Add Harbor And Update Traefik

Reseaux/Traefik/configs/dynamic/dashboard.yml

@@ -1,16 +1,16 @@
 http:
   routers:
     traefik:
-      rule: Host(`dashboard.10.0.4.29.traefik.me`)
+      rule: Host(`dashboard.traefik.me`)
       entryPoints:
         - https
       service: api@internal
       middlewares:
         - dashboardauth
       tls:
-        certResolver: letsencrypt
+        certResolver: production
     traefik-http-redirect:
-      rule: Host(`dashboard.10.0.4.29.traefik.me`)
+      rule: Host(`dashboard.traefik.me`)
       entryPoints:
         - http
       service: api@internal

Reseaux/Traefik/configs/dynamic/global-middlewares.yml

@@ -48,3 +48,58 @@ http:
         regex: "^https?://www\\.(.+)"
         # How to modify the URL to have the new target URL
         replacement: "https://${1}"
+
+#    default-headers:
+#      headers:
+#        frameDeny: true
+#        browserXssFilter: true
+#        contentTypeNosniff: true
+#        forceSTSHeader: true
+#        stsIncludeSubdomains: true
+#        stsPreload: true
+#        stsSeconds: 15552000
+#        customFrameOptionsValue: SAMEORIGIN
+#        customRequestHeaders:
+#          X-Forwarded-Proto: https
+
+#    crowdsec:
+#      plugin:
+#        bouncer:
+#          enabled: true
+#          logLevel: INFO
+#          updateIntervalSeconds: 15
+#          updateMaxFailure: 0
+#          defaultDecisionSeconds: 15
+#          httpTimeoutSeconds: 10
+#          crowdsecMode: stream
+#          crowdsecAppsecEnabled: true
+#          crowdsecAppsecHost: crowdsec:7422
+#          crowdsecAppsecFailureBlock: true
+#          crowdsecAppsecUnreachableBlock: true
+#          crowdsecLapiKey: #####REPLACE_API_KEY#####                                    # Replace CrowdSec API key (docker exec crowdsec cscli bouncers add crowdsecBouncer)
+#          crowdsecLapiKeyFile: /etc/traefik/cs-privateKey-foo
+#          crowdsecLapiHost: crowdsec:8080
+#          crowdsecLapiScheme: http
+#          forwardedHeadersTrustedIPs:
+#            - 10.0.35.4/32                                                              # Cloudflare tunnel IP address
+#            - 172.30.0.0/24                                                            # Reverse Proxy IP address
+#          clientTrustedIPs:
+#            - 10.0.1.0/24                                                              # Internal LAN IP addresses
+#            - 10.0.2.0/24                                                              # Internal LAN IP addresses
+#            - 10.0.3.0/24                                                              # Internal LAN IP addresses
+#            - 10.0.4.0/24                                                              # Internal LAN IP addresses
+#            - 10.0.5.0/24                                                              # Internal LAN IP addresses
+#          forwardedHeadersCustomName: CF-Connecting-IP                                 # Cloudflare IP address header
+
+#    default-whitelist:
+#      ipWhiteList:
+#        sourceRange:
+#        - "10.0.4.0/24"
+#        - "192.168.0.0/16"
+#        - "172.16.0.0/12"
+
+#    secured:
+#      chain:
+#        middlewares:
+#        - default-whitelist
+#        - default-headers

Reseaux/Traefik/configs/dynamic/registry.yml

@@ -0,0 +1,13 @@
+http:
+  routers:
+    harbor:
+      service: harbor
+      rule: "Host(`registry.traefik.me`)"
+      tls:
+        certResolver: production
+
+  services:
+    harbor:
+      loadBalancer:
+        servers:
+          - url: "http://registry.traefik.me:8083"

Reseaux/Traefik/configs/traefik.yml

@@ -8,8 +8,8 @@ global:
 entryPoints:
   http:
     address: ":80"
-#    forwardedHeaders:
-#      insecure: true
+    forwardedHeaders:
+      insecure: true
     http:
       redirections:
         entryPoint:
@@ -17,8 +17,8 @@ entryPoints:
           scheme: https
   https:
     address: ":443"
-#    forwardedHeaders:
-#      insecure: true
+    forwardedHeaders:
+      insecure: true
 #    http:
 #      middlewares:
 #        - secureHeaders@file
@@ -38,12 +38,23 @@ providers:
   providersThrottleDuration: 10
 
 certificatesResolvers:
-  cloudflare:
+  staging:
     acme:
       email: admin@tips-of-mine.fr
       storage: acme.json
+      caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
       dnsChallenge:
-        provider: cloudflare
+        provider: staging
+      tlschallenge: true
+      httpChallenge:
+        entryPoint: http
+  production:
+    acme:
+      email: admin@tips-of-mine.fr
+      storage: acme.json
+      caServer: "https://acme-v02.api.letsencrypt.org/directory"
+      dnsChallenge:
+        provider: production
         resolvers:
           - "1.1.1.1:53"
           - "1.0.0.1:53"
@@ -83,3 +94,21 @@ metrics:
     # Ajout des services
     addServicesLabels: true
     addRoutersLabels: true
+
+experimental:
+  plugins:
+    crowdsec-bouncer-traefik-plugin:
+      moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      version: "v1.3.3"
+
+    traefik-maintenance:
+      moduleName: github.com/TRIMM/traefik-maintenance
+      version: v1.0.1
+
+    fail2ban:
+      moduleName: "github.com/tomMoulard/fail2ban"
+      version: "v0.8.3"
+
+    sablier:
+      moduleName: "github.com/acouvreur/sablier"
+      version: "v1.8.0-beta.22"