86 lines
3.9 KiB
YAML
86 lines
3.9 KiB
YAML
# External Services Router
|
|
# For services running on other VMs (TrueNAS, etc.)
|
|
|
|
version: "3.8"
|
|
|
|
networks:
|
|
services:
|
|
external: true # Connect to main LemonSec network
|
|
|
|
services:
|
|
# ============================================================================
|
|
# EXTERNAL NEXTCLOUD (on TrueNAS Scale)
|
|
# ============================================================================
|
|
# This is just a "dummy" container that tells Traefik how to route to TrueNAS
|
|
# No actual container runs - it's just configuration
|
|
|
|
nextcloud-router:
|
|
image: alpine:latest
|
|
container_name: nextcloud-router
|
|
restart: "no"
|
|
command: "echo 'This is a routing configuration container'"
|
|
networks:
|
|
- services
|
|
labels:
|
|
- "traefik.enable=true"
|
|
|
|
# EXTERNAL ACCESS - Public URL for family
|
|
- "traefik.http.routers.nextcloud.rule=Host(`cloud.lemonlink.eu`)"
|
|
- "traefik.http.routers.nextcloud.entrypoints=websecure"
|
|
- "traefik.http.routers.nextcloud.tls.certresolver=letsencrypt"
|
|
|
|
# Service points to TrueNAS Nextcloud
|
|
# Replace TRUENAS_IP with your TrueNAS VM IP
|
|
- "traefik.http.services.nextcloud.loadbalancer.server.url=http://${TRUENAS_IP}:PORT"
|
|
# If TrueNAS Nextcloud uses HTTPS internally:
|
|
# - "traefik.http.services.nextcloud.loadbalancer.server.url=https://${TRUENAS_IP}:PORT"
|
|
# - "traefik.http.services.nextcloud.loadbalancer.server.scheme=https"
|
|
# - "traefik.http.services.nextcloud.loadbalancer.serversTransport=insecureTransport@file"
|
|
|
|
# AUTHENTICATION OPTIONS (choose one):
|
|
|
|
# Option A: No Authelia (Nextcloud handles auth itself)
|
|
# Good for: Family already has Nextcloud accounts
|
|
# - "traefik.http.routers.nextcloud.middlewares=security-headers@file,rate-limit@file"
|
|
|
|
# Option B: Authelia one_factor (password only, no 2FA)
|
|
# Good for: Family-friendly, still protected from internet
|
|
- "traefik.http.routers.nextcloud.middlewares=authelia@docker,security-headers@file,rate-limit@file"
|
|
|
|
# Option C: Authelia two_factor (password + 2FA)
|
|
# Good for: Maximum security
|
|
# - "traefik.http.routers.nextcloud.middlewares=authelia@docker,security-headers@file,rate-limit@file"
|
|
|
|
# WebDAV/CalDAV support (important for Nextcloud apps)
|
|
- "traefik.http.routers.nextcloud-dav.rule=Host(`cloud.lemonlink.eu`) && PathPrefix(`/.well-known/carddav`,`/.well-known/caldav`,`/remote.php`)"
|
|
- "traefik.http.routers.nextcloud-dav.entrypoints=websecure"
|
|
- "traefik.http.routers.nextcloud-dav.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.nextcloud-dav.service=nextcloud"
|
|
- "traefik.http.routers.nextcloud-dav.middlewares=authelia@docker"
|
|
|
|
# Upload size (important for Nextcloud)
|
|
- "traefik.http.middlewares.nextcloud-headers.headers.customRequestHeaders.X-Forwarded-Proto=https"
|
|
- "traefik.http.middlewares.nextcloud-headers.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN"
|
|
- "traefik.http.routers.nextcloud.middlewares=authelia@docker,security-headers@file,rate-limit@file,nextcloud-headers"
|
|
|
|
# ============================================================================
|
|
# OTHER EXTERNAL SERVICES
|
|
# ============================================================================
|
|
|
|
# TrueNAS Web UI (internal only)
|
|
truenas-router:
|
|
image: alpine:latest
|
|
container_name: truenas-router
|
|
restart: "no"
|
|
command: "echo 'TrueNAS routing'"
|
|
networks:
|
|
- services
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.truenas.rule=Host(`nas.local.lemonlink.eu`)"
|
|
- "traefik.http.routers.truenas.entrypoints=internal"
|
|
- "traefik.http.routers.truenas.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.truenas.middlewares=authelia@docker"
|
|
- "traefik.http.services.truenas.loadbalancer.server.url=https://${TRUENAS_IP}:443"
|
|
- "traefik.http.services.truenas.loadbalancer.serversTransport=insecureTransport@file"
|