2104e5fe7d
- Drop `recreate: always` from collabora/drawio/homarr/opencloud/traefik handlers and the authentik_outpost_ldap start task. `up -d` with `state: present` already recreates exactly the services whose compose definition changed; the blanket recreate was forcing restarts even when nothing relevant moved. - Rewrite the `*_domains` Traefik Host loop to the `Host(\`a\`) || Host(\`b\`)` form across authentik/collabora/garage/nextcloud so the rule still matches when traefik can't normalize the comma-form into the same canonical shape. - Traefik: add `traefik_acme_tcp_only` (sets LEGO_EXPERIMENTAL_DNS_TCP_ONLY) and `traefik_acme_disable_ans_checks` (disables lego's authoritative-NS propagation check) for environments where the DNS path between the traefik container and the zone's nameservers is constrained. - Traefik DMZ collector: two-step merge so a `traefik_dmz_exposed_services` entry that sets its own `backend_host` wins over the host fallback; lets a route target an internal FQDN covered by the backend cert's SANs instead of the raw IP. - Nextcloud: add `nextcloud_notify_push_domain` override for the `occ notify_push:setup` call so the setup check can hit an internal FQDN instead of hairpinning through the DMZ. Push router now matches every entry in `nextcloud_domains`. - Nextcloud: also %2F-escape slashes in the postgres user/password inside the notify_push DATABASE_URL.
66 lines
No EOL
1.3 KiB
Django/Jinja
66 lines
No EOL
1.3 KiB
Django/Jinja
log:
|
|
level: {{ traefik_log_level }}
|
|
|
|
{% if traefik_enable_dashboard %}
|
|
api:
|
|
dashboard: true
|
|
{% if not traefik_dashboard_domain %}
|
|
insecure: true
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if traefik_enable_access_logs %}
|
|
accessLog:
|
|
format: {{ traefik_access_log_format }}
|
|
{% endif %}
|
|
|
|
entryPoints:
|
|
web:
|
|
address: ":80"
|
|
{% if traefik_use_ssl %}
|
|
http:
|
|
redirections:
|
|
entryPoint:
|
|
to: websecure
|
|
scheme: https
|
|
{% endif %}
|
|
websecure:
|
|
address: ":443"
|
|
|
|
providers:
|
|
file:
|
|
directory: /config
|
|
watch: true
|
|
{% if traefik_mode == 'backend' %}
|
|
docker:
|
|
endpoint: "unix:///var/run/docker.sock"
|
|
network: {{ traefik_network }}
|
|
exposedByDefault: false
|
|
{% endif %}
|
|
|
|
{% if traefik_use_ssl and traefik_cert_mode == 'acme' %}
|
|
certificatesResolvers:
|
|
{{ traefik_ssl_cert_resolver }}:
|
|
acme:
|
|
email: {{ traefik_ssl_email }}
|
|
storage: /letsencrypt/acme.json
|
|
dnsChallenge:
|
|
provider: rfc2136
|
|
resolvers:
|
|
- "{{ traefik_acme_dns_nameserver }}"
|
|
{% if traefik_acme_disable_ans_checks | default(false) %}
|
|
propagation:
|
|
disableANSChecks: true
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if traefik_use_ssl %}
|
|
tls:
|
|
options:
|
|
default:
|
|
minVersion: VersionTLS12
|
|
{% endif %}
|
|
|
|
global:
|
|
checkNewVersion: false
|
|
sendAnonymousUsage: false |