sorbandClaude Opus 4.8
8d089e238a
TLS-ALPN-01 needs 80/443 open to the whole internet for renewal, which fails silently behind the user-IP firewall. Switch the letsencrypt resolver to DNS-01 with the IONOS provider (token from host .env, git-ignored) and public resolvers for the propagation check. acme.json is preserved; existing certs renew via DNS-01 before 2026-10-28. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
102 lines
3.9 KiB
YAML
102 lines
3.9 KiB
YAML
# Stack "thread-net-git" (CFGMON): Traefik + Gitea + cAdvisor.
|
|
# Abgeloest aus Portainer (Stack-ID 8) am 2026-07-30.
|
|
#
|
|
# WICHTIG: Der Compose-Projektname MUSS "thread-net-git" bleiben (siehe
|
|
# "name:" unten), sonst findet Compose das bestehende Gitea-Datenvolumen
|
|
# nicht und die Traefik/Portainer-Historie bricht. Deploy immer aus diesem
|
|
# Verzeichnis: docker compose up -d
|
|
name: thread-net-git
|
|
|
|
services:
|
|
reverse-proxy: #lol
|
|
image: traefik:v3.7.9
|
|
container_name: traefik
|
|
restart: always
|
|
command:
|
|
- "--api.dashboard=true"
|
|
- "--api.insecure=false"
|
|
- "--log.level=INFO"
|
|
- "--providers.docker=true"
|
|
- "--providers.docker.exposedbydefault=false"
|
|
- "--entrypoints.web.address=:80"
|
|
- "--entrypoints.websecure.address=:443"
|
|
# DNS-01 statt TLS-ALPN-01 (CFGMON-01): keine oeffentlich offenen 80/443
|
|
# fuer die Validierung noetig; ermoeglicht Wildcards. Token via .env (Host).
|
|
- "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
|
|
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=ionos"
|
|
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53"
|
|
- "--certificatesresolvers.letsencrypt.acme.email=gamemaster@axion1337.de"
|
|
- "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
|
|
- "--entrypoints.web.http.redirections.entryPoint.to=websecure"
|
|
- "--entrypoints.web.http.redirections.entryPoint.scheme=https"
|
|
- "--metrics.prometheus=true"
|
|
- "--metrics.prometheus.addEntryPointsLabels=true"
|
|
- "--metrics.prometheus.addServicesLabels=true"
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
environment:
|
|
# IONOS Developer DNS-API-Key im Format <prefix>.<secret> — liegt in
|
|
# /opt/thread-net-git/.env (git-ignoriert), NICHT im Repo.
|
|
- "IONOS_API_KEY=${IONOS_API_KEY:?IONOS_API_KEY fehlt in .env}"
|
|
volumes:
|
|
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
|
# Named Volume statt frueherem Portainer-Bind ./letsencrypt: enthaelt
|
|
# acme.json (LE-Account + Zertifikate rohana/selendis). Verlust erzwingt
|
|
# eine Neuausstellung, die an der Firewall scheitert (80/443 nur fuer
|
|
# die User-IP offen) -- Volume niemals loeschen. Befuellung beim
|
|
# Erst-Deploy: siehe README.
|
|
- letsencrypt:/letsencrypt
|
|
networks:
|
|
- traefik
|
|
|
|
gitea:
|
|
# Gepinnt statt :latest (Ist-Stand der Migration). NIEMALS auf eine
|
|
# aeltere Version wechseln -- die SQLite-DB kennt kein Downgrade.
|
|
image: gitea/gitea:1.27.0
|
|
restart: always
|
|
environment:
|
|
- USER_UID=1000
|
|
- USER_GID=1000
|
|
- GITEA__server__ROOT_URL=https://rohana.axion1337.de
|
|
- GITEA__service__DISABLE_REGISTRATION=true
|
|
volumes:
|
|
- gitea-data:/data
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.gitea.rule=Host(`rohana.axion1337.de`)
|
|
- traefik.http.routers.gitea.entrypoints=websecure
|
|
- traefik.http.routers.gitea.tls.certresolver=letsencrypt
|
|
- traefik.http.services.gitea.loadbalancer.server.port=3000
|
|
networks:
|
|
- traefik
|
|
|
|
cadvisor:
|
|
# Stand vorher NICHT in der Portainer-Compose (war manuell in den Stack
|
|
# gehaengt). Prometheus (monitoring-Stack) scrapt "cadvisor:8080" ueber
|
|
# das gemeinsame traefik-Netz -- container_name daher fest.
|
|
image: gcr.io/cadvisor/cadvisor:v0.49.1
|
|
container_name: cadvisor
|
|
restart: always
|
|
volumes:
|
|
- /:/rootfs:ro
|
|
- /var/run:/var/run:ro
|
|
- /sys:/sys:ro
|
|
- /var/lib/docker/:/var/lib/docker:ro
|
|
networks:
|
|
- traefik
|
|
|
|
networks:
|
|
traefik:
|
|
external: true
|
|
|
|
volumes:
|
|
# Produktivdaten (Repos, SQLite-DB, LFS, Packages, SSH-Hostkeys).
|
|
# external, damit Compose das Volume weder anlegen noch loeschen kann:
|
|
# ein Deploy mit falschem Projektnamen schlaegt laut fehl, statt leise
|
|
# ein leeres Volume zu erzeugen.
|
|
gitea-data:
|
|
external: true
|
|
name: thread-net-git_gitea-data
|
|
letsencrypt:
|