Compare commits
1 Commits
add-route-
...
ee89ebae07
| Author | SHA1 | Date | |
|---|---|---|---|
| ee89ebae07 |
@@ -46,10 +46,10 @@ jobs:
|
||||
needs: [prepare_context]
|
||||
if: github.event_name == 'pull_request' && github.event.action != 'closed'
|
||||
steps:
|
||||
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
|
||||
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
|
||||
|
||||
- name: Deploy via Rsync & Docker
|
||||
uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
|
||||
uses: easingthemes/ssh-deploy@16bb35ed0b6e568fa7554ebdf990fdc4c046b549 # v5.0.0
|
||||
env:
|
||||
SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
|
||||
REMOTE_HOST: ${{ env.SSH_HOST }}
|
||||
@@ -75,10 +75,10 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
if: github.ref == 'refs/heads/main'
|
||||
steps:
|
||||
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
|
||||
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
|
||||
|
||||
- name: Deploy via Rsync & Docker
|
||||
uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
|
||||
uses: easingthemes/ssh-deploy@16bb35ed0b6e568fa7554ebdf990fdc4c046b549 # v5.0.0
|
||||
env:
|
||||
SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
|
||||
REMOTE_HOST: ${{ env.SSH_HOST }}
|
||||
@@ -102,10 +102,10 @@ jobs:
|
||||
needs: [deploy_staging]
|
||||
if: github.ref == 'refs/heads/main'
|
||||
steps:
|
||||
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
|
||||
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
|
||||
|
||||
- name: Deploy via Rsync & Docker
|
||||
uses: easingthemes/ssh-deploy@a1aa0b6cf96ce2406eef90faa35007a4a7bf0ac0 # v5.1.1
|
||||
uses: easingthemes/ssh-deploy@16bb35ed0b6e568fa7554ebdf990fdc4c046b549 # v5.0.0
|
||||
env:
|
||||
SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
|
||||
REMOTE_HOST: ${{ env.SSH_HOST }}
|
||||
@@ -130,7 +130,7 @@ jobs:
|
||||
if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
|
||||
steps:
|
||||
- name: Remove Remote Environment
|
||||
uses: appleboy/ssh-action@823bd89e131d8d508129f9443cad5855e9ba96f0 # v1.2.4
|
||||
uses: appleboy/ssh-action@029f5b4aeeeb58fdfe1410a5d17f967dacf36262 # v1.0.3
|
||||
with:
|
||||
host: ${{ env.SSH_HOST }}
|
||||
username: ${{ env.SSH_USER }}
|
||||
|
||||
4
dev.env
4
dev.env
@@ -4,6 +4,4 @@ ENV=dev
|
||||
NETWORK_NAME=proxy
|
||||
CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
DOMAIN=dev.kovagoadi.hu
|
||||
ACME_BYPASS=false
|
||||
# TRAEFIK_LEGACY_OPT=
|
||||
TRAEFIK_LEGACY_OPT="--providers.file.directory=/etc/traefik"
|
||||
TRAEFIK_LEGACY_OPT=
|
||||
@@ -1,47 +0,0 @@
|
||||
# ./traefik/forward-to-legacy-nginx.yaml
|
||||
|
||||
tcp:
|
||||
routers:
|
||||
# Router for HTTPS (Passthrough)
|
||||
nginx-legacy-router-secure:
|
||||
rule: "HostSNI(`*`)"
|
||||
service: nginx-legacy-service-secure
|
||||
# Passthrough must be true for SSL to reach Nginx encrypted
|
||||
tls:
|
||||
passthrough: true
|
||||
priority: 10
|
||||
entryPoints:
|
||||
- "https"
|
||||
|
||||
services:
|
||||
# Service defining the external IP
|
||||
nginx-legacy-service-secure:
|
||||
loadBalancer:
|
||||
servers:
|
||||
# This is the actual external IP and Port of your Nginx
|
||||
- address: "webserver:443"
|
||||
|
||||
http:
|
||||
routers:
|
||||
# 1. TRAEFIK-MANAGED ACME HANDLER (Removed manual router)
|
||||
traefik-acme-handler:
|
||||
rule: "Host(`test-whoami.kovagoadi.hu`) && PathPrefix(`/.well-known/acme-challenge/`)"
|
||||
entryPoints:
|
||||
- "web"
|
||||
service: "acme-http@internal" # This is the internal service name
|
||||
priority: 1000 # High priority to ensure it wins
|
||||
|
||||
# 2. THE HTTP CATCH-ALL (Sends other ACME and HTTP to Nginx)
|
||||
nginx-legacy-router:
|
||||
rule: "HostRegexp(`^.+$`)"
|
||||
service: nginx-legacy-service
|
||||
# Low priority ensures specific containers are handled first, but before the default acme-handler
|
||||
priority: 90
|
||||
entryPoints:
|
||||
- "web"
|
||||
|
||||
services:
|
||||
nginx-legacy-service:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://webserver:80"
|
||||
@@ -1,30 +0,0 @@
|
||||
http:
|
||||
routers:
|
||||
# Router for HTTP (Port 80)
|
||||
staging:
|
||||
rule: "Host(`staging.kovagoadi.hu`) || Host(`test-whoami.staging.kovagoadi.hu`)"
|
||||
entryPoints:
|
||||
- "web"
|
||||
service: "dev-staging"
|
||||
priority: 1000000
|
||||
|
||||
# Router for HTTPS (Port 443)
|
||||
staging-secure:
|
||||
rule: "Host(`staging.kovagoadi.hu`) || Host(`dev.kovagoadi.hu`)"
|
||||
entryPoints:
|
||||
- "https"
|
||||
service: "dev-staging-secure"
|
||||
priority: 100
|
||||
tls: {} # <--- This enables TLS for this router
|
||||
|
||||
services:
|
||||
dev-staging:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://192.168.1.85:8080"
|
||||
|
||||
dev-staging-secure:
|
||||
loadBalancer:
|
||||
servers:
|
||||
# Note: Ensure Traefik trusts the cert at .85 or set insecureSkipVerify
|
||||
- url: "https://192.168.1.85:445"
|
||||
@@ -1,21 +1,18 @@
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v3.6@sha256:67622638cd88dbfcfba40159bc652ecf0aea0e032f8a3c7e3134ae7c037b9910"
|
||||
image: "traefik:v3.6@sha256:aaf0f6185419a50c74651448c1a5bf4606bd2d2ddb7b8749eed505d55bf8b8ea"
|
||||
restart: unless-stopped
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
networks:
|
||||
- proxy
|
||||
- legacy-nginx
|
||||
command:
|
||||
- "--log.level=DEBUG"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--providers.docker.network=proxy"
|
||||
- "--providers.docker.constraints=Label(`env`, `${ENV}`)"
|
||||
- "--entryPoints.web.address=:80"
|
||||
- "--entryPoints.https.address=:443"
|
||||
- "--entryPoints.web.allowACMEByPass=${ACME_BYPASS}"
|
||||
- "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
|
||||
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
|
||||
- "--certificatesresolvers.letsencrypt.acme.email=kovagoadi@gmail.com"
|
||||
@@ -30,7 +27,7 @@ services:
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "letsencrypt:/letsencrypt"
|
||||
- "./${ENV}:/etc/traefik"
|
||||
- "./${ENV}/forward-to-legacy-nginx.yaml:/etc/traefik/forward-to-legacy-nginx.yaml"
|
||||
|
||||
whoami:
|
||||
image: "traefik/whoami@sha256:200689790a0a0ea48ca45992e0450bc26ccab5307375b41c84dfc4f2475937ab"
|
||||
@@ -40,9 +37,7 @@ services:
|
||||
labels:
|
||||
- "env=${ENV}"
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.whoami.priority=1000000"
