Fix Traefik configuration issues and improve security

- Upgrade to traefik:latest to fix Docker API compatibility with v29
- Fix websecure entrypoint indentation in traefik.yml
- Remove obsolete DOCKER_API_VERSION environment variable
- Remove incompatible network_mode: host setting
- Set network to external for multi-compose compatibility
- Add environment variable support for certificate email
- Add acme.json to .gitignore for security
- Create acme.json with correct 600 permissions

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
BeauTroll
2025-12-21 04:31:56 +01:00
parent c53a6bcce3
commit 4e16685ebe
4 changed files with 7 additions and 10 deletions

View File

@@ -1,3 +1,4 @@
DASHBOARD_HOST= DASHBOARD_HOST=
DASHBOARD_USER= DASHBOARD_USER=
DASHNOARD_PASSWORD= DASHNOARD_PASSWORD=
CERT_EMAIL=

1
.gitignore vendored
View File

@@ -1 +1,2 @@
.env .env
acme.json

View File

@@ -1,16 +1,13 @@
services: services:
traefik: traefik:
image: traefik:v3.2 image: traefik:latest
container_name: traefik container_name: traefik
restart: unless-stopped restart: unless-stopped
network_mode: host
security_opt: security_opt:
- no-new-privileges:true - no-new-privileges:true
ports: ports:
- "80:80" - "80:80"
- "443:443" - "443:443"
environment:
- DOCKER_API_VERSION=1.44
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro - /var/run/docker.sock:/var/run/docker.sock:ro
- ./traefik.yml:/etc/traefik/traefik.yml:ro - ./traefik.yml:/etc/traefik/traefik.yml:ro
@@ -25,7 +22,6 @@ services:
- "traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt" - "traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt"
- "traefik.http.routers.traefik-dashboard.middlewares=traefik-auth" - "traefik.http.routers.traefik-dashboard.middlewares=traefik-auth"
- "traefik.http.middlewares.traefik-auth.basicauth.users=${DASHBOARD_USER}:${DASHBOARD_PASSWORD}" - "traefik.http.middlewares.traefik-auth.basicauth.users=${DASHBOARD_USER}:${DASHBOARD_PASSWORD}"
networks: networks:
traefik-net: traefik-net:
external: false external: true

View File

@@ -9,19 +9,18 @@ entryPoints:
entryPoint: entryPoint:
to: websecure to: websecure
scheme: https scheme: https
websecure: websecure:
address: ":443" address: ":443"
certificatesResolvers: certificatesResolvers:
letsencrypt: letsencrypt:
acme: acme:
email: votre@email.com email: ${CERT_EMAIL}
storage: acme.json storage: acme.json
httpChallenge: httpChallenge:
entryPoint: web entryPoint: web
providers: providers:
docker: docker:
endpoint: "unix:///var/run/docker.sock"
exposedByDefault: false exposedByDefault: false
network: traefik-net network: traefik-net