######################## # Networks & Volumes ######################## networks: traefik_proxy: name: traefik_proxy volumes: traefik_letsencrypt: traefik_logs: portainer_data: uptime_kuma_data: umami_data: pgadmin_data: ######################## # Services ######################## services: ## ───────────────────────────────────────────── ## Traefik — edge router + ACME (HTTP-01) ## ───────────────────────────────────────────── traefik: image: traefik:v3.1 container_name: traefik restart: unless-stopped ports: - "80:80" - "443:443" # Mail protocol ports for MailCow integration - "25:25" # SMTP - "465:465" # SMTPS - "587:587" # Submission - "143:143" # IMAP - "993:993" # IMAPS - "110:110" # POP3 - "995:995" # POP3S - "4190:4190" # ManageSieve networks: [traefik_proxy] environment: TZ: "${TZ}" command: # Experimental plugins - --experimental.plugins.traefik-umami-plugin.modulename=github.com/1cedsoda/traefik-umami-plugin - --experimental.plugins.traefik-umami-plugin.version=v1.0.3 # Providers - --providers.docker=true - --providers.docker.exposedbydefault=false # Entrypoints - --entrypoints.web.address=:80 - --entrypoints.web.http.redirections.entrypoint.to=websecure - --entrypoints.web.http.redirections.entrypoint.scheme=https - --entrypoints.websecure.address=:443 - --entrypoints.web.forwardedheaders.insecure=true - --entrypoints.websecure.forwardedheaders.insecure=true # Mail protocol entrypoints for MailCow integration - --entrypoints.smtp.address=:25 - --entrypoints.smtps.address=:465 - --entrypoints.submission.address=:587 - --entrypoints.imap.address=:143 - --entrypoints.imaps.address=:993 - --entrypoints.pop3.address=:110 - --entrypoints.pop3s.address=:995 - --entrypoints.sieve.address=:4190 # Dashboard/API (internal) - --api=true - --api.dashboard=true # ACME via HTTP-01 (no registrar API needed) - --certificatesresolvers.le.acme.email=${ACME_EMAIL} - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json - --certificatesresolvers.le.acme.httpchallenge=true - --certificatesresolvers.le.acme.httpchallenge.entrypoint=web # (Alt) Use TLS-ALPN-01 if port 80 is blocked: # - --certificatesresolvers.le.acme.tlschallenge=true # Global timeouts for slow backends - --serversTransport.forwardingTimeouts.dialTimeout=30s - --serversTransport.forwardingTimeouts.responseHeaderTimeout=60s - --serversTransport.forwardingTimeouts.idleConnTimeout=180s # Logs - --accesslog.filepath=/var/log/traefik/access.log - --accesslog.bufferingsize=100 - --log.level=INFO volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - traefik_letsencrypt:/letsencrypt - traefik_logs:/var/log/traefik labels: - traefik.enable=true # Reusable security headers - traefik.http.middlewares.security-headers.headers.stsSeconds=31536000 - traefik.http.middlewares.security-headers.headers.stsIncludeSubdomains=true - traefik.http.middlewares.security-headers.headers.stsPreload=true - traefik.http.middlewares.security-headers.headers.browserXssFilter=true - traefik.http.middlewares.security-headers.headers.contentTypeNosniff=true - traefik.http.middlewares.security-headers.headers.referrerPolicy=no-referrer-when-downgrade - traefik.http.middlewares.security-headers.headers.frameDeny=true # Basic Auth middleware - traefik.http.middlewares.basic-auth.basicauth.users=${BASIC_AUTH_USERS} # Umami Analytics middleware - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.umamiHost=umami:3000 - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.websiteId=${UMAMI_WEBSITE_ID} - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.forwardPath=umami - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.scriptInjection=true - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.scriptInjectionMode=tag - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.autoTrack=true - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.doNotTrack=false - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.cache=false - traefik.http.middlewares.umami-analytics.plugin.traefik-umami-plugin.serverSideTracking=false # Traefik dashboard (protected) - traefik.http.routers.traefik.rule=Host(`traefik.gate.