|
||||
- "traefik.http.routers.whoami.rule=Host(`test-whoami.${DOMAIN}`)"
|
||||
- "traefik.http.routers.https.priority=1000000"
|
||||
- "traefik.http.routers.https.rule=Host(`test-whoami.${DOMAIN}`)"
|
||||
- "traefik.http.routers.whoami.entrypoints=web"
|
||||
- traefik.http.routers.https.entrypoints=https
|
||||
@@ -50,8 +45,5 @@ services:
|
||||
- traefik.http.routers.https.tls.certresolver=letsencrypt
|
||||
networks:
|
||||
proxy:
|
||||
legacy-nginx:
|
||||
name: proxy
|
||||
external: true
|
||||
volumes:
|
||||
letsencrypt:
|
||||
3
prod.env
3
prod.env
@@ -4,5 +4,4 @@ ENV=prod
|
||||
NETWORK_NAME=proxy
|
||||
CERTBOT_CA_RESOLVER=https://acme-v02.api.letsencrypt.org/directory
|
||||
DOMAIN=kovagoadi.hu
|
||||
ACME_BYPASS=true
|
||||
TRAEFIK_LEGACY_OPT="--providers.file.directory=/etc/traefik"
|
||||
TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"
|
||||
@@ -9,7 +9,7 @@ tcp:
|
||||
# Passthrough must be true for SSL to reach Nginx encrypted
|
||||
tls:
|
||||
passthrough: true
|
||||
priority: 10
|
||||
priority: 1
|
||||
entryPoints:
|
||||
- "https"
|
||||
|
||||
@@ -23,20 +23,12 @@ tcp:
|
||||
|
||||
http:
|
||||
routers:
|
||||
# 1. TRAEFIK-MANAGED ACME HANDLER (Removed manual router)
|
||||
traefik-acme-handler:
|
||||
rule: "Host(`test-whoami.kovagoadi.hu`) && PathPrefix(`/.well-known/acme-challenge/`)"
|
||||
entryPoints:
|
||||
- "web"
|
||||
service: "acme-http@internal" # This is the internal service name
|
||||
priority: 1000 # High priority to ensure it wins
|
||||
|
||||
# 2. THE HTTP CATCH-ALL (Sends other ACME and HTTP to Nginx)
|
||||
# Router for HTTP
|
||||
nginx-legacy-router:
|
||||
rule: "HostRegexp(`^.+$`)"
|
||||
service: nginx-legacy-service
|
||||
# Low priority ensures specific containers are handled first, but before the default acme-handler
|
||||
priority: 90
|
||||
# Low priority ensures specific containers are handled first
|
||||
priority: 1
|
||||
entryPoints:
|
||||
- "web"
|
||||
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
http:
|
||||
routers:
|
||||
# Router for HTTP (Port 80)
|
||||
staging:
|
||||
rule: "HostRegexp({subdomain:.+}.staging.kovagoadi.hu`) || Host(`staging.kovagoadi.hu`) || Host(`dev.kovagoadi.hu`)"
|
||||
entryPoints:
|
||||
- "web"
|
||||
service: "dev-staging"
|
||||
priority: 1_000_000
|
||||
|
||||
# Router for HTTPS (Port 443)
|
||||
staging-secure:
|
||||
rule: "Host(`staging.kovagoadi.hu`) || Host(`dev.kovagoadi.hu`)"
|
||||
entryPoints:
|
||||
- "https"
|
||||
service: "dev-staging-secure"
|
||||
priority: 100
|
||||
tls: {} # <--- This enables TLS for this router
|
||||
|
||||
services:
|
||||
dev-staging:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://192.168.1.85:8080"
|
||||
|
||||
dev-staging-secure:
|
||||
loadBalancer:
|
||||
servers:
|
||||
# Note: Ensure Traefik trusts the cert at .85 or set insecureSkipVerify
|
||||
- url: "https://192.168.1.85:445"
|
||||
@@ -4,5 +4,4 @@ ENV=staging
|
||||
NETWORK_NAME=proxy
|
||||
CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
DOMAIN=staging.kovagoadi.hu
|
||||
ACME_BYPASS=false
|
||||
TRAEFIK_LEGACY_OPT=
|
||||
Reference in New Issue
Block a user