stack/traefik/dynamic/services.yml

{{- $domain := env "DOMAIN" | default "homelab.fhirworx.io" -}}
{{- $reef := dict
  "dashboard"          (dict "port" "80"    "theme" true  "extra_hosts" (list $domain) "mw" "secure-headers")
  "docs"               (dict "port" "80"    "theme" true  "mw" "secure-headers")
  "gitea"              (dict "port" "3000"  "theme" true  "mw" "secure-headers")
  "woodpecker-server"  (dict "port" "8000"  "theme" true  "subdomain" "ci" "mw" "local-only,secure-headers")
  "notebooks"          (dict "port" "2718"  "theme" true  "mw" "local-only,secure-headers")
  "zotero"             (dict "port" "8080"  "theme" true  "mw" "secure-headers")
  "webdav"             (dict "port" "8080"  "theme" false "mw" "secure-headers")
  "api"                (dict "port" "8000"  "theme" false "mw" "secure-headers")
  "nessie"             (dict "port" "19120" "theme" false "mw" "local-only,infra-headers")
  "trino"              (dict "port" "8080"  "theme" true  "mw" "local-only,infra-headers")
  "polaris"            (dict "port" "8181"  "theme" false "mw" "local-only,infra-headers")
  "grafana"            (dict "port" "3000"  "theme" true  "mw" "local-only,secure-headers")
  "prometheus"         (dict "port" "9090"  "theme" true  "mw" "local-only,infra-headers")
  "jaeger"             (dict "port" "16686" "theme" true  "mw" "local-only,infra-headers")
  "loki"               (dict "port" "3100"  "theme" false "mw" "local-only,infra-headers")
-}}
{{- $multi := dict
  "rustfs-api"         (dict "container" "rustfs" "port" "9000" "subdomain" "s3"        "theme" false "mw" "local-only,infra-headers")
  "rustfs-console"     (dict "container" "rustfs" "port" "9001" "subdomain" "s3console" "theme" true  "mw" "local-only,infra-headers")
-}}
http:
  middlewares:
    secure-headers:
      headers:
        frameDeny: true
        browserXssFilter: true
        contentTypeNosniff: true
    local-only:
      ipAllowList:
        sourceRange:
          - "127.0.0.1/32"
          - "10.0.0.0/8"
          - "172.16.0.0/12"
          - "192.168.0.0/16"
    infra-headers:
      headers:
        frameDeny: true
        browserXssFilter: true
        contentTypeNosniff: true
        referrerPolicy: "strict-origin-when-cross-origin"
        customResponseHeaders:
          X-Robots-Tag: "noindex, nofollow"
    inject-loch:
      plugin:
        rewrite-body:
          lastModified: true
          rewrites:
            - regex: "</head>"
              replacement: '<link rel="icon" type="image/png" sizes="32x32" href="http://{{ $domain }}/fav32.png"><link rel="stylesheet" type="text/css" href="http://{{ $domain }}/loch.css"></head>'
  routers:
    {{- range $name, $svc := $reef }}
    {{ $name }}:
      rule: "Host(`{{ get $svc "subdomain" | default $name }}.{{ $domain }}`){{ range get $svc "extra_hosts" | default list }} || Host(`{{ . }}`){{ end }}"
      service: {{ $name }}
      entryPoints:
        - web
      {{- $mwList := list -}}
      {{- if get $svc "theme" }}{{ $mwList = append $mwList "inject-loch" }}{{ end -}}
      {{- $extra := get $svc "mw" | default "" -}}
      {{- if ne $extra "" }}{{ range splitList "," $extra }}{{ $mwList = append $mwList (trim .) }}{{ end }}{{ end -}}
      {{- if $mwList }}
      middlewares:
        {{- range $mwList }}
        - {{ . }}
        {{- end }}
      {{- end }}
    {{ $name }}-tls:
      rule: "Host(`{{ get $svc "subdomain" | default $name }}.{{ $domain }}`){{ range get $svc "extra_hosts" | default list }} || Host(`{{ . }}`){{ end }}"
      service: {{ $name }}
      entryPoints:
        - websecure
      tls: {}
      {{- if $mwList }}
      middlewares:
        {{- range $mwList }}
        - {{ . }}
        {{- end }}
      {{- end }}
    {{- end }}
    {{- range $name, $svc := $multi }}
    {{ $name }}:
      rule: "Host(`{{ get $svc "subdomain" }}.{{ $domain }}`)"
      service: {{ $name }}
      entryPoints:
        - web
      {{- $mwList := list -}}
      {{- if get $svc "theme" }}{{ $mwList = append $mwList "inject-loch" }}{{ end -}}
      {{- $extra := get $svc "mw" | default "" -}}
      {{- if ne $extra "" }}{{ range splitList "," $extra }}{{ $mwList = append $mwList (trim .) }}{{ end }}{{ end -}}
      {{- if $mwList }}
      middlewares:
        {{- range $mwList }}
        - {{ . }}
        {{- end }}
      {{- end }}
    {{ $name }}-tls:
      rule: "Host(`{{ get $svc "subdomain" }}.{{ $domain }}`)"
      service: {{ $name }}
      entryPoints:
        - websecure
      tls: {}
      {{- if $mwList }}
      middlewares:
        {{- range $mwList }}
        - {{ . }}
        {{- end }}
      {{- end }}
    {{- end }}
    traefik-dashboard:
      rule: "Host(`traefik.{{ $domain }}`)"
      service: api@internal
      entryPoints:
        - web
      middlewares:
        - inject-loch
        - local-only
        - infra-headers
    traefik-dashboard-tls:
      rule: "Host(`traefik.{{ $domain }}`)"
      service: api@internal
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - inject-loch
        - local-only
        - infra-headers
  services:
    {{- range $name, $svc := $reef }}
    {{ $name }}:
      loadBalancer:
        servers:
          - url: "http://{{ $name }}:{{ get $svc "port" }}"
    {{- end }}
    {{- range $name, $svc := $multi }}
    {{ $name }}:
      loadBalancer:
        servers:
          - url: "http://{{ get $svc "container" }}:{{ get $svc "port" }}"
    {{- end }}