atareao / HAPROXY - TRAEFIK

global log /dev/log local0 debug log /dev/log local1 notice chroot /var/lib/haproxy stats socket /run/haproxy/admin.sock mode 660 level admin stats timeout 30s user haproxy group haproxy daemon # Default SSL material locations ca-base /etc/ssl/certs crt-base /etc/ssl/private # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets defaults log global mode tcp option tcplog option dontlognull timeout connect 5s timeout client 50s timeout server 50s frontend http_in bind :80 mode http # Redirige todo el tráfico entrante de HTTP a HTTPS conservando la URL original redirect scheme https code 301 if !{ ssl_fc } frontend https_in bind :443 mode tcp default_backend traefik_backend backend traefik_backend mode tcp log global # Envía el tráfico a Traefik agregando el protocolo PROXY (v2) server traefik 127.0.0.1:8443 send-proxy-v2

[Unit] Description=Red interna de comunicación entre Traefik y Servicios [Network] NetworkName=proxy

[Unit] Description=Servicio Proxy Inverso Traefik con Podman After=network-online.target Requires=proxy-network.service [Container] Image=docker.io/library/traefik:v3.7.15 ContainerName=traefik Environment=TZ=Europe/Madrid Environment=CF_DNS_API_TOKEN=cfut_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXx Network=proxy.network LogDriver=journald # Mapeo de puertos PublishPort=8443:8443/tcp # PublishPort=8443:8443/udp # Deshabilitar SELinux/AppArmor labels para acceder al socket de podman # SecurityLabelDisable=true # Volúmenes montados Volume=/run/user/1002/podman/podman.sock:/run/user/1002/podman/podman.sock:ro Volume=%h/traefik/data/traefik.yml:/etc/traefik/traefik.yml:ro Volume=%h/traefik/data/config.yml:/etc/traefik/config.yml:ro Volume=%h/traefik/data/acme.json:/etc/traefik/acme.json [Install] WantedBy=default.target

global: checkNewVersion: false sendAnonymousUsage: false log: level: INFO accessLog: filePath: "" # Vacio para volcar a stdout/journald format: json filters: statusCodes: - "400-499" # Captura errores de autenticación y accesos no autorizados api: dashboard: false insecure: false entryPoints: websecure: address: ":8443" proxyProtocol: trustedIPs: - "127.0.0.1/32" - "10.89.0.0/16" providers: docker: endpoint: "unix:///run/user/1002/podman/podman.sock" exposedByDefault: false file: filename: "/etc/traefik/config.yml" watch: true certificatesResolvers: cloudflare: acme: email: "tu-email@servidor.es" storage: "/etc/traefik/acme.json" dnsChallenge: provider: cloudflare propagation: delayBeforeChecks: 10s resolvers: - "1.1.1.1:53" - "8.8.8.8:53"

[Unit] Description=Volumen de datos persistente para Umami PostgreSQL [Volume] VolumeName=umami-db-data

[Unit] Description=Base de Datos PostgreSQL para Umami After=proxy-network.service [Container] Image=docker.io/library/postgres:17-alpine ContainerName=umami-db Network=umami.network # Variables de entorno de PostgreSQL Environment=POSTGRES_DB=umami Environment=POSTGRES_USER=umami Environment=POSTGRES_PASSWORD=password # Montaje del volumen persistente de datos Volume=umami-db-data.volume:/var/lib/postgresql/data [Install] WantedBy=default.target

[Unit] Description=Servicio de Analítica Umami After=umami-db.service umami-network.service proxy-network.service [Container] Image=ghcr.io/umami-software/umami:postgresql-latest ContainerName=umami Network=umami.network Network=proxy Environment=DATABASE_URL=postgresql://umami:password@umami-db:5432/umami Environment=APP_SECRET=tu_hash_aleatorio_largo # Le indica a Umami qué cabecera HTTP contiene la IP real del cliente Environment=CLIENT_IP_HEADER=cf-connecting-ip # Etiquetas de Traefik Label=traefik.enable=true Label=traefik.http.routers.umami.rule=Host(`umami.servidor.es`) Label=traefik.http.routers.umami.entrypoints=websecure Label=traefik.http.routers.umami.tls=true Label=traefik.http.routers.umami.tls.certresolver=cloudflare Label=traefik.http.services.umami.loadbalancer.server.port=3000 [Install] WantedBy=default.target

[Network] NetworkName=umami

[Unit] Description=Contenedor Whoami de prueba para Traefik After=traefik.service Requires=traefik.service [Container] Image=docker.io/traefik/whoami ContainerName=whoami Network=proxy.network # Etiquetas de Traefik para autodescubrimiento Label=traefik.enable=true Label=traefik.http.routers.whoami.rule=Host(`whoami.servidor.es`) Label=traefik.http.routers.whoami.entrypoints=websecure Label=traefik.http.routers.whoami.tls.certresolver=cloudflare Label=traefik.docker.network=proxy [Install] WantedBy=default.target