docker-compose.yaml (6238B)
1 # tuwunel - Behind Traefik Reverse Proxy 2 3 services: 4 homeserver: 5 ### If you already built the tuwunel image with 'docker build' or want to use the Docker Hub image, 6 ### then you are ready to go. 7 image: ghcr.io/matrix-construct/tuwunel:latest 8 restart: unless-stopped 9 volumes: 10 - db:/var/lib/tuwunel 11 #- ./tuwunel.toml:/etc/tuwunel.toml 12 networks: 13 - proxy 14 environment: 15 TUWUNEL_SERVER_NAME: docker-synapse.minervajuppiter.net # EDIT THIS 16 TUWUNEL_TRUSTED_SERVERS: '["matrix.org"]' 17 TUWUNEL_ALLOW_REGISTRATION: 'true' # After setting a secure registration token, you can enable this 18 TUWUNEL_REGISTRATION_TOKEN: "PSrYqEAJUpsLfsARbJWnMbs9WbxygM79" # This is a token you can use to register on the server 19 #TUWUNEL_REGISTRATION_TOKEN_FILE: "" # Alternatively you can configure a path to a token file to read 20 TUWUNEL_ADDRESS: 0.0.0.0 21 TUWUNEL_PORT: 6167 # you need to match this with the traefik load balancer label if you're want to change it 22 TUWUNEL_DATABASE_PATH: /var/lib/tuwunel 23 #TUWUNEL_CONFIG: '/etc/conduit.toml' # Uncomment if you mapped config toml above 24 ### Uncomment and change values as desired, note that tuwunel has plenty of config options, so you should check out the example example config too 25 # Available levels are: error, warn, info, debug, trace - more info at: https://docs.rs/env_logger/*/env_logger/#enabling-logging 26 # TUWUNEL_LOG: info # default is: "warn,state_res=warn" 27 # TUWUNEL_ALLOW_ENCRYPTION: 'true' 28 # TUWUNEL_ALLOW_FEDERATION: 'true' 29 # TUWUNEL_ALLOW_INCOMING_PRESENCE: true 30 # TUWUNEL_ALLOW_OUTGOING_PRESENCE: true 31 # TUWUNEL_ALLOW_LOCAL_PRESENCE: true 32 # TUWUNEL_WORKERS: 10 33 # TUWUNEL_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB 34 # TUWUNEL_NEW_USER_DISPLAYNAME_SUFFIX = "🏳<200d>⚧" 35 36 # We need some way to serve the client and server .well-known json. The simplest way is via the TUWUNEL_WELL_KNOWN 37 # variable / config option, there are multