Skip to content

Commit a0f967f

Browse files
dannylambdannylamb
committed
TLS and traefik.me instead of localhost
1 parent 6b13adf commit a0f967f

14 files changed

+86
-27
lines changed

‎.gitignore

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,4 +85,8 @@ docker-compose.env.yml
8585

8686
#===================
8787
# User overrides for building custom image from the codebase directory.
88-
Dockerfile
88+
Dockerfile
89+
90+
#===================
91+
# User provided certs for TLS.
92+
certs

‎Makefile

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -243,10 +243,20 @@ endif
243243
$(REPOSITORY)/drupal:$(TAG) -r \
244244
'echo password_hash(md5("$(MATOMO_USER_PASS)"), PASSWORD_DEFAULT) . "\n";'
245245

246+
# Helper function to generate keys for the user to use in their docker-compose.env.yml
247+
.PHONY: download-default-certs
248+
.SILENT: download-default-certs
249+
download-default-certs:
250+
mkdir -p certs
251+
curl http://traefik.me/cert.pem -o certs/cert.pem
252+
curl http://traefik.me/chain.pem -o certs/chain.pem
253+
curl http://traefik.me/fullchain.pem -o certs/fullchain.pem
254+
curl http://traefik.me/privkey.pem -o certs/privkey.pem
255+
246256
# Destroys everything beware!
247257
.PHONY: clean
248258
.SILENT: clean
249259
clean:
250260
-docker-compose down -v
251261
sudo rm -fr codebase
252-
git clean -xffd .
262+
git clean -xffd .

‎docker-compose.blazegraph.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,11 @@ services:
1616
default:
1717
# Allow services to use the edge name to reference this service.
1818
aliases:
19-
- blazegraph.${COMPOSE_PROJECT_NAME-isle-dc}.localhost
19+
- blazegraph.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}
20+
- blazegraph-${COMPOSE_PROJECT_NAME-isle-dc}-${DRUPAL_SITE_HOST-traefik.me}
2021
gateway: # Do not expose in production.
2122
labels:
2223
- traefik.enable=true
2324
- traefik.http.services.${COMPOSE_PROJECT_NAME-isle-dc}-blazegraph.loadbalancer.server.port=80
2425
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-blazegraph_http.service=${COMPOSE_PROJECT_NAME-isle-dc}-blazegraph
25-
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-blazegraph_http.entrypoints=http
26+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-blazegraph_http.entrypoints=http

‎docker-compose.cantaloupe.yml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,15 @@ services:
1515
labels:
1616
- traefik.enable=true
1717
- traefik.http.services.${COMPOSE_PROJECT_NAME-isle-dc}-cantaloupe.loadbalancer.server.port=80
18+
- traefik.http.middlewares.cantaloupe-redirectscheme.redirectscheme.scheme=https
19+
- traefik.http.middlewares.cantaloupe-redirectscheme.redirectscheme.permanent=true
1820
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-cantaloupe_http.service=${COMPOSE_PROJECT_NAME-isle-dc}-cantaloupe
1921
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-cantaloupe_http.entrypoints=http
20-
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-cantaloupe_http.rule=Host(`islandora.${COMPOSE_PROJECT_NAME-isle-dc}.localhost`) && PathPrefix(`/cantaloupe`)
22+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-cantaloupe_http.rule=Host(`islandora.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}`,`islandora-${COMPOSE_PROJECT_NAME-isle-dc}-${DRUPAL_SITE_HOST-traefik.me}`) && PathPrefix(`/cantaloupe`)
23+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-cantaloupe_http.middlewares=cantaloupe-redirectscheme
24+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-cantaloupe_https.entrypoints=https
25+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-cantaloupe_https.rule=Host(`islandora.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}`,`islandora-${COMPOSE_PROJECT_NAME-isle-dc}-${DRUPAL_SITE_HOST-traefik.me}`) && PathPrefix(`/cantaloupe`)
26+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-cantaloupe_https.tls=true
2127
networks:
2228
default:
23-
gateway:
29+
gateway:

‎docker-compose.demo.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,4 +36,4 @@ services:
3636
# On a production site you may not want to take this approach but instead refer to each of the cores
3737
# data directories specifically and maintain the configuration as part of a customized image, where
3838
# in your configuration is Solr managed under source control somewhere.
39-
- solr-data:/opt/solr/server/solr
39+
- solr-data:/opt/solr/server/solr

‎docker-compose.drupal.yml

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,19 @@ services:
1313
labels:
1414
- traefik.enable=true
1515
- traefik.http.services.${COMPOSE_PROJECT_NAME-isle-dc}-drupal.loadbalancer.server.port=80
16+
- traefik.http.middlewares.drupal-redirectscheme.redirectscheme.scheme=https
17+
- traefik.http.middlewares.drupal-redirectscheme.redirectscheme.permanent=true
1618
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-drupal_http.service=${COMPOSE_PROJECT_NAME-isle-dc}-drupal
1719
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-drupal_http.entrypoints=http
18-
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-drupal_http.rule=Host(`islandora.${COMPOSE_PROJECT_NAME-isle-dc}.localhost`)
20+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-drupal_http.rule=Host(`islandora.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}`,`islandora-${COMPOSE_PROJECT_NAME-isle-dc}-${DRUPAL_SITE_HOST-traefik.me}`)
21+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-drupal_http.middlewares=drupal-redirectscheme
22+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-drupal_https.entrypoints=https
23+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-drupal_https.rule=Host(`islandora.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}`,`islandora-${COMPOSE_PROJECT_NAME-isle-dc}-${DRUPAL_SITE_HOST-traefik.me}`)
24+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-drupal_https.tls=true
1925
networks:
2026
default:
2127
# Allow services (like Matomo) to use the edge name to reference this service in addition to `drupal`.
2228
aliases:
23-
- islandora.${COMPOSE_PROJECT_NAME-isle-dc}.localhost
24-
gateway:
29+
- islandora.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}
30+
- islandora-${COMPOSE_PROJECT_NAME-isle-dc}-${DRUPAL_SITE_HOST-traefik.me}
31+
gateway:

‎docker-compose.fcrepo.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@ services:
2121
# used for display as well. This means this service edge name must
2222
# also be used in the default network for access by the `drupal`
2323
# service.
24-
- fcrepo.${COMPOSE_PROJECT_NAME-isle-dc}.localhost
24+
- fcrepo.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}
25+
- fcrepo-${COMPOSE_PROJECT_NAME-isle-dc}-${DRUPAL_SITE_HOST-traefik.me}
2526
gateway: # May want to disable in production if you wish to hide Fedora REST API from the internet.
2627
labels:
2728
# Do not expose in production.

‎docker-compose.local.yml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,12 @@ services:
1919
image: ${REPOSITORY:-islandora}/drupal:${TAG:-latest}
2020
environment:
2121
# Use the edge name so the Drush on the host machine can access it.
22-
DRUPAL_DEFAULT_DB_HOST: database.${COMPOSE_PROJECT_NAME-isle-dc}.localhost
22+
DRUPAL_DEFAULT_DB_HOST: database.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}
2323
volumes:
2424
- ./codebase:/var/www/drupal
2525
- drupal-sites-data:/var/www/drupal/web/sites/default/files
2626
- solr-data:/opt/solr/server/solr
27+
- ./certs/fullchain.pem:/usr/local/share/ca-certificates/fullchain.pem
2728
depends_on:
2829
# Requires a the very minimum a database.
2930
- database
@@ -52,5 +53,6 @@ services:
5253
# name in settings.php so Drush on the host machine can be used in the
5354
# codebase folder.
5455
aliases:
55-
- database.${COMPOSE_PROJECT_NAME-isle-dc}.localhost
56-
gateway:
56+
- database.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}
57+
- database-${COMPOSE_PROJECT_NAME-isle-dc}-${DRUPAL_SITE_HOST-traefik.me}
58+
gateway:

