traefik: feat: Add custom error pages

freshrss/.env.example

@@ -0,0 +1,11 @@
+# set IS_ARM to :arm for ARM version
+IS_ARM=
+
+FRESHRSS_DOMAIN=freshrss.ykz.app
+CRON_MIN=2,32
+
+# Variables below are only used at the very first run
+ADMIN_USERNAME=admin_username_goes_here
+ADMIN_EMAIL=admin_email_goes_here
+ADMIN_PASSWORD=admin_password_goes_here
+ADMIN_API_PASSWORD=admin_api_password_goes_here

freshrss/docker-compose.yml

@@ -0,0 +1,48 @@
+version: "3.9"
+
+networks:
+  public:
+    external: true
+
+services:
+  freshrss:
+    image: freshrss/freshrss${IS_ARM}
+    container_name: freshrss
+    restart: always
+    logging:
+      options:
+        max-size: 10m
+    volumes:
+      - "./freshrss-data:/var/www/FreshRSS/data"
+      - "./freshrss-extensions-data:/var/www/FreshRSS/extensions"
+    environment:
+      TZ: Asia/Singapore
+      CRON_MIN: '${CRON_MIN}'
+      FRESHRSS_INSTALL: |-
+        --api_enabled
+        --default_user ${ADMIN_USERNAME}
+        --language en
+      FRESHRSS_USER: |-
+        --api_password ${ADMIN_API_PASSWORD}
+        --email ${ADMIN_EMAIL}
+        --language en
+        --password ${ADMIN_PASSWORD}
+        --user ${ADMIN_USERNAME}
+    # ports:
+    #   - "80:80"
+    networks:
+      - public
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.freshrss.rule=Host(`${FRESHRSS_DOMAIN}`)"
+      - "traefik.http.routers.freshrss.service=freshrss-service"
+      - "traefik.http.services.freshrss-service.loadbalancer.server.port=80"
+      - "traefik.http.routers.freshrss.tls=true"
+      - "traefik.http.routers.freshrss.tls.certresolver=le"
+      - traefik.http.middlewares.freshrssM1.compress=true
+      - traefik.http.middlewares.freshrssM2.headers.browserXssFilter=true
+      - traefik.http.middlewares.freshrssM2.headers.forceSTSHeader=true
+      - traefik.http.middlewares.freshrssM2.headers.frameDeny=true
+      - traefik.http.middlewares.freshrssM2.headers.referrerPolicy=no-referrer-when-downgrade
+      - traefik.http.middlewares.freshrssM2.headers.stsSeconds=31536000
+      - traefik.http.routers.freshrss.middlewares=freshrssM1,freshrssM2

homeassistant/.env.example

@@ -0,0 +1 @@
+HOMEASSISTANT_DOMAIN=domain_goes_here

homeassistant/docker-compose.yml

@@ -0,0 +1,11 @@
+version: "3.9"
+
+services:
+  homeassistant:
+    image: "ghcr.io/home-assistant/home-assistant:stable"
+    container_name: homeassistant
+    restart: always
+    volumes:
+      - "./homeassistant-config-data:/config"
+      - "/etc/localtime:/etc/localtime:ro"
+    network_mode: host

nextcloud/.env.example

@@ -0,0 +1,4 @@
+NEXTCLOUD_DOMAIN=nextcloud_domain_goes_here
+DB_ROOT_PASSWORD=mariadb_root_password_goes_here
+NEXTCLOUD_DB_PASSWORD=mariadb_nextcloud_user_password_goes_here
+COLLABORA_DOMAIN=collabora_domain_goes_here

nextcloud/docker-compose.yml

@@ -0,0 +1,76 @@
+version: "3.9"
+
+networks:
+  public:
+    external: true
+
+services:
+  nextcloud:
+    image: lscr.io/linuxserver/nextcloud:latest
+    container_name: nextcloud
+    restart: always
+    volumes:
+      - "./nextcloud-config-data:/config"
+      - "./nextcloud-data:/data"
+    environment:
+      - "PUID=1000"
+      - "PGID=1000"
+      - "TZ=Asia/Singapore"
+    # ports:
+    #   - "443:443"
+    networks:
+      - public
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.nextcloud.rule=Host(`${NEXTCLOUD_DOMAIN}`)"
+      - "traefik.http.routers.nextcloud.service=nextcloud-service"
+      - "traefik.http.services.nextcloud-service.loadbalancer.server.port=443"
+      - "traefik.http.services.nextcloud-service.loadbalancer.server.scheme=https"
+      - "traefik.http.routers.nextcloud.tls=true"
+      - "traefik.http.routers.nextcloud.tls.certresolver=le"
+      # Nextcloud DAV services discovery
+      - "traefik.http.middlewares.nextcloud-redirectregex.redirectregex.regex=https://(.*)/.well-known/(card|cal)dav"
+      - "traefik.http.middlewares.nextcloud-redirectregex.redirectregex.replacement=https://$${1}/remote.php/dav/"
+      - "traefik.http.middlewares.nextcloud-redirectregex.redirectregex.permanent=true"
+      # HSTS
+      - "traefik.http.middlewares.nextcloud-headers.headers.stsSeconds=15552000"
+      # Apply middlewares
+      - "traefik.http.routers.nextcloud.middlewares=nextcloud-redirectregex,nextcloud-headers"
+
+  mariadb:
+    image: lscr.io/linuxserver/mariadb:latest
+    container_name: mariadb
+    restart: always
+    volumes:
+      - "./mariadb-data:/config"
+    environment:
+      - "PUID=1000"
+      - "PGID=1000"
+      - "MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}"
+      - "TZ=Asia/Singapore"
+      - "MYSQL_DATABASE=nextcloud_db"
+      - "MYSQL_USER=nextcloud"
+      - "MYSQL_PASSWORD=${NEXTCLOUD_DB_PASSWORD}"
+    # ports:
+    #   - "3306:3306"
+    networks:
+      - public
+
+  collabora:
+    image: collabora/code
+    container_name: collabora
+    restart: always
+    environment:
+      - "domain=${NEXTCLOUD_DOMAIN}"
+      - "extra_params=--o:ssl.enable=false --o:ssl.termination=true"
+    # ports:
+    #   - "9980:9980"
+    networks:
+      - public
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.collabora.rule=Host(`${COLLABORA_DOMAIN}`)"
+      - "traefik.http.routers.collabora.service=collabora-service"
+      - "traefik.http.services.collabora-service.loadbalancer.server.port=9980"
+      - "traefik.http.routers.collabora.tls=true"
+      - "traefik.http.routers.collabora.tls.certresolver=le"

