Add infra.yml

infra.yml

@@ -0,0 +1,118 @@
+  socketproxy:
+services:
+    networks:
+    image: tecnativa/docker-socket-proxy
+      - socketproxy
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+    environment:
+      NETWORKS: 1
+      SERVICES: 1
+      TASKS: 1
+    #  Non Default permissions
+      CONTAINERS: 1
+    #   BUILD: 1
+    #   COMMIT: 1
+    #   CONFIGS: 1
+    #   CONTAINERS: 1
+    #   DISTRIBUTION: 1
+    #   EXEC: 1
+    #   GRPC: 1
+    #   IMAGES: 1
+    #   INFO: 1
+    #   NETWORKS: 1
+    #   NODES: 1
+    #   PLUGINS: 1
+    #   SERVICES: 1
+    #   SESSION: 1
+    #   SWARM: 1
+    #   SYSTEM: 1
+    #   TASKS: 1
+    #   VOLUMES: 1
+    deploy:
+      endpoint_mode: dnsrr
+      placement:
+        constraints:
+          - node.role == manager
+      update_config:
+        order: start-first
+        failure_action: rollback
+        delay: 0s
+        parallelism: 1
+      restart_policy:
+        condition: on-failure
+
+
+  traefik-http:
+    image: traefik:v2
+    command:
+      - "--providers.docker.endpoint=http://socketproxy_socketproxy:2375"
+      - "--log.level=ERROR"
+      - "--global.checknewversion=false"
+      - "--global.sendanonymoususage=false"
+      - "--providers.docker.swarmMode=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--providers.docker.network=traefik"
+      - "--serverstransport.insecureskipverify=true"
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.websecure.address=:443"
+      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
+      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
+      - "--entrypoints.web.http.redirections.entryPoint.permanent=true"  # Permanent redirect
+      - "--certificatesresolvers.letsencryptresolver.acme.httpchallenge=true"
+      - "--certificatesresolvers.letsencryptresolver.acme.httpchallenge.entrypoint=web"
+      - "--certificatesresolvers.letsencryptresolver.acme.email=admin@nixc.us"
+      - "--certificatesresolvers.letsencryptresolver.acme.storage=/letsencrypt/acme.json"
+      - "--api.dashboard=true"
+      - "--entryPoints.websecure.forwardedHeaders.insecure=true"
+      - "--entryPoints.websecure.transport.respondingTimeouts.idleTimeout=600s"
+      - "--entryPoints.websecure.transport.respondingTimeouts.readTimeout=600s"
+      - "--entryPoints.websecure.transport.respondingTimeouts.writeTimeout=600s"
+    ports:
+      - target: 80
+        published: 80
+        protocol: tcp
+        mode: host
+      - target: 443
+        published: 443
+        protocol: tcp
+        mode: host
+    volumes:
+      - /mnt/tank/persist/nixc.us/traefik/production/config:/letsencrypt
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - traefik
+      - socketproxy
+    deploy:
+      endpoint_mode: dnsrr
+      placement:
+        constraints:
+          - node.hostname == {{hostname}}
+      labels:
+        homepage.group: Infrastructure
+        homepage.name: Ingress
+        homepage.href: https://{{url}}/
+        homepage.description:
+        us.nixc.autodeploy: "true"
+        traefik.enable: "true"
+        traefik.docker.network: traefik
+        traefik.http.routers.traefik_traefik-http.tls: "true"
+        traefik.http.routers.traefik_traefik-http.rule: "Host(`{{url}}`)"
+        traefik.http.routers.traefik_traefik-http.entrypoints: "websecure"
+        traefik.http.routers.traefik_traefik-http.tls.certresolver: "letsencryptresolver"
+        traefik.http.routers.traefik_traefik-http.service: "api@internal"
+        traefik.http.services.traefik_traefik-http.loadbalancer.server.port: "888"
+      update_config:
+        order: stop-first
+        failure_action: rollback
+        delay: 15s
+        parallelism: 1
+      restart_policy:
+        condition: on-failure
+
+# docker network create --driver=overlay socketproxy
+networks:
+  socketproxy:
+    external: true
+  traefik:
+    external: true