Move to Traefik

internal/component/web/web-http.env

@@ -1,2 +0,0 @@
-DEFAULT_HOST=${DEFAULT_HOST}
-HTTPS_METHOD=nohttps

internal/component/web/web-http/docker-compose.yml

@@ -1,30 +1,27 @@
 version: "3.7"
 
 services:
-  nginx-proxy:
-    image: ghcr.io/nginx-proxy/nginx-proxy:alpine
-    environment:
-      - DEFAULT_HOST=${DEFAULT_HOST}
-      - HTTPS_METHOD=${HTTPS_METHOD}
+  reverse-proxy:
+    image: docker.io/library/traefik:v2.9
+    command:
+      - "--providers.docker"
+      - "--providers.docker.exposedByDefault=false"
+      - "--providers.docker.network=${DOCKER_NETWORK_NAME}"
+      - "--providers.docker.constraints=Label(`eu.wiss-ki.barrel.distillery`,`${DOCKER_NETWORK_NAME}`)"
+      - "--entrypoints.web.address=:80"
+
+      ## for debugging purposes, the following can be enabled.
+      # - "--api.insecure=true"
     ports:
       - "80:80"
+      # - "127.0.0.1:8888:8080"
     volumes:
-      - "vhost:/etc/nginx/vhost.d"
-      - "./global.conf:/etc/nginx/conf.d/global.conf:ro"
-      - "./proxy.conf:/etc/nginx/proxy.conf:ro"
-      - "htpasswd:/etc/nginx/htpasswd"
-      - "html:/usr/share/nginx/html"
-      - "/var/run/docker.sock:/tmp/docker.sock:ro"
+      - "/var/run/docker.sock:/var/run/docker.sock"
     restart: always
     networks:
       - default
 
-volumes:
-  vhost:
-  html:
-  htpasswd:
-
 networks:
   default:
-    name: distillery
+    name: ${DOCKER_NETWORK_NAME}
     external: true

internal/component/web/web-http/global.conf

@@ -1,4 +0,0 @@
-# Nginx Configuration File
-# These should match with distillery/resources/compose/barrel/conf/wisski.ini.
- 
-client_max_body_size 1000m;

internal/component/web/web-http/proxy.conf

@@ -1,19 +0,0 @@
-# HTTP 1.1 support
-proxy_http_version 1.1;
-proxy_buffering off;
-proxy_set_header Host $http_host;
-proxy_set_header Upgrade $http_upgrade;
-proxy_set_header Connection $proxy_connection;
-proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
-proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-
-# Mitigate httpoxy attack (see README for details)
-proxy_set_header Proxy "";
-
-# Timeouts for the proxy connection - in sync with the appropriate max_execution time.
-proxy_connect_timeout 3000s;
-proxy_read_timeout 3000s;
-proxy_send_timeout 3000s;

internal/component/web/web-https.env

@@ -1,2 +0,0 @@
-DEFAULT_HOST=${DEFAULT_HOST}
-HTTPS_METHOD=redirect

internal/component/web/web-https/docker-compose.yml

@@ -1,52 +1,41 @@
 version: "3.7"
 
 services:
-  nginx-proxy:
-    image: ghcr.io/nginx-proxy/nginx-proxy:alpine
-    environment:
-      - DEFAULT_HOST=${DEFAULT_HOST}
-      - HTTPS_METHOD=${HTTPS_METHOD}
+  reverse-proxy:
+    image: docker.io/library/traefik:v2.9
+    command:
+      - "--providers.docker"
+
+      - "--providers.docker.exposedByDefault=false"
+      - "--providers.docker.network=${DOCKER_NETWORK_NAME}"
+      - "--providers.docker.constraints=Label(`eu.wiss-ki.barrel.distillery`,`${DOCKER_NETWORK_NAME}`)"
+  
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
+      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
+      - "--entrypoints.websecure.address=:443"
+      
+      - "--certificatesresolvers.distillery.acme.httpchallenge=true"
+      - "--certificatesresolvers.distillery.acme.email=${CERT_EMAIL}"
+      - "--certificatesresolvers.distillery.acme.storage=/acme.json"
+      - "--certificatesresolvers.distillery.acme.httpchallenge.entrypoint=web"
+
+      ## for debugging purposes, the following can be enabled.
+      # - "--api.insecure=true"
+      # - "--certificatesresolvers.distillery.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
+
     ports:
       - "80:80"
       - "443:443"
+      # - "127.0.0.1:8888:8080"
     volumes:
-      - "vhost:/etc/nginx/vhost.d"
-      - "./global.conf:/etc/nginx/conf.d/global.conf:ro"
-      - "./proxy.conf:/etc/nginx/proxy.conf:ro"
-      - "htpasswd:/etc/nginx/htpasswd"
-      - "html:/usr/share/nginx/html"
-      - "/var/run/docker.sock:/tmp/docker.sock:ro"
-      - "certs:/etc/nginx/certs"
-    labels:
-      com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: true
+      - "/var/run/docker.sock:/var/run/docker.sock"
+      - "./acme.json:/acme.json"
     restart: always
     networks:
       - default
 
