gist:8d508fc7e16242858a3e47e28ada52a2

deploy_socat.sh · 503 B · Bash Raw

1	#!/bin/bash
2
3	if [ $(ip -6 route \| grep -c ^default) -eq 0 ]; then exit; fi
4	apt install socat \|\| exit
5
6	cat > /etc/systemd/system/socat\@.service <<EOF
7	[Unit]
8	Description=ipv6 to ipv4 port forwarding
9	After=network.target
10
11	[Service]
12	Type=simple
13	ExecStart=/usr/bin/socat TCP6-LISTEN:%i,ipv6only=1,reuseaddr,fork TCP4:127.0.0.1:%i
14
15	[Install]
16	WantedBy=docker.service
17	EOF
18	systemctl daemon-reload
19	for PROTO in http https; do
20	systemctl enable socat@${PROTO}.service
21	systemctl start socat@${PROTO}.service
22	done
23

deploy_traefik.sh · 3.0 KiB · Bash Raw

#!/bin/bash
DOCKER_BASE=/srv/docker

mkdir -p ${DOCKER_BASE}/traefik/container.conf

cat > ${DOCKER_BASE}/traefik/container.conf/docker-compose.yml <<EOF
version: '3.7'

services:
  traefik:
    image: traefik:1.7-alpine
    networks:
      - system_traefik
    environment:
      - LC_ALL=C.UTF-8
      - TZ=Europe/Berlin
    labels:
      - traefik.enable=true
      - traefik.backend=traefik
      - traefik.port=8080
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    restart: always
    volumes:
      - "./config/:/etc/traefik/"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

networks:
  system_traefik:
    external: true
EOF
ln -s container.conf/docker-compose.yml ${DOCKER_BASE}/traefik/

cat > ${DOCKER_BASE}/traefik/container.conf/production.yml <<EOF
version: '3.7'

services:

traefik:
    logging:
      options:
        max-size: "100M"
        max-file: "10"
    labels:
      - traefik.frontend.rule=Host:host.test.org;PathPrefixStrip:/traefik
      - com.centurylinklabs.watchtower.enable=true
EOF

cat > ${DOCKER_BASE}/traefik/container.conf/traefik.service <<EOF
[Unit]
Description=Traefik Proxy Service
After=network.target docker.service
Requires=docker.service

[Service]
Type=oneshot
RemainAfterExit=yes

Environment="WORK_DIR=/srv/docker/traefik/"
WorkingDirectory=/srv/docker/traefik/
ExecStartPre=/bin/bash -c "/usr/bin/docker network inspect system_traefik &>/dev/null || /usr/bin/docker network create --driver bridge system_traefik"
ExecStartPre=-/usr/local/bin/docker-compose -f "\${WORK_DIR}/docker-compose.yml" -f "\${WORK_DIR}/container.conf/production.yml" down
ExecStart=/usr/local/bin/docker-compose -f "\${WORK_DIR}/docker-compose.yml" -f "\${WORK_DIR}/container.conf/production.yml" up -d
ExecStop=/usr/local/bin/docker-compose -f "\${WORK_DIR}/docker-compose.yml" -f "\${WORK_DIR}/container.conf/production.yml" down

[Install]
WantedBy=docker.service
EOF
ln -s ${DOCKER_BASE}/traefik/container.conf/traefik.service /etc/systemd/system/

mkdir -p ${DOCKER_BASE}/traefik/config

cat > ${DOCKER_BASE}/traefik/config/traefik.toml <<EOF
logLevel = "DEBUG"
defaultEntryPoints = ["http", "https"]

# WEB interface of Traefik - it will show web page with overview of frontend and backend configurations 
[web]
address = ":8080"
  [web.auth.basic]
  users = ["admin:$apr1$AAbCdQpX$ajolS9mMfKRG.lqcY/uXU/"]

# Connection to docker host system (docker.sock)
[docker]
domain = "test.org"
watch = true
# This will hide all docker containers that don't have explicitly  
# set label to "enable"
exposedbydefault = false

# Force HTTPS
[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
    minVersion = "VersionTLS12"
  
# Let's encrypt configuration
[acme]
  email="ssladmin@test.org"
  storage="/etc/traefik/acme.json"
  entryPoint="https"
  acmeLogging=true
  onDemand=false
  OnHostRule=true

[acme.httpChallenge]
  entryPoint = "http"
EOF

systemctl daemon-reload && systemctl enable traefik && systemctl start traefik

1	#!/bin/bash
2	DOCKER_BASE=/srv/docker
3
4	mkdir -p ${DOCKER_BASE}/traefik/container.conf
5
6	cat > ${DOCKER_BASE}/traefik/container.conf/docker-compose.yml <<EOF
7	version: '3.7'
8
9	services:
10	traefik:
11	image: traefik:1.7-alpine
12	networks:
13	- system_traefik
14	environment:
15	- LC_ALL=C.UTF-8
16	- TZ=Europe/Berlin
17	labels:
18	- traefik.enable=true
19	- traefik.backend=traefik
20	- traefik.port=8080
21	ports:
22	- "80:80"
23	- "443:443"
24	- "8080:8080"
25	restart: always
26	volumes:
27	- "./config/:/etc/traefik/"
28	- "/var/run/docker.sock:/var/run/docker.sock:ro"
29
30	networks:
31	system_traefik:
32	external: true
33	EOF
34	ln -s container.conf/docker-compose.yml ${DOCKER_BASE}/traefik/
35
36	cat > ${DOCKER_BASE}/traefik/container.conf/production.yml <<EOF
37	version: '3.7'
38
39	services:
40
41	traefik:
42	logging:
43	options:
44	max-size: "100M"
45	max-file: "10"
46	labels:
47	- traefik.frontend.rule=Host:host.test.org;PathPrefixStrip:/traefik
48	- com.centurylinklabs.watchtower.enable=true
49	EOF
50
51	cat > ${DOCKER_BASE}/traefik/container.conf/traefik.service <<EOF
52	[Unit]
53	Description=Traefik Proxy Service
54	After=network.target docker.service
55	Requires=docker.service
56
57	[Service]
58	Type=oneshot
59	RemainAfterExit=yes
60
61	Environment="WORK_DIR=/srv/docker/traefik/"
62	WorkingDirectory=/srv/docker/traefik/
63	ExecStartPre=/bin/bash -c "/usr/bin/docker network inspect system_traefik &>/dev/null \|\| /usr/bin/docker network create --driver bridge system_traefik"
64	ExecStartPre=-/usr/local/bin/docker-compose -f "\${WORK_DIR}/docker-compose.yml" -f "\${WORK_DIR}/container.conf/production.yml" down
65	ExecStart=/usr/local/bin/docker-compose -f "\${WORK_DIR}/docker-compose.yml" -f "\${WORK_DIR}/container.conf/production.yml" up -d
66	ExecStop=/usr/local/bin/docker-compose -f "\${WORK_DIR}/docker-compose.yml" -f "\${WORK_DIR}/container.conf/production.yml" down
67
68	[Install]
69	WantedBy=docker.service
70	EOF
71	ln -s ${DOCKER_BASE}/traefik/container.conf/traefik.service /etc/systemd/system/
72
73	mkdir -p ${DOCKER_BASE}/traefik/config
74
75	cat > ${DOCKER_BASE}/traefik/config/traefik.toml <<EOF
76	logLevel = "DEBUG"
77	defaultEntryPoints = ["http", "https"]
78
79	# WEB interface of Traefik - it will show web page with overview of frontend and backend configurations
80	[web]
81	address = ":8080"
82	[web.auth.basic]
83	users = ["admin:$apr1$AAbCdQpX$ajolS9mMfKRG.lqcY/uXU/"]
84
85	# Connection to docker host system (docker.sock)
86	[docker]
87	domain = "test.org"
88	watch = true
89	# This will hide all docker containers that don't have explicitly
90	# set label to "enable"
91	exposedbydefault = false
92
93	# Force HTTPS
94	[entryPoints]
95	[entryPoints.http]
96	address = ":80"
97	[entryPoints.http.redirect]
98	entryPoint = "https"
99	[entryPoints.https]
100	address = ":443"
101	[entryPoints.https.tls]
102	minVersion = "VersionTLS12"
103
104	# Let's encrypt configuration
105	[acme]
106	email="ssladmin@test.org"
107	storage="/etc/traefik/acme.json"
108	entryPoint="https"
109	acmeLogging=true
110	onDemand=false
111	OnHostRule=true
112
113	[acme.httpChallenge]
114	entryPoint = "http"
115	EOF
116
117	systemctl daemon-reload && systemctl enable traefik && systemctl start traefik
118

migrate_system_traefik_network.sh · 566 B · Bash Raw

1	#!/bin/bash
2	sed -i '/^WorkingDirectory/a ExecStartPre=/bin/bash -c "/usr/bin/docker network inspect system_traefik &>/dev/null \|\| /usr/bin/docker network create --driver bridge system_traefik"' /srv/docker/traefik/container.conf/traefik.service && systemctl daemon-reload
3	sed -i '/image: traefik/a\ networks:\n - system_traefik' /srv/docker/traefik/container.conf/docker-compose.yml
4	sed -i s/traefik_default/system_traefik/g /srv/docker//container.conf/.yml
5	sed -i s/traefik_default/system_traefik/g /srv/docker/portainer/data/compose/*/docker-compose.yml
6

migrate_traefik_TLS11.sh · 152 B · Bash Raw

1	#!/bin/bash
2	sed -i '/\[entryPoints.https.tls\]/a \ minVersion = "VersionTLS11"' /srv/docker/traefik/config/traefik.toml && systemctl restart traefik
3

migrate_traefik_TLS12.sh · 117 B · Bash Raw

1	#!/bin/bash
2	sed -i s/VersionTLS11/VersionTLS12/ /srv/docker/traefik/config/traefik.toml && systemctl restart traefik
3