${DOMAIN}`) - traefik.http.routers.traefik.entrypoints=websecure - traefik.http.routers.traefik.tls.certresolver=le - traefik.http.routers.traefik.service=api@internal - traefik.http.routers.traefik.middlewares=basic-auth,security-headers ## ───────────────────────────────────────────── ## Portainer — Docker control plane ## ───────────────────────────────────────────── portainer: image: portainer/portainer-ce:latest container_name: portainer restart: unless-stopped networks: [traefik_proxy] volumes: - /var/run/docker.sock:/var/run/docker.sock - portainer_data:/data labels: - traefik.enable=true - traefik.http.routers.portainer.rule=Host(`portainer.gate.${DOMAIN}`) - traefik.http.routers.portainer.entrypoints=websecure - traefik.http.routers.portainer.tls.certresolver=le - traefik.http.routers.portainer.middlewares=security-headers - traefik.http.services.portainer.loadbalancer.server.port=9000 ## ───────────────────────────────────────────── ## Uptime Kuma — status page / checks ## ───────────────────────────────────────────── uptime-kuma: image: louislam/uptime-kuma:1 container_name: uptime-kuma restart: unless-stopped volumes: - uptime_kuma_data:/app/data networks: [traefik_proxy] labels: - traefik.enable=true - traefik.http.routers.kuma.rule=Host(`uptime.gate.${DOMAIN}`) - traefik.http.routers.kuma.entrypoints=websecure - traefik.http.routers.kuma.tls.certresolver=le - traefik.http.routers.kuma.middlewares=basic-auth,security-headers - traefik.http.services.kuma.loadbalancer.server.port=3001 ## ───────────────────────────────────────────── ## Umami — web analytics ## ───────────────────────────────────────────── umami: image: ghcr.io/umami-software/umami:postgresql-v2.13.2 container_name: umami restart: unless-stopped networks: [traefik_proxy] environment: DATABASE_URL: postgresql://${UMAMI_DB_USER}:${UMAMI_DB_PASS}@umami-db:5432/${UMAMI_DB_NAME} DATABASE_TYPE: postgresql APP_SECRET: ${UMAMI_APP_SECRET} depends_on: - umami-db labels: - traefik.enable=true - traefik.http.routers.umami.rule=Host(`umami.gate.${DOMAIN}`) - traefik.http.routers.umami.entrypoints=websecure - traefik.http.routers.umami.tls.certresolver=le - traefik.http.routers.umami.middlewares=security-headers - traefik.http.services.umami.loadbalancer.server.port=3000 ## ───────────────────────────────────────────── ## Umami Database — PostgreSQL ## ───────────────────────────────────────────── umami-db: image: postgres:15-alpine container_name: umami-db restart: unless-stopped networks: [traefik_proxy] environment: POSTGRES_DB: ${UMAMI_DB_NAME} POSTGRES_USER: ${UMAMI_DB_USER} POSTGRES_PASSWORD: ${UMAMI_DB_PASS} volumes: - umami_data:/var/lib/postgresql/data # ───────────────────────────────────────────── # pgAdmin — PostgreSQL administration # ───────────────────────────────────────────── pgadmin: image: dpage/pgadmin4:latest container_name: pgadmin restart: unless-stopped networks: [traefik_proxy] environment: PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL} PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD} PGADMIN_CONFIG_SERVER_MODE: 'False' PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: 'False' volumes: - pgadmin_data:/var/lib/pgadmin labels: - traefik.enable=true - traefik.http.routers.pgadmin.rule=Host(`pgadmin.gate.${DOMAIN}`) - traefik.http.routers.pgadmin.entrypoints=websecure - traefik.http.routers.pgadmin.tls.certresolver=le - traefik.http.routers.pgadmin.middlewares=basic-auth,security-headers - traefik.http.services.pgadmin.loadbalancer.server.port=80