Add copy treafik config
This commit is contained in:
parent
3fbdcc0a51
commit
445c50dab6
12 changed files with 13 additions and 2 deletions
2
roles/traefik/files/config/.gitignore
vendored
Normal file
2
roles/traefik/files/config/.gitignore
vendored
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
acme.json
|
||||
acme.json*
|
||||
1
roles/traefik/files/config/dynamic_conf.yaml
Normal file
1
roles/traefik/files/config/dynamic_conf.yaml
Normal file
|
|
@ -0,0 +1 @@
|
|||
http: {}
|
||||
51
roles/traefik/files/config/traefik.yml
Normal file
51
roles/traefik/files/config/traefik.yml
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
log:
|
||||
level: DEBUG
|
||||
|
||||
api:
|
||||
dashboard: true
|
||||
|
||||
accessLog:
|
||||
filePath: "/var/log/traefik/access.log"
|
||||
format: json
|
||||
|
||||
entryPoints:
|
||||
http:
|
||||
address: ":80"
|
||||
http:
|
||||
redirections:
|
||||
entryPoint:
|
||||
to: https
|
||||
scheme: https
|
||||
https:
|
||||
address: ":443"
|
||||
metrics:
|
||||
address: ":8080"
|
||||
|
||||
metrics:
|
||||
prometheus:
|
||||
entryPoint: metrics
|
||||
buckets:
|
||||
- 0.1
|
||||
- 0.3
|
||||
- 1.2
|
||||
- 5.0
|
||||
addEntryPointsLabels: true
|
||||
addServicesLabels: true
|
||||
|
||||
providers:
|
||||
docker:
|
||||
endpoint: "unix:///var/run/docker.sock"
|
||||
exposedByDefault: false
|
||||
http:
|
||||
endpoint: "http://http_provider/dynamic_conf.yaml"
|
||||
|
||||
certificatesResolvers:
|
||||
sslResolver:
|
||||
acme:
|
||||
email: florian.richer.97@outlook.com
|
||||
tlschallenge: {}
|
||||
storage: acme.json
|
||||
keyType: RSA4096
|
||||
#caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
|
||||
httpChallenge:
|
||||
entryPoint: http
|
||||
126
roles/traefik/files/docker-compose.yml
Normal file
126
roles/traefik/files/docker-compose.yml
Normal file
|
|
@ -0,0 +1,126 @@
|
|||
version: '3'
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: traefik:latest
|
||||
container_name: traefik
|
||||
restart: unless-stopped
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
networks:
|
||||
- providers
|
||||
- proxy
|
||||
ports:
|
||||
- 80:80
|
||||
- 443:443
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- ./config/traefik.yml:/traefik.yml:ro
|
||||
- ./config/acme.json:/acme.json:rw
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
extra_hosts:
|
||||
- "host.docker.internal:host-gateway"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.middlewares.traefik-auth.basicauth.users=mrdev023:$$2y$$05$$t51tXUW6zO9dndSK1JEFS.utJ3th/RYVSgDlouOZhUigjbkTX1zQC$$"
|
||||
- "traefik.http.middlewares.traefik-stripprefix.stripprefix.prefixes=/traefik"
|
||||
- "traefik.http.routers.traefik-secure.entrypoints=https"
|
||||
- "traefik.http.routers.traefik-secure.rule=Host(`dash.mrdev023.fr`) && (PathPrefix(`/traefik`) || PathPrefix(`/api`))"
|
||||
- "traefik.http.middlewares.tls-rep.redirectregex.permanent=true"
|
||||
- "traefik.http.middlewares.tls-header.headers.SSLRedirect=true"
|
||||
- "traefik.http.middlewares.tls-header.headers.forceSTSHeader=true"
|
||||
- "traefik.http.middlewares.tls-header.headers.STSSeconds=315360000"
|
||||
- "traefik.http.middlewares.tls-header.headers.STSIncludeSubdomains=true"
|
||||
- "traefik.http.middlewares.tls-header.headers.STSPreload=true"
|
||||
- "traefik.http.middlewares.tls-header.headers.browserXSSFilter=true"
|
||||
- "traefik.http.middlewares.tls-header.headers.contentTypeNosniff=true"
|
||||
- "traefik.http.middlewares.tls-header.headers.frameDeny=true"
|
||||
- "traefik.http.middlewares.tls-header.headers.customFrameOptionsValue=SAMEORIGIN"
|
||||
