docker-synapse.minervajuppiter.net

commit 23ed43e533519334e7f7d8a7ccfbe43203e0dd2f
parent e1e87512df11b3249dfa957eff6ed2ef5cc12378
Author: Minerva_juppiter <94231606+minerva-jupiter@users.noreply.github.com>
Date:   Mon,  9 Feb 2026 19:23:42 +0900

Refactor docker-compose for tuwunel and Traefik
Diffstat:
M
docker-compose.yaml
 | 
153
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--------

1 file changed, 138 insertions(+), 15 deletions(-)
diff --git a/docker-compose.yaml b/docker-compose.yaml
@@ -1,28 +1,151 @@
+# tuwunel - Behind Traefik Reverse Proxy
+
 services:
-  tuwunel:
+  homeserver:
+    ### If you already built the tuwunel image with 'docker build' or want to use the Docker Hub image,
+    ### then you are ready to go.
     image: ghcr.io/matrix-construct/tuwunel:latest
     restart: unless-stopped
-    ports:
-      - "6167:6167"
     volumes:
-      - ./tuwunel-data:/var/lib/tuwunel
+      - db:/var/lib/tuwunel
+      #- ./tuwunel.toml:/etc/tuwunel.toml
+    networks:
+      - proxy
     environment:
-      TUWUNEL_SERVER_NAME: docker-synapse.minervajuppiter.net
-      TUWUNEL_DATABASE_PATH: /var/lib/tuwunel
+      TUWUNEL_SERVER_NAME: docker-synapse.minervajuppiter.net # EDIT THIS
+      TUWUNEL_TRUSTED_SERVERS: '["matrix.org"]'
+      TUWUNEL_ALLOW_REGISTRATION: 'true' # After setting a secure registration token, you can enable this
+      TUWUNEL_REGISTRATION_TOKEN: "PSrYqEAJUpsLfsARbJWnMbs9WbxygM79" # This is a token you can use to register on the server
+      #TUWUNEL_REGISTRATION_TOKEN_FILE: "" # Alternatively you can configure a path to a token file to read
       TUWUNEL_ADDRESS: 0.0.0.0
-      TUWUNEL_PORT: 6167
-      TUWUNEL_LOG: info
-      TUWUNEL_ALLOW_REGISTRATION: "true"
-      TUWUNEL_REGISTRATION_TOKEN: "PSrYqEAJUpsLfsARbJWnMbs9WbxygM79"
-    networks:
-      - matrix-net
-      
+      TUWUNEL_PORT: 6167 # you need to match this with the traefik load balancer label if you're want to change it
+      TUWUNEL_DATABASE_PATH: /var/lib/tuwunel
+      #TUWUNEL_CONFIG: '/etc/conduit.toml' # Uncomment if you mapped config toml above
+      ### Uncomment and change values as desired, note that tuwunel has plenty of config options, so you should check out the example example config too
+      # Available levels are: error, warn, info, debug, trace - more info at: https://docs.rs/env_logger/*/env_logger/#enabling-logging
+      # TUWUNEL_LOG: info  # default is: "warn,state_res=warn"
+      # TUWUNEL_ALLOW_ENCRYPTION: 'true'
+      # TUWUNEL_ALLOW_FEDERATION: 'true'
+      # TUWUNEL_ALLOW_INCOMING_PRESENCE: true
+      # TUWUNEL_ALLOW_OUTGOING_PRESENCE: true
+      # TUWUNEL_ALLOW_LOCAL_PRESENCE: true
+      # TUWUNEL_WORKERS: 10
+      # TUWUNEL_MAX_REQUEST_SIZE: 20000000  # in bytes, ~20 MB
+      # TUWUNEL_NEW_USER_DISPLAYNAME_SUFFIX = "🏳<200d>⚧"
+
+      # We need some way to serve the client and server .well-known json. The simplest way is via the TUWUNEL_WELL_KNOWN
+      # variable / config option, there are multiple ways to do this, e.g. in the tuwunel.toml file, and in a separate
+      # reverse proxy, but since you do not have a reverse proxy and following this guide, this example is included
+      TUWUNEL_WELL_KNOWN: |
+        {
+          client=https://docker-synapse.minervajuppiter.net,
+          server=docker-synapse.minervajuppiter.net:443
+        }
+    #cpuset: "0-4" # Uncomment to limit to specific CPU cores
+    ulimits: # tuwunel uses quite a few file descriptors, and on some systems it defaults to 1024, so you can tell docker to increase it
+      nofile:
+        soft: 1048567
+        hard: 1048567
+
+    ### Uncomment if you want to use your own Element-Web App.
+    ### Note: You need to provide a config.json for Element and you also need a second
+    ###       Domain or Subdomain for the communication between Element and tuwunel
+    ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md
+    # element-web:
+    #     image: vectorim/element-web:latest
+    #     restart: unless-stopped
+    #     volumes:
+    #         - ./element_config.json:/app/config.json
+    #     networks:
+    #         - proxy
+    #     depends_on:
+    #         - homeserver
+        
   watchtower:
     image: nickfedor/watchtower:latest
     restart: unless-stopped
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
 