‎docker-compose.matomo.yml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,16 @@ services:
1919
# Do not expose in production over http, setup https.
2020
- traefik.enable=true
2121
- traefik.http.services.${COMPOSE_PROJECT_NAME-isle-dc}-matomo.loadbalancer.server.port=80
22+
- traefik.http.middlewares.${COMPOSE_PROJECT_NAME-isle-dc}-matomo-redirectscheme.redirectscheme.scheme=https
23+
- traefik.http.middlewares.${COMPOSE_PROJECT_NAME-isle-dc}-matomo-redirectscheme.redirectscheme.permanent=true
2224
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-matomo_http.service=${COMPOSE_PROJECT_NAME-isle-dc}-matomo
2325
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-matomo_http.entrypoints=http
24-
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-matomo_http.rule=Host(`islandora.${COMPOSE_PROJECT_NAME-isle-dc}.localhost`) && PathPrefix(`/matomo`)
26+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-matomo_http.rule=Host(`islandora.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}`,`islandora-${COMPOSE_PROJECT_NAME-isle-dc}-${DRUPAL_SITE_HOST-traefik.me}`) && PathPrefix(`/matomo`)
27+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-matomo_http.middlewares=${COMPOSE_PROJECT_NAME-isle-dc}-matomo-redirectscheme
2528
- traefik.http.middlewares.${COMPOSE_PROJECT_NAME-isle-dc}-matomo-stripprefix.stripprefix.prefixes=/matomo
2629
- traefik.http.middlewares.${COMPOSE_PROJECT_NAME-isle-dc}-matomo-customrequestheaders.headers.customrequestheaders.X-Forwarded-Uri=/matomo
2730
- traefik.http.middlewares.${COMPOSE_PROJECT_NAME-isle-dc}-matomo.chain.middlewares=${COMPOSE_PROJECT_NAME-isle-dc}-matomo-stripprefix,${COMPOSE_PROJECT_NAME-isle-dc}-matomo-customrequestheaders
28-
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-matomo_http.middlewares=${COMPOSE_PROJECT_NAME-isle-dc}-matomo
31+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-matomo_https.entrypoints=https
32+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-matomo_https.rule=Host(`islandora.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}`,`islandora-${COMPOSE_PROJECT_NAME-isle-dc}-${DRUPAL_SITE_HOST-traefik.me}`) && PathPrefix(`/matomo`)
33+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-matomo_https.tls=true
34+
- traefik.http.routers.${COMPOSE_PROJECT_NAME-isle-dc}-matomo_https.middlewares=${COMPOSE_PROJECT_NAME-isle-dc}-matomo

‎docker-compose.sample.env.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -70,10 +70,10 @@ services:
7070
# If creating sub-sites you must specify each of these as the defaults would cause odd issues where it pulls
7171
# content from the main site rather than the sub site.
7272
#
73-
DRUPAL_DEFAULT_CANTALOUPE_URL: http://islandora.${COMPOSE_PROJECT_NAME-isle-dc}.localhost/cantaloupe/iiif/2
74-
DRUPAL_DEFAULT_FCREPO_HOST: fcrepo.${COMPOSE_PROJECT_NAME-isle-dc}.localhost
75-
DRUPAL_DEFAULT_MATOMO_URL: http://islandora.${COMPOSE_PROJECT_NAME-isle-dc}.localhost/matomo/
76-
DRUPAL_DEFAULT_SITE_URL: http://islandora.${COMPOSE_PROJECT_NAME-isle-dc}.localhost
73+
DRUPAL_DEFAULT_CANTALOUPE_URL: http://islandora.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}/cantaloupe/iiif/2
74+
DRUPAL_DEFAULT_FCREPO_HOST: fcrepo.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}
75+
DRUPAL_DEFAULT_MATOMO_URL: http://islandora.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}/matomo/
76+
DRUPAL_DEFAULT_SITE_URL: http://islandora.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}
7777
#
7878
# Salt for one-time login links, cancel links, form tokens, etc, if deploying multiple
7979
# instances of the site this must be set the same for all instances.
@@ -275,7 +275,7 @@ services:
275275
#
276276
# Must be exactly the same as DRUPAL_DEFAULT_SITE_URL without the protocol.
277277
#
278-
MATOMO_SITE_HOST: islandora.${COMPOSE_PROJECT_NAME-isle-dc}.localhost
278+
MATOMO_SITE_HOST: islandora.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}
279279
#
280280
# Timezone of site.
281281
#
@@ -302,4 +302,4 @@ services:
302302
rwIDAQAB
303303
-----END PUBLIC KEY-----
304304
solr:
305-
# No environment variables require overriding.
305+
# No environment variables require overriding.

‎docker-compose.solr.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@ services:
1717
# This allows links from the Drupal administration page to lead
1818
# to the appropriate solr server.
1919
aliases:
20-
- solr.${COMPOSE_PROJECT_NAME-isle-dc}.localhost
20+
- solr.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}
21+
- solr-${COMPOSE_PROJECT_NAME-isle-dc}-${DRUPAL_SITE_HOST-traefik.me}
2122
gateway: # Do not expose in production.
2223
labels:
2324
# Do not expose in production.

‎docker-compose.traefik.yml

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
# Allows traefik to work as the edge router for multiple projects.
22
#
3-
# By default the rules will redirect to ${SERVICE}.${COMPOSE_PROJECT_NAME}.localhost
3+
# By default the rules will redirect to ${SERVICE}.${COMPOSE_PROJECT_NAME}.traefik.me
4+
# if working on localhost and ${SERVICE}-${COMPOSE_PROJECT_NAME}-XX-XX-XX-XX.traefik.me
5+
# if working remotely, where XX-XX-XX-XX is the dashed version of your IP address.
46
#
57
# For a traefik to be able to route traffic to a given container, that
68
# container needs to be on the `gateway` network, otherwise traefik will
@@ -27,7 +29,8 @@ services:
2729
--providers.docker
2830
--providers.docker.network=gateway
2931
--providers.docker.exposedByDefault=false
30-
'--providers.docker.defaultRule=Host(`{{ index .Labels "com.docker.compose.service" }}.{{ index .Labels "com.docker.compose.project" }}.localhost`)'
32+
--providers.file.filename=/etc/traefik/tls.yml
33+
'--providers.docker.defaultRule=Host(`{{ index .Labels "com.docker.compose.service" }}.{{ index .Labels "com.docker.compose.project" }}.${DRUPAL_SITE_HOST:-traefik.me}`,`{{ index .Labels "com.docker.compose.service" }}-{{ index .Labels "com.docker.compose.project" }}-${DRUPAL_SITE_HOST:-traefik.me}`)'
3134
ports:
3235
# Has to be bind mounted to 80/443 for assumptions
3336
# around internal network alias to work as intended.
@@ -40,8 +43,16 @@ services:
4043
- ${TRAEFIK_WEB_UI_PORT-8080}:8080
4144
volumes:
4245
- /var/run/docker.sock:/var/run/docker.sock
46+
- ./tls.yml:/etc/traefik/tls.yml
47+
- ./certs:/etc/ssl/traefik
4348
labels:
4449
# Do not expose in production.
4550
- traefik.http.routers.api.service=api@internal
4651
networks:
47-
- gateway
52+
default:
53+
# Easy to construct aliases the Drupal service needs to occassionally kick
54+
# internal requests back through traefik.
55+
aliases:
56+
- traefik.islandora.${COMPOSE_PROJECT_NAME-isle-dc}.${DRUPAL_SITE_HOST-traefik.me}
57+
- traefik-islandora-${COMPOSE_PROJECT_NAME-isle-dc}-${DRUPAL_SITE_HOST-traefik.me}
58+
gateway: null

‎sample.env

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,10 @@ ENVIRONMENT=demo
1616
COMPOSE_HTTP_TIMEOUT=480
1717

1818
# Also used for naming services in traefik as well as defining network alias and urls.
19-
# For example the `drupal` service will be found at `islandora.${COMPOSE_PROJECT_NAME}.localhost`.
19+
# For example the `drupal` service will be found at `islandora.${COMPOSE_PROJECT_NAME}.${DRUPAL_SITE_HOST}`.
2020
# See https://docs.docker.com/compose/reference/envvars/
2121
COMPOSE_PROJECT_NAME=isle-dc
22+
DRUPAL_SITE_HOST=68-183-192-46.traefik.me
2223

2324
# Allows building custom image with buildkit.
2425
COMPOSE_DOCKER_CLI_BUILD=1

‎tls.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
tls:
2+
stores:
3+
default:
4+
defaultCertificate:
5+
certFile: /etc/ssl/traefik/cert.pem
6+
keyFile: /etc/ssl/traefik/privkey.pem
7+
certificates:
8+
- certFile: /etc/ssl/traefik/cert.pem
9+
keyFile: /etc/ssl/traefik/privkey.pem

0 commit comments

Comments
 (0)