- "traefik.http.middlewares.tls-header.headers.featurePolicy=accelerometer 'none'; ambient-light-sensor 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; usb 'none'; midi 'none'; sync-xhr 'none'; vr 'none'"
|
||||
- "traefik.http.middlewares.tls-header.headers.referrerPolicy=strict-origin-when-cross-origin"
|
||||
- "traefik.http.middlewares.tls-chain.chain.middlewares=tls-rep,tls-header"
|
||||
- "traefik.http.routers.traefik-secure.middlewares=traefik-stripprefix,tls-chain,traefik-auth"
|
||||
- "traefik.http.routers.traefik-secure.tls=true"
|
||||
- "traefik.http.routers.traefik-secure.tls.certresolver=sslResolver"
|
||||
- "traefik.http.routers.traefik-secure.service=api@internal"
|
||||
|
||||
prometheus:
|
||||
image: prom/prometheus:latest
|
||||
restart: unless-stopped
|
||||
container_name: prometheus
|
||||
volumes:
|
||||
- ./prometheus/:/etc/prometheus/
|
||||
- prometheus:/prometheus
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
command:
|
||||
- "--web.route-prefix=/"
|
||||
- "--web.external-url=https://dash.mrdev023.fr/prometheus"
|
||||
- "--config.file=/etc/prometheus/prometheus.yml"
|
||||
- "--storage.tsdb.path=/prometheus"
|
||||
- "--web.console.libraries=/usr/share/prometheus/console_libraries"
|
||||
- "--web.console.templates=/usr/share/prometheus/consoles"
|
||||
networks:
|
||||
- proxy
|
||||
- internal
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.middlewares.prometheus-auth.basicauth.users=mrdev023:$$2y$$05$$t51tXUW6zO9dndSK1JEFS.utJ3th/RYVSgDlouOZhUigjbkTX1zQC$$"
|
||||
- "traefik.http.middlewares.prometheus-stripprefix.stripprefix.prefixes=/prometheus"
|
||||
- "traefik.http.routers.prometheus-secure.entrypoints=https"
|
||||
- "traefik.http.routers.prometheus-secure.rule=Host(`dash.mrdev023.fr`) && PathPrefix(`/prometheus`)"
|
||||
- "traefik.http.routers.prometheus-secure.middlewares=tls-chain,prometheus-stripprefix,prometheus-auth"
|
||||
- "traefik.http.routers.prometheus-secure.tls=true"
|
||||
- "traefik.http.routers.prometheus-secure.tls.certresolver=sslResolver"
|
||||
- "traefik.http.routers.prometheus-secure.service=prometheus"
|
||||
- "traefik.http.services.prometheus.loadbalancer.server.port=9090"
|
||||
- "traefik.docker.network=proxy"
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana:latest
|
||||
restart: unless-stopped
|
||||
container_name: grafana
|
||||
volumes:
|
||||
- grafana:/var/lib/grafana
|
||||
- ./grafana/provisioning:/etc/grafana/provisioning
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
env_file:
|
||||
- grafana.env
|
||||
depends_on:
|
||||
- prometheus
|
||||
networks:
|
||||
- proxy
|
||||
- internal
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.middlewares.grafana-auth.basicauth.users=mrdev023:$$2y$$05$$t51tXUW6zO9dndSK1JEFS.utJ3th/RYVSgDlouOZhUigjbkTX1zQC$$"
|
||||
- "traefik.http.middlewares.grafana-stripprefix.stripprefix.prefixes=/grafana"
|
||||
- "traefik.http.routers.grafana-secure.entrypoints=https"
|
||||
- "traefik.http.routers.grafana-secure.rule=Host(`dash.mrdev023.fr`) && PathPrefix(`/grafana`)"
|
||||
- "traefik.http.routers.grafana-secure.middlewares=tls-chain,grafana-stripprefix,grafana-auth"
|
||||
- "traefik.http.routers.grafana-secure.tls=true"
|
||||
- "traefik.http.routers.grafana-secure.tls.certresolver=http"
|
||||
- "traefik.http.routers.grafana-secure.service=grafana"
|
||||
- "traefik.http.services.grafana.loadbalancer.server.port=3000"
|
||||
- "traefik.docker.network=proxy"
|
||||
http_provider:
|
||||
image: httpd:latest
|
||||
restart: unless-stopped
|
||||
container_name: http_provider
|
||||
networks:
|
||||
- internal
|
||||
- providers
|
||||
volumes:
|
||||