pihole/docker-compose.yml

@@ -1,6 +1,8 @@
 version: "3.9"
 
 networks:
+  public:
+    external: true
   dns_net:
     name: dns_net
     driver: bridge
@@ -16,9 +18,10 @@ services:
     ports:
       - "53:53/tcp"
       - "53:53/udp"
-      - "8180:80/tcp"
+      # - "8180:80/tcp"
     hostname: pihole
     networks:
+      public: {}
       dns_net:
         ipv4_address: 172.20.0.10
     environment:
@@ -30,6 +33,18 @@ services:
     volumes:
       - "./pihole-data/:/etc/pihole/"
       - "./dnsmasq.d-data/:/etc/dnsmasq.d/"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.pihole.rule=Host(`${PIHOLE_DOMAIN}`)"
+      - "traefik.http.routers.pihole.service=pihole-service"
+      - "traefik.http.services.pihole-service.loadbalancer.server.port=80"
+      - "traefik.http.routers.pihole.tls=true"
+      - "traefik.http.routers.pihole.tls.certresolver=le"
+      # - "traefik.http.middlewares.pihole-admin.addprefix.prefix=/admin"
+      - "traefik.http.middlewares.pihole-redirect.redirectregex.regex=^https://pihole.ykz.app/$$"
+      - "traefik.http.middlewares.pihole-redirect.redirectregex.replacement=https://pihole.ykz.app/admin"
+      - "traefik.http.middlewares.pihole-redirect.redirectregex.permanent=true"
+      - "traefik.http.routers.pihole.middlewares=pihole-redirect"
 
   unbound:
     image: mvance/unbound${IS_RPI}:latest

traefik/.gitignore

@@ -1 +1,2 @@
 acme.json
+certs/

traefik/docker-compose.yml

@@ -25,7 +25,8 @@ services:
       - "443:443"
       # - "8080:8080"
     networks:
-      - public
+      public:
+        ipv4_address: 172.22.0.254
     command:
       - "--log.level=DEBUG"
       - "--api.insecure=true"
@@ -44,6 +45,7 @@ services:
       - "--certificatesresolvers.le.acme.dnschallenge=true"
       - "--certificatesresolvers.le.acme.dnschallenge.provider=cloudflare"
       - "--certificatesresolvers.le.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53"
+      - "--serversTransport.insecureSkipVerify=true"
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.dashboard.rule=Host(`${TRAEFIK_DOMAIN}`)"
@@ -52,4 +54,32 @@ services:
       - "traefik.http.routers.dashboard.tls=true"
       - "traefik.http.routers.dashboard.tls.certresolver=le"
       - "traefik.http.middlewares.dashboard-basicauth.basicauth.users=${BASIC_AUTH_CREDENTIALS}"
-      - "traefik.http.routers.dashboard.middlewares=dashboard-basicauth@docker"
+      - "traefik.http.routers.dashboard.middlewares=dashboard-basicauth,error-pages-middleware"
+
+  error-pages:
+    image: tarampampam/error-pages
+    container_name: error-pages
+    restart: always
+    environment:
+      TEMPLATE_NAME: lost-in-space
+      SHOW_DETAILS: true
+    labels:
+      traefik.enable: true
+      # use as "fallback" for any NON-registered services (with priority below normal)
+      traefik.http.routers.error-pages.rule: HostRegexp(`{host:.+}`) || Host(`error.ykz.app`)
+      traefik.http.routers.error-pages.priority: 10
+      # "errors" middleware settings
+      traefik.http.routers.error-pages.middlewares: error-pages-middleware
+      traefik.http.middlewares.error-pages-middleware.errors.status: 400-599
+      traefik.http.middlewares.error-pages-middleware.errors.service: error-pages-service
+      traefik.http.middlewares.error-pages-middleware.errors.query: /{status}.html
+      # define service properties
+      traefik.http.services.error-pages-service.loadbalancer.server.port: 8080
+      traefik.http.routers.error-pages.service: error-pages-service
+      traefik.http.routers.error-pages.tls: true
+      traefik.http.routers.error-pages.tls.certresolver: le
+      traefik.http.routers.traefik.middlewares: error-pages-middleware
+    networks:
+      - public
+    depends_on:
+      - traefik

traefik/dynamic/homeassistant.yml

@@ -0,0 +1,13 @@
+http:
+  routers:
+    homeassistant:
+      rule: "Host(`ha.ykz.app`)"
+      tls:
+        certResolver: le
+      service: homeassistant
+  services:
+    homeassistant:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.2.200:8123"
+

uptime-kuma/docker-compose.yml

@@ -11,6 +11,7 @@ services:
     restart: always
     volumes:
       - "./uptime-kuma-data:/app/data"
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
     # ports:
     #   - "3001:3001"
     networks: