blob: dfcf72c8275f268c62e4beade2061a7193aa3447 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
services:
headscale-client:
image: tailscale/tailscale:latest
hostname: headscale-traefik
environment:
- DEPLOYMENT_TIME={{ deployment_time }}
- TZ={{ timezone }}
- TS_AUTHKEY={{ headscale_user_auth_key }}
- TS_EXTRA_ARGS=--login-server=https://{{ headscale_host }} --accept-dns --stateful-filtering=false --advertise-routes={{ loadbalancer_ip }}/32
- TS_STATE_DIR=/var/lib/tailscale
- TS_USERSPACE=false
healthcheck:
test: ["CMD-SHELL", "tailscale status"]
interval: 1s
timeout: 5s
retries: 10
volumes:
- {{ traefik_base }}/volumes/headscale:/var/lib/tailscale
- /dev/net/tun:/dev/net/tun
cap_add:
- NET_ADMIN
- SYS_ADMIN
networks:
- headnet
deploy:
mode: replicated
replicas: 1
update_config:
parallelism: 1
order: stop-first # hostname conflicts
failure_action: rollback
monitor: 8s
traefik:
image: traefik:v3
depends_on:
- headscale-client
ports:
# http
- 80:80
- 443:443
healthcheck:
test: traefik healthcheck --ping
interval: 10s
retries: 2
timeout: 3s
environment:
- DEPLOYMENT_TIME={{ deployment_time }}
- TZ={{ timezone }}
- CF_API_EMAIL={{ cloudflare_email }}
- CF_DNS_API_TOKEN={{ cloudflare_dns_api_token }}
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- {{ traefik_base }}/stacks/traefik.yml:/traefik.yml
- {{ traefik_base }}/volumes/certs:/certs
networks:
- proxy
- headnet
deploy:
mode: replicated
replicas: 2
update_config:
parallelism: 1
order: start-first
failure_action: rollback
monitor: 8s
labels:
- traefik.enable=true
- traefik.http.routers.dashboard.rule=Host(`{{ traefik_domain }}`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))
- traefik.http.routers.dashboard.service=api@internal
- traefik.http.routers.dashboard.tls=true
- traefik.http.routers.dashboard.tls.certresolver=letsencrypt
- traefik.http.routers.ping.rule=Host(`{{ traefik_domain }}`) && PathPrefix(`/ping`)
- traefik.http.routers.ping.service=ping@internal
- traefik.http.routers.ping.tls=true
- traefik.http.routers.ping.tls.certresolver=letsencrypt
- traefik.http.services.dashboard.loadbalancer.server.port=8080
- traefik.http.services.ping.loadbalancer.server.port=8080
networks:
proxy:
name: proxy
driver: overlay
attachable: true
headnet:
|