- ./config/dynamic_conf.yaml:/usr/local/apache2/htdocs/dynamic_conf.yaml
|
||||
|
||||
networks:
|
||||
providers:
|
||||
internal:
|
||||
proxy:
|
||||
external: true
|
||||
|
||||
volumes:
|
||||
prometheus:
|
||||
grafana:
|
||||
6
roles/traefik/files/grafana.env
Normal file
6
roles/traefik/files/grafana.env
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
GF_AUTH_ANONYMOUS_ENABLED=true
|
||||
GF_AUTH_BASIC_ENABLED=false
|
||||
GF_AUTH_PROXY_ENABLED=false
|
||||
GF_USERS_ALLOW_SIGN_UP=false
|
||||
GF_INSTALL_PLUGINS=grafana-piechart-panel
|
||||
GF_SERVER_ROOT_URL=%(protocol)s://%(domain)s:%(http_port)s/grafana
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
apiVersion: 1
|
||||
|
||||
providers:
|
||||
# <string> provider name
|
||||
- name: 'default'
|
||||
# <int> org id. will default to orgId 1 if not specified
|
||||
orgId: 1
|
||||
# <string, required> name of the dashboard folder. Required
|
||||
folder: ''
|
||||
# <string> folder UID. will be automatically generated if not specified
|
||||
folderUid: ''
|
||||
# <string, required> provider type. Required
|
||||
type: file
|
||||
# <bool> disable dashboard deletion
|
||||
disableDeletion: false
|
||||
# <bool> enable dashboard editing
|
||||
editable: true
|
||||
# <int> how often Grafana will scan for changed dashboards
|
||||
updateIntervalSeconds: 10
|
||||
options:
|
||||
path: /etc/grafana/provisioning/dashboards
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,50 @@
|
|||
# config file version
|
||||
apiVersion: 1
|
||||
|
||||
# list of datasources that should be deleted from the database
|
||||
deleteDatasources:
|
||||
- name: Prometheus
|
||||
orgId: 1
|
||||
|
||||
# list of datasources to insert/update depending
|
||||
# whats available in the database
|
||||
datasources:
|
||||
# <string, required> name of the datasource. Required
|
||||
- name: Prometheus
|
||||
# <string, required> datasource type. Required
|
||||
type: prometheus
|
||||
# <string, required> access mode. direct or proxy. Required
|
||||
access: proxy
|
||||
# <int> org id. will default to orgId 1 if not specified
|
||||
orgId: 1
|
||||
# <string> url
|
||||
url: http://prometheus:9090
|
||||
# <string> database password, if used
|
||||
password:
|
||||
# <string> database user, if used
|
||||
user:
|
||||
# <string> database name, if used
|
||||
database:
|
||||
# <bool> enable/disable basic auth
|
||||
basicAuth: false
|
||||
# <string> basic auth username
|
||||
basicAuthUser:
|
||||
# <string> basic auth password
|
||||
basicAuthPassword:
|
||||
# <bool> enable/disable with credentials headers
|
||||
withCredentials:
|
||||
# <bool> mark as default datasource. Max one per org
|
||||
isDefault: true
|
||||
# <map> fields that will be converted to json and stored in json_data
|
||||
jsonData:
|
||||
graphiteVersion: "1.1"
|
||||
tlsAuth: false
|
||||
tlsAuthWithCACert: false
|
||||
# <string> json object of data that will be encrypted.
|
||||
secureJsonData:
|
||||
tlsCACert: "..."
|
||||
tlsClientCert: "..."
|
||||
tlsClientKey: "..."
|
||||
version: 1
|
||||
# <bool> allow users to edit datasources from the UI.
|
||||
editable: true
|
||||
7
roles/traefik/tasks/base.yml
Normal file
7
roles/traefik/tasks/base.yml
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
---
|
||||
|
||||
- name: Copy traefik conf
|
||||
ansible.builtin.copy:
|
||||
backup: true
|
||||
src: .
|
||||
dest: traefik/
|
||||
4
roles/traefik/tasks/main.yml
Normal file
4
roles/traefik/tasks/main.yml
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
---
|
||||
|
||||
- ansible.builtin.import_tasks: base.yml
|
||||
name: base
|
||||
Loading…
Add table
Add a link
Reference in a new issue