mirror of
https://github.com/openziti/zrok.git
synced 2025-07-21 16:08:05 +02:00
81 lines
3.6 KiB
YAML
81 lines
3.6 KiB
YAML
# delete this file from your compose project if you do not want to use Traefik for TLS termination
|
|
services:
|
|
traefik:
|
|
build:
|
|
context: .
|
|
dockerfile: ./traefik.Dockerfile
|
|
restart: unless-stopped
|
|
environment:
|
|
# DNS provider configuration
|
|
TRAEFIK_CERTIFICATESRESOLVERS_default_ACME_EMAIL: ${ZROK_USER_EMAIL}
|
|
TRAEFIK_CERTIFICATESRESOLVERS_default_ACME_CASERVER: ${TRAEFIK_ACME_API:-https://acme-v02.api.letsencrypt.org/directory}
|
|
TRAEFIK_CERTIFICATESRESOLVERS_default_ACME_DNSCHALLENGE: "true"
|
|
TRAEFIK_CERTIFICATESRESOLVERS_default_ACME_DNSCHALLENGE_PROVIDER: ${TRAEFIK_DNS_PROVIDER}
|
|
TRAEFIK_CERTIFICATESRESOLVERS_default_ACME_DNSCHALLENGE_RESOLVERS: "1.1.1.1:53,8.8.8.8:53"
|
|
TRAEFIK_CERTIFICATESRESOLVERS_default_ACME_DNSCHALLENGE_DELAYBEFORECHECK: "60"
|
|
TRAEFIK_CERTIFICATESRESOLVERS_default_ACME_STORAGE: /etc/traefik/acme/acme.json
|
|
|
|
# Entrypoints configuration
|
|
TRAEFIK_ENTRYPOINTS_websecure_ADDRESS: ":${TRAEFIK_HTTPS_PORT:-443}"
|
|
|
|
# DNS provider credentials - these will be mapped to environment variables expected by the provider
|
|
# See: https://doc.traefik.io/traefik/https/acme/#providers
|
|
TRAEFIK_DNS_PROVIDER: ${TRAEFIK_DNS_PROVIDER} # e.g., "digitalocean"
|
|
|
|
# Provider-specific credentials - uncomment and set in .env as needed
|
|
# Digital Ocean
|
|
# DO_AUTH_TOKEN: ${TRAEFIK_DNS_PROVIDER_TOKEN:-}
|
|
|
|
# Cloudflare - Option 1: Using Email and API Key
|
|
# CLOUDFLARE_EMAIL: ${CLOUDFLARE_EMAIL:-}
|
|
# CLOUDFLARE_API_KEY: ${CLOUDFLARE_API_KEY:-}
|
|
|
|
# Cloudflare - Option 2: Using API Tokens (recommended)
|
|
CLOUDFLARE_DNS_API_TOKEN: ${TRAEFIK_DNS_PROVIDER_TOKEN:-}
|
|
# CLOUDFLARE_ZONE_API_TOKEN: ${TRAEFIK_DNS_PROVIDER_TOKEN:-}
|
|
|
|
# AWS Route53 - uncomment if using Route53
|
|
# AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
|
|
# AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
|
|
# AWS_REGION: ${AWS_REGION:-}
|
|
# AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-} # if temporary credential, e.g., from STS
|
|
|
|
# General configuration
|
|
ZROK_DNS_ZONE: ${ZROK_DNS_ZONE} # e.g., "example.com" or "127.0.0.1.sslip.io"
|
|
ZROK_CTRL_PORT: ${ZROK_CTRL_PORT:-18080}
|
|
ZROK_FRONTEND_PORT: ${ZROK_FRONTEND_PORT:-8080}
|
|
ZROK_OAUTH_PORT: ${ZROK_OAUTH_PORT:-8081}
|
|
ZITI_CTRL_ADVERTISED_PORT: ${ZITI_CTRL_ADVERTISED_PORT:-80}
|
|
|
|
# Traefik specific configurations
|
|
TRAEFIK_API_DASHBOARD: "true"
|
|
TRAEFIK_API_INSECURE: "false"
|
|
TRAEFIK_PROVIDERS_DOCKER: "false" # Disable Docker provider since we're not mounting the socket
|
|
TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT: "false"
|
|
TRAEFIK_PROVIDERS_FILE_DIRECTORY: "/etc/traefik/dynamic"
|
|
TRAEFIK_PROVIDERS_FILE_WATCH: "true"
|
|
TRAEFIK_LOG_LEVEL: "DEBUG"
|
|
TRAEFIK_ACCESSLOG: "true"
|
|
TRAEFIK_ACCESSLOG_FORMAT: "common"
|
|
|
|
expose:
|
|
- ${TRAEFIK_HTTPS_PORT:-443}/tcp
|
|
- ${TRAEFIK_HTTPS_PORT:-443}/udp # For HTTP/3 (QUIC) (not published yet)
|
|
- 8080/tcp # Traefik's admin API (not published)
|
|
ports:
|
|
- ${TRAEFIK_INTERFACE:-0.0.0.0}:${TRAEFIK_HTTPS_PORT:-443}:${TRAEFIK_HTTPS_PORT:-443}
|
|
# - ${TRAEFIK_INTERFACE:-0.0.0.0}:${TRAEFIK_HTTPS_PORT:-443}:${TRAEFIK_HTTPS_PORT:-443}/udp # future: HTTP/3 (QUIC)
|
|
volumes:
|
|
- traefik_data:/etc/traefik/acme
|
|
# - /var/run/docker.sock:/var/run/docker.sock:ro # Docker provider for detecting new routes by label
|
|
networks:
|
|
zrok-instance:
|
|
|
|
zrok-frontend:
|
|
environment:
|
|
ZROK_FRONTEND_SCHEME: https
|
|
ZROK_FRONTEND_PORT: ${TRAEFIK_HTTPS_PORT:-443}
|
|
|
|
volumes:
|
|
traefik_data:
|