b6bbe77dff
Traefik now also listens on `extra`, whose name comes from TRAEFIK_EXTRA_NETWORK and defaults to rpc_extra (matching the rpc_chains convention). It is not `external: true`, so compose creates it; hosts that never use it just get an empty bridge. Why: anything that wants a traefik route currently has to sit on `chains`, which on a typical host means 26 containers including unauthenticated redis:6379, traefik:8080 (--api.insecure=true) and several unauthenticated :8545 endpoints. A public site accepting anonymous uploads does not belong there. With this it can be routed from an isolated network that only traefik bridges into. Validated with `docker compose config` against a real host .env: unset -> rpc_extra, TRAEFIK_EXTRA_NETWORK=vientiane_net -> vientiane_net, traefik on [chains, extra] in both. Operational note: changing traefik's network list means the NEXT rpc-update on a host recreates the traefik container, briefly interrupting all HTTP/HTTPS routing on that host, RPC endpoints included. Nothing pulls /root/rpc on its own, so this lands host by host and should ride the serving gate. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KjqejYycVyVvrxV9aTDhgX
53 lines
1.9 KiB
YAML
53 lines
1.9 KiB
YAML
services:
|
|
traefik:
|
|
image: traefik:v3.6.1
|
|
container_name: traefik
|
|
restart: always
|
|
expose:
|
|
- "8082"
|
|
ports:
|
|
- "443:443"
|
|
- "80:80"
|
|
- "3042:3042"
|
|
command:
|
|
- "--api=true"
|
|
- "--api.insecure=true"
|
|
- "--api.dashboard=true"
|
|
- "--log.level=info"
|
|
- "--core.defaultRuleSyntax=v2"
|
|
- "--providers.docker=true"
|
|
- "--providers.docker.exposedbydefault=false"
|
|
- "--providers.file.filename=/dynamic_config.yml"
|
|
- "--entrypoints.websecure.address=:443"
|
|
# disable read timeout to not timeout webdav uploads.
|
|
# TODO:can this be local to the webdav container
|
|
- "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
|
|
- "--entrypoints.metrics.address=:8082"
|
|
- "--entrypoints.grpc.address=:3042"
|
|
- "--entrypoints.web.address=:80"
|
|
- "--metrics.prometheus.entryPoint=metrics"
|
|
- "${NO_SSL:---entrypoints.web.http.redirections.entryPoint.to=websecure}"
|
|
- "${NO_SSL:---entrypoints.web.http.redirections.entryPoint.scheme=https}"
|
|
- "${NO_SSL:---certificatesresolvers.myresolver.acme.tlschallenge=true}"
|
|
- "${NO_SSL:---certificatesresolvers.myresolver.acme.email=$EMAIL}"
|
|
- "${NO_SSL:---certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json}"
|
|
volumes:
|
|
- "./traefik/letsencrypt:/letsencrypt"
|
|
- "./main_configs:/main_configs"
|
|
- "./traefik/config/dynamic_config.yml:/dynamic_config.yml"
|
|
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
|
networks:
|
|
- chains
|
|
- extra
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.middlewares.ipallowlist.ipallowlist.sourcerange=$WHITELIST"
|
|
- "prometheus-scrape.enabled=true"
|
|
- "prometheus-scrape.port=8082"
|
|
- "prometheus-scrape.job_name=traefik"
|
|
logging:
|
|
options:
|
|
max-file: '1'
|
|
compress: 'false'
|
|
driver: local
|