-  letsencrypt-nginx-proxy-companion:
-    image: docker.io/nginxproxy/acme-companion:latest
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "htpasswd:/etc/nginx/htpasswd"
-      - "vhost:/etc/nginx/vhost.d"
-      - "html:/usr/share/nginx/html"
-      - "/var/run/docker.sock:/tmp/docker.sock:ro"
-      - "certs:/etc/nginx/certs"
-      - "acme:/etc/acme.sh"
-    restart: always
-    networks:
-      - default
-    depends_on:
-      - nginx-proxy
-
-volumes:
-  acme:
-  vhost:
-  html:
-  certs:
-  htpasswd:
-
 networks:
   default:
-    name: distillery
+    name: ${DOCKER_NETWORK_NAME}
     external: true

internal/component/web/web-https/global.conf

@@ -1,4 +0,0 @@
-# Nginx Configuration File
-# These should match with distillery/resources/compose/barrel/conf/wisski.ini.
- 
-client_max_body_size 1000m;

internal/component/web/web-https/proxy.conf

@@ -1,19 +0,0 @@
-# HTTP 1.1 support
-proxy_http_version 1.1;
-proxy_buffering off;
-proxy_set_header Host $http_host;
-proxy_set_header Upgrade $http_upgrade;
-proxy_set_header Connection $proxy_connection;
-proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
-proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-
-# Mitigate httpoxy attack (see README for details)
-proxy_set_header Proxy "";
-
-# Timeouts for the proxy connection - in sync with the appropriate max_execution time.
-proxy_connect_timeout 3000s;
-proxy_read_timeout 3000s;
-proxy_send_timeout 3000s;

internal/component/web/web.env

@@ -0,0 +1,2 @@
+DOCKER_NETWORK_NAME=${DOCKER_NETWORK_NAME}
+CERT_EMAIL=${CERT_EMAIL}

internal/component/web/web.go

@@ -37,33 +37,37 @@ func (web Web) Stack(env environment.Environment) component.StackWithResources {
 }
 
 //go:embed all:web-https
-//go:embed web-https.env
+//go:embed web.env
 var httpsResources embed.FS
 
 func (web *Web) stackHTTPS(env environment.Environment) component.StackWithResources {
 	return component.MakeStack(web, env, component.StackWithResources{
 		Resources:   httpsResources,
 		ContextPath: "web-https",
-		EnvPath:     "web-https.env",
+		EnvPath:     "web.env",
 
 		EnvContext: map[string]string{
-			"DEFAULT_HOST": web.Config.DefaultDomain,
+			"DOCKER_NETWORK_NAME": web.Config.DockerNetworkName,
+			"CERT_EMAIL":          web.Config.CertbotEmail,
 		},
+		TouchFilesPerm: 0600,
+		TouchFiles:     []string{"acme.json"},
 	})
 }
 
 //go:embed all:web-http
-//go:embed web-http.env
+//go:embed web.env
 var httpResources embed.FS
 
 func (web *Web) stackHTTP(env environment.Environment) component.StackWithResources {
 	return component.MakeStack(web, env, component.StackWithResources{
 		Resources:   httpResources,
 		ContextPath: "web-http",
-		EnvPath:     "web-http.env",
+		EnvPath:     "web.env",
 
 		EnvContext: map[string]string{
-			"DEFAULT_HOST": web.Config.DefaultDomain,
+			"DOCKER_NETWORK_NAME": web.Config.DockerNetworkName,
+			"CERT_EMAIL":          web.Config.CertbotEmail,
 		},
 	})
 }