docker-compose.instance.yaml

#! This is a ytt template file for docker-compose.override.yaml
#! References:
#!   https://carvel.dev/ytt
#!   https://docs.docker.com/compose/extends/#adding-and-overriding-configuration
#!   https://github.com/enigmacurry/d.rymcg.tech#overriding-docker-composeyaml-per-instance

#! ### Standard project vars:
#@ load("@ytt:data", "data")
#@ project = data.values.project
#@ instance = data.values.instance
#@ context = data.values.context
#@ traefik_host = data.values.traefik_host
#@ ip_sourcerange = data.values.ip_sourcerange
#@ enable_http_auth = len(data.values.http_auth.strip()) > 0
#@ http_auth = data.values.http_auth_var
#@ enable_oauth2 = data.values.oauth2 == "true"
#@ authorized_group = data.values.authorized_group
#@ enable_mtls_auth = data.values.enable_mtls_auth == "true"
#@ mtls_authorized_certs = data.values.mtls_authorized_certs
#@ enabled_middlewares = []

#! ### Custom project vars:
#@ lemmy_private = data.values.lemmy_private == "true"

#@yaml/text-templated-strings
services:
  proxy:
    #@ service = "proxy"
    labels:
      - "backup-volume.stop-during-backup=true"
      #! Services must opt-in to be proxied by Traefik:
      - "traefik.enable=true"

      #! 'router' is the fully qualified key in traefik for this router/service: project + instance + service
      #@ router = "{}-{}-{}".format(project,instance,service)

      #! The host matching router rule:
      - "traefik.http.routers.(@= router @).rule=Host(`(@= traefik_host @)`)"
      - "traefik.http.routers.(@= router @).entrypoints=websecure"
      #@ enabled_middlewares.append("{}-ipallowlist".format(router))
      - "traefik.http.middlewares.(@= router @)-ipallowlist.ipallowlist.sourcerange=(@= ip_sourcerange @)"

      #! Override the default port that proxy binds to, so that it lives in userspace >1024:
      #! You don't normally need to do this, as long as your image has
      #! an EXPOSE directive in it, Traefik will autodetect it, but this is how you can override it:
      - "traefik.http.services.(@= router @).loadbalancer.server.port=8536"

      #! Block access to `/feeds` (RSS) due to a bug that leaks private info via feeds:
      #! https://github.com/LemmyNet/lemmy/issues/3785
      #@ if lemmy_private:
      #@ enabled_middlewares.append("{}-blockpath".format(router))
      - "traefik.http.middlewares.(@= router @)-blockpath.plugin.blockpath.regex=^/feeds.*"
      #@ end

      #@ if enable_http_auth:
      #@ enabled_middlewares.append("{}-basicauth".format(router))
      - "traefik.http.middlewares.(@= router @)-basicauth.basicauth.users=(@= http_auth @)"
      - "traefik.http.middlewares.(@= router @)-basicauth.basicauth.headerField=X-Forwarded-User"
      #@ end

      #@ if enable_oauth2:
      #@ enabled_middlewares.append("traefik-forward-auth@docker")
      #@ enabled_middlewares.append("header-authorization-group-{}@file".format(authorized_group))
      #@ end


      #@ if enable_mtls_auth:
      - "traefik.http.routers.(@= router @).tls.options=step_ca_mTLS@file"
        #@ if len(mtls_authorized_certs):
      - "traefik.http.middlewares.mtlsauth-(@= router @).plugin.certauthz.domains=(@= mtls_authorized_certs @)"
        #@ enabled_middlewares.append("mtlsauth-{}".format(router))
        #@ end
        #@ enabled_middlewares.append("mtls-header@file")
      #@ end

      #! Apply all middlewares (do this at the end!)
      - "traefik.http.routers.(@= router @).middlewares=(@= ','.join(enabled_middlewares) @)"