docker-compose-for-heavymetal-networks.yml

version: "3.9"

networks:
  vlan_80:
    driver: macvlan # Otherwise PiHole and other containers cannot resolve DNS internally due to NAT issue within Docker
    # driver: ipvlan
    driver_opts:
      parent: ${NETWORK_DEVICE}.${METAL_VLAN_ID}
      name: macvlan${METAL_VLAN_ID}
    ipam:
      config:
        - subnet: 10.100.${METAL_VLAN_ID}.0/24
          gateway: ${METAL_GATEWAY}
          ip_range: 10.100.${METAL_VLAN_ID}.192/26 # 192-255
          # aux_addresses:
          #   reserved: 10.100.${METAL_VLAN_ID}.1
          #   dns: 10.100.${METAL_VLAN_ID}.3

  vlan_20:
    driver: macvlan # Otherwise PiHole container cannot resolve DNS internally due to NAT issue within Docker
    driver_opts:
      parent: ${NETWORK_DEVICE}.${THINGS_VLAN_ID}
      name: macvlan${THINGS_VLAN_ID}
    ipam:
      config:
        - subnet: 10.100.${THINGS_VLAN_ID}.0/24
          gateway: ${THINGS_GATEWAY}
          ip_range: 10.100.${THINGS_VLAN_ID}.12/30  # 12 - 15

  traefik_proxy:
    driver: bridge
    internal: true

  internet:
    driver: bridge

services:
  do-nothing:
    image: jhnrn/do-nothing:latest
    restart: unless-stopped
    networks:
      vlan_20:
      vlan_80:
      traefik_proxy:
      internet:

  dockerproxy:
    image: ghcr.io/tecnativa/docker-socket-proxy:latest
    container_name: dockerproxy
    environment:
        - CONTAINERS=1 # Allow access to viewing containers
        - POST=0 # Disallow any POST operations (effectively read-only)
    # ports:
    #     - 2375:2375
    volumes:
        - /var/run/docker.sock:/var/run/docker.sock:ro # Mounted as read-only
    networks:
      traefik_proxy:
      vlan_80:
        ipv4_address: ${HEAVYMETAL_DOCKERPROXY_IP_ADDRESS}
    restart: unless-stopped
    healthcheck:
      test: wget --spider http://localhost:2375/version || exit 1
      interval: "29s"
      timeout: "5s"
      retries: 3
      start_period: "21s"

  traefik:
    image: traefik:latest
    hostname: traefik
    container_name: traefik
    command:
      - "--log.level=INFO"
      - "--accesslog=false"
      - "--api.dashboard=true"
      - "--providers.docker.endpoint=tcp://dockerproxy:2375"
      - "--providers.file.directory=/FileProvider/"
      - "--providers.file.watch=true"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=web-secure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.web-secure.address=:443"
      - "--entrypoints.web-secure.forwardedHeaders.trustedIPs=${TRUSTED_IPS}"
      - "--entrypoints.gogs-ssh.address=:22"
      - "--entrypoints.gitea-ssh.address=:2222"
      - "--entrypoints.rtsp.address=:8554"
      - "--entrypoints.webrtc.address=:8555"
      - "--entrypoints.mqtt.address=:1883"
      - "--entrypoints.websocket.address=:9001"
      - "--serverstransport.insecureskipverify=true"
      # Set up LetsEncrypt
      - "--certificatesresolvers.certificato.acme.dnschallenge=true"
      - "--certificatesresolvers.certificato.acme.dnschallenge.provider=cloudflare"
      - "--certificatesresolvers.certificato.acme.dnschallenge.delaybeforecheck=10"
      - "--certificatesresolvers.certificato.acme.dnschallenge.resolvers=1.1.1.1:53"
      # - "--certificatesresolvers.certificato.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.certificato.acme.email=postmaster@${DOMAIN}"
      - "--certificatesresolvers.certificato.acme.storage=/letsencrypt/acme.json"
      - "--ping=true"
    networks:
      traefik_proxy:
      vlan_80:
        ipv4_address: ${TRAEFIK_IP_ADDRESS_2}
    dns:
      - ${METAL_DNS_IP_ADDRESS}
      - 1.1.1.1
    extra_hosts:
      host.docker.internal: host-gateway
    environment:
      CLOUDFLARE_EMAIL: ${CF_API_EMAIL}
      CLOUDFLARE_DNS_API_TOKEN: ${DNS_API_TOKEN}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`reverse-heavymetal.${DOMAIN}`)"
      - "traefik.http.routers.api.entrypoints=web-secure"
      - "traefik.http.routers.api.tls.certresolver=certificato"
      - "traefik.http.middlewares.private-ipallowlist.ipallowlist.sourcerange=127.0.0.1/32,${PRIVATE_IPS_COMMA_SEPARATED},${METAL_NETWORK}"
      - "traefik.http.middlewares.quantum-ipallowlist.ipallowlist.sourcerange=127.0.0.1/32,${QUANTUM_NETWORK}"
      - "traefik.http.middlewares.quantum_metal-ipallowlist.ipallowlist.sourcerange=127.0.0.1/32,${QUANTUM_NETWORK},${METAL_NETWORK}"
      - "traefik.http.middlewares.quantum_things-ipallowlist.ipallowlist.sourcerange=127.0.0.1/32,${QUANTUM_NETWORK},${THINGS_NETWORK}"
      - "traefik.http.middlewares.things-ipallowlist.ipallowlist.sourcerange=127.0.0.1/32,${THINGS_NETWORK}"
      # - "traefik.http.routers.api.tls.domains[0].main=*.${DOMAIN}"
      - "traefik.http.routers.api.service=api@internal"
      - "traefik.http.services.api@internal.loadbalancer.server.port=80"
      - traefik.docker.network=networks_traefik_proxy
      - homepage.group=HeavyMetal
      - homepage.name=Traefik
      - homepage.weight=1000
      - homepage.description=for HeavyMetal
      - homepage.icon=traefik.png
      - homepage.href=https://reverse-heavymetal.${DOMAIN}
      - homepage.widget.type=traefik
      - homepage.widget.url=https://reverse-heavymetal.${DOMAIN}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${DATA_STORAGE}/traefik/certs:/letsencrypt
      - ${DATA_STORAGE}/traefik/dynamic:/FileProvider
    restart: always
    depends_on:
      - dockerproxy
    healthcheck: # This is to announce to the network (router and switch) that this ip address is sitting here
      # test: traefik healthcheck --ping && ping -c 1 bing.com || exit 1
      test: traefik healthcheck --ping || exit 1
      interval: 30s
      retries: 5