEKO_ROOMS_NAT1TO1"
+      - "NEKO_ROOMS_TRAEFIK_DOMAIN"
+      - "NEKO_ROOMS_TRAEFIK_ENTRYPOINT"
+      - "NEKO_ROOMS_TRAEFIK_CERTRESOLVER"
+      - "NEKO_ROOMS_TRAEFIK_NETWORK"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.neko-rooms-frontend.loadbalancer.server.port=8080"
+      - "traefik.http.routers.neko-rooms.entrypoints=${NEKO_ROOMS_TRAEFIK_ENTRYPOINT}"
+      - "traefik.http.routers.neko-rooms.rule=Host(`${NEKO_ROOMS_TRAEFIK_DOMAIN}`)"
+      - "traefik.http.routers.neko-rooms.tls=true"
+      - "traefik.http.routers.neko-rooms.tls.certresolver=${NEKO_ROOMS_TRAEFIK_CERTRESOLVER}"
+      - "traefik.http.routers.neko-rooms.middlewares=basicauth@file"

traefik/.gitignore

@@ -0,0 +1,2 @@
+acme.json
+usersfile

traefik/config/middlewares.yml

@@ -0,0 +1,10 @@
+http:
+  middlewares:
+    basicauth:
+      basicAuth:
+        usersFile: "/usersfile"
+
+    httpsredirect:
+      redirectScheme:
+        scheme: https
+        permanent: true

traefik/config/routers.yml

@@ -0,0 +1,9 @@
+http:
+  routers:
+    redirecttohttps:
+      entryPoints:
+        - "web"
+      middlewares:
+        - "httpsredirect"
+      rule: "HostRegexp(`{host:.+}`)"
+      service: "noop@internal"

traefik/config/tls.yml

@@ -0,0 +1,11 @@
+tls:
+  options:
+    default:
+      minVersion: VersionTLS12
+      cipherSuites:
+        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305

traefik/traefik.yml

@@ -0,0 +1,22 @@
+entryPoints:
+  web:
+    address: ":80"
+  websecure:
+    address: ":443"
+
+providers:
+  file:
+    directory: "/config"
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    network: traefik
+    watch: true
+    exposedByDefault: false
+
+certificatesResolvers:
+  lets-encrypt:
+    acme:
+      email: youname@example.com
+      storage: /acme.json
+      httpChallenge:
+        entryPoint: web