+  traefik:
+    image: "traefik:latest"
+    container_name: "traefik"
+    restart: "unless-stopped"
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:z"
+      - "acme:/etc/traefik/acme"
+      #- "./traefik_config:/etc/traefik:z"
+    labels:
+      - "traefik.enable=true"
+
+      # middleware redirect
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+      # global redirect to https
+      - "traefik.http.routers.redirs.rule=hostregexp(`{host:.+}`)"
+      - "traefik.http.routers.redirs.entrypoints=web"
+      - "traefik.http.routers.redirs.middlewares=redirect-to-https"
+
+    configs:
+      - source: dynamic.yml
+        target: /etc/traefik/dynamic.yml
+
+    environment:
+      TRAEFIK_LOG_LEVEL: DEBUG
+      TRAEFIK_ENTRYPOINTS_WEB: true
+      TRAEFIK_ENTRYPOINTS_WEB_ADDRESS: ":80"
+      TRAEFIK_ENTRYPOINTS_WEB_HTTP_REDIRECTIONS_ENTRYPOINT_TO: websecure
+
+      TRAEFIK_ENTRYPOINTS_WEBSECURE: true
+      TRAEFIK_ENTRYPOINTS_WEBSECURE_ADDRESS: ":443"
+      TRAEFIK_ENTRYPOINTS_WEBSECURE_HTTP_TLS_CERTRESOLVER: letsencrypt
+      #TRAEFIK_ENTRYPOINTS_WEBSECURE_HTTP_MIDDLEWARES: secureHeaders@file # if you want to enabled STS
+
+      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT: true
+      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL: # Set this to the email you want to receive certificate expiration emails for
+      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_KEYTYPE: EC384
+      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE: true
+      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE_ENTRYPOINT: web
+      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_STORAGE: "/etc/traefik/acme/acme.json"
+
+      TRAEFIK_PROVIDERS_DOCKER: true
+      TRAEFIK_PROVIDERS_DOCKER_ENDPOINT: "unix:///var/run/docker.sock"
+      TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT: false
+
+      TRAEFIK_PROVIDERS_FILE: true
+      TRAEFIK_PROVIDERS_FILE_FILENAME: "/etc/traefik/dynamic.yml"
+
+configs:
+  dynamic.yml:
+    content: |
+      # Optionally set STS headers, like in https://hstspreload.org
+      # http:
+      #   middlewares:
+      #     secureHeaders:
+      #       headers:
+      #         forceSTSHeader: true
+      #         stsIncludeSubdomains: true
+      #         stsPreload: true
+      #         stsSeconds: 31536000
+      tls:
+        options:
+          default:
+            cipherSuites:
+              - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+              - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+              - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+              - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+              - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+              - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+            minVersion: VersionTLS12
+
+volumes:
+    db:
+    acme:
+
 networks:
-  matrix-net:
-    driver: bridge
+    proxy:
+
+# vim: ts=2:sw=2:expandtab