blob: dfdd6baa16f3a660a313408cb6c2c115bfa6ea21 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
services:
headscale-client:
image: tailscale/tailscale:latest
hostname: headscale-traefik
restart: unless-stopped
environment:
- TS_AUTHKEY={{ headscale_user_auth_key }}
- TS_EXTRA_ARGS=--login-server=https://{{ headscale_host }} --accept-dns --stateful-filtering=false
- TS_STATE_DIR=/var/lib/tailscale
- TS_USERSPACE=false
- TZ={{ timezone }}
volumes:
- {{ traefik_base }}/volumes/headscale:/var/lib/tailscale
- /dev/net/tun:/dev/net/tun
cap_add:
- NET_ADMIN
- SYS_ADMIN
networks:
- headnet
deploy:
mode: replicated
replicas: 1
placement:
constraints: [node.role == manager]
traefik:
image: traefik:v3
restart: unless-stopped
depends_on:
- headscale-client
ports:
- 80:80
- 443:443
- 53:53
- 53:53/udp
environment:
- TZ={{ timezone }}
- CF_API_EMAIL={{ cloudflare_email }}
- CF_DNS_API_TOKEN={{ cloudflare_dns_api_token }}
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- {{ traefik_base }}/stacks/traefik.yml:/traefik.yml
- {{ traefik_base }}/volumes/certs:/certs
networks:
- proxy
- headnet
deploy:
mode: global
placement:
constraints: [node.role == manager]
labels:
- traefik.enable=true
- traefik.http.routers.dashboard.rule=Host(`traefik.{{ traefik_domain }}`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard/`))
- traefik.http.routers.dashboard.service=api@internal
- traefik.http.routers.dashboard.tls=true
- traefik.http.routers.dashboard.tls.certresolver=letsencrypt
- traefik.http.routers.ping.rule=Host(`traefik.{{ traefik_domain }}`) && PathPrefix(`/ping`)
- traefik.http.routers.ping.service=ping@internal
- traefik.http.routers.ping.tls=true
- traefik.http.routers.ping.tls.certresolver=letsencrypt
- traefik.http.services.dashboard.loadbalancer.server.port=8080
- traefik.http.services.ping.loadbalancer.server.port=8080
networks:
proxy:
name: proxy
driver: overlay
attachable: true
headnet:
|
