From 900e46c667fe8a1d9aba58a713caf382240d58d8 Mon Sep 17 00:00:00 2001 From: dtoro Date: Wed, 12 Aug 2026 18:26:12 +0200 Subject: [PATCH] =?UTF-8?q?add=20VPS=20Traefik=20dynamic=20config=20?= =?UTF-8?q?=E2=80=94=20hubris.network=20fallback=20routes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All services use certResolver: letsencrypt (TLS-ALPN-01). Patterns: HTTP backends: blog, artifacto, trmnl, matrix, house, sso, media, paperless HTTPS+SNI: mcp, oikos (via caddy-hubris serversTransport) HTTPS+insecure: proxmox (via proxmox serversTransport) Static config: --serverstransport.insecureskipverify=true Config lives at /opt/traefik-dynamic.yaml on VPS. Auto-deploy: webhook receiver on :8082 -> git pull + docker kill -s HUP netbird-traefik --- hosts/vps/traefik-dynamic.yaml | 324 +++++++++++++++++++++++++++++++++ 1 file changed, 324 insertions(+) create mode 100644 hosts/vps/traefik-dynamic.yaml diff --git a/hosts/vps/traefik-dynamic.yaml b/hosts/vps/traefik-dynamic.yaml new file mode 100644 index 0000000..537a2f7 --- /dev/null +++ b/hosts/vps/traefik-dynamic.yaml @@ -0,0 +1,324 @@ +tcp: + serversTransports: + pp-v2: + proxyProtocol: + version: 2 + +tls: + certificates: + - certFile: /letsencrypt/fullchain.crt + keyFile: /letsencrypt/privkey.key + - certFile: /letsencrypt/blog.fullchain.crt + keyFile: /letsencrypt/blog.privkey.key + - certFile: /letsencrypt/trmnl.fullchain.crt + keyFile: /letsencrypt/trmnl.privkey.key + - certFile: /letsencrypt/sso.fullchain.crt + keyFile: /letsencrypt/sso.privkey.key + - certFile: /letsencrypt/media.fullchain.crt + keyFile: /letsencrypt/media.privkey.key + - certFile: /letsencrypt/paperless.fullchain.crt + keyFile: /letsencrypt/paperless.privkey.key + +http: + serversTransports: + caddy-hubris: + serverName: mcp.hubris.network + proxmox: + serverName: proxmox.hubris.network + insecureSkipVerify: true + + routers: + artifacto-public: + rule: 'Host(`artifacto.hubris.network`) && (PathPrefix(`/p/`) || PathPrefix(`/static/`) || Path(`/healthz`))' + entryPoints: + - websecure + priority: 10 + tls: + certResolver: letsencrypt + middlewares: + - artifacto-strip-sso + - artifacto-ratelimit + service: artifacto-public + blog-public: + rule: 'Host(`blog.hubris.network`)' + entryPoints: + - websecure + priority: 10 + tls: + certResolver: letsencrypt + middlewares: + - blog-ratelimit + service: blog-public + trmnl-public: + rule: 'Host(`trmnl.hubris.network`)' + entryPoints: + - websecure + priority: 10 + tls: + certResolver: letsencrypt + middlewares: + - trmnl-ratelimit + service: trmnl-public + matrix-public: + rule: 'Host(`matrix.hubris.network`) && !PathPrefix(`/.well-known/matrix/`)' + entryPoints: + - websecure + priority: 10 + tls: + certResolver: letsencrypt + middlewares: + - matrix-ratelimit + service: matrix-public + matrix-wellknown: + rule: 'Host(`matrix.hubris.network`) && (PathPrefix(`/.well-known/matrix/`) || PathPrefix(`/.well-known/acme-challenge/`))' + entryPoints: + - websecure + priority: 20 + tls: + certResolver: letsencrypt + service: matrix-wellknown-svc + house-public: + rule: 'Host(`house.hubris.network`)' + entryPoints: + - websecure + priority: 10 + tls: + certResolver: letsencrypt + middlewares: + - house-ratelimit + service: house-public + sso-public: + rule: 'Host(`sso.hubris.network`)' + entryPoints: + - websecure + priority: 10 + tls: + certResolver: letsencrypt + middlewares: + - sso-ratelimit + service: sso-public + media-public: + rule: 'Host(`media.hubris.network`)' + entryPoints: + - websecure + priority: 10 + tls: + certResolver: letsencrypt + middlewares: + - media-ratelimit + service: media-public + paperless-api-public: + rule: 'Host(`paperless.hubris.network`) && PathPrefix(`/api/`)' + entryPoints: + - websecure + priority: 20 + tls: + certResolver: letsencrypt + middlewares: + - paperless-ratelimit + service: paperless-public + paperless-public: + rule: 'Host(`paperless.hubris.network`)' + entryPoints: + - websecure + priority: 10 + tls: + certResolver: letsencrypt + middlewares: + - authentik-forwardauth + - paperless-ratelimit + service: paperless-public + git-public: + rule: 'Host(`git.hubris.network`)' + entryPoints: + - websecure + priority: 10 + tls: + certResolver: letsencrypt + middlewares: + - git-ratelimit + service: git-public + mcp-public: + rule: 'Host(`mcp.hubris.network`)' + entryPoints: + - websecure + priority: 10 + tls: + certResolver: letsencrypt + middlewares: + - mcp-ratelimit + service: mcp-public + oikos-public: + rule: 'Host(`oikos.hubris.network`)' + entryPoints: + - websecure + priority: 10 + tls: + certResolver: letsencrypt + middlewares: + - oikos-ratelimit + service: oikos-public + proxmox-public: + rule: 'Host(`proxmox.hubris.network`)' + entryPoints: + - websecure + priority: 10 + tls: + certResolver: letsencrypt + middlewares: + - proxmox-ratelimit + service: proxmox-public + + middlewares: + admin-allowlist: + ipAllowList: + sourceRange: + - "5.61.168.0/24" + artifacto-strip-sso: + headers: + customRequestHeaders: + X-Artifacto-Gateway: "" + X-Authentik-Username: "" + X-Authentik-Groups: "" + X-Authentik-Email: "" + X-Authentik-Name: "" + X-Authentik-Uid: "" + X-Authentik-Jwt: "" + X-Authentik-Meta-Jwks: "" + X-Authentik-Meta-Outpost: "" + X-Authentik-Meta-Provider: "" + X-Authentik-Meta-App: "" + X-Authentik-Meta-Version: "" + artifacto-ratelimit: + rateLimit: + average: 50 + period: 1s + burst: 100 + blog-ratelimit: + rateLimit: + average: 100 + period: 1s + burst: 200 + trmnl-ratelimit: + rateLimit: + average: 20 + period: 1s + burst: 40 + matrix-ratelimit: + rateLimit: + average: 30 + period: 1s + burst: 60 + house-ratelimit: + rateLimit: + average: 30 + period: 1s + burst: 60 + sso-ratelimit: + rateLimit: + average: 30 + period: 1s + burst: 60 + media-ratelimit: + rateLimit: + average: 30 + period: 1s + burst: 60 + paperless-ratelimit: + rateLimit: + average: 20 + period: 1s + burst: 40 + authentik-forwardauth: + forwardAuth: + address: "http://192.168.8.6:9000/outpost.goauthentik.io/auth/traefik" + trustForwardHeader: true + authResponseHeaders: + - X-authentik-username + - X-authentik-groups + - X-authentik-email + - X-authentik-name + - X-authentik-uid + - X-authentik-jwt + - X-authentik-meta-jwks + - X-authentik-meta-outpost + - X-authentik-meta-provider + - X-authentik-meta-app + - X-authentik-meta-version + git-ratelimit: + rateLimit: + average: 30 + period: 1s + burst: 60 + mcp-ratelimit: + rateLimit: + average: 30 + period: 1s + burst: 60 + oikos-ratelimit: + rateLimit: + average: 30 + period: 1s + burst: 60 + proxmox-ratelimit: + rateLimit: + average: 20 + period: 1s + burst: 40 + + services: + artifacto-public: + loadBalancer: + servers: + - url: 'http://192.168.8.205:3100' + blog-public: + loadBalancer: + servers: + - url: 'http://192.168.8.205:8080' + trmnl-public: + loadBalancer: + servers: + - url: 'http://192.168.8.211:9851' + matrix-public: + loadBalancer: + servers: + - url: 'http://192.168.8.242:8008' + matrix-wellknown-svc: + loadBalancer: + servers: + - url: 'http://matrix-wellknown:80' + house-public: + loadBalancer: + servers: + - url: 'http://192.168.8.244:3000' + sso-public: + loadBalancer: + servers: + - url: 'http://192.168.8.6:9000' + media-public: + loadBalancer: + servers: + - url: 'http://192.168.8.246:8096' + paperless-public: + loadBalancer: + servers: + - url: 'http://192.168.8.130:8000' + git-public: + loadBalancer: + servers: + - url: 'http://192.168.8.121:3000' + mcp-public: + loadBalancer: + serversTransport: caddy-hubris + servers: + - url: 'https://192.168.8.175:443' + oikos-public: + loadBalancer: + serversTransport: caddy-hubris + servers: + - url: 'https://192.168.8.175:443' + proxmox-public: + loadBalancer: + serversTransport: proxmox + servers: + - url: 'https://192.168.8.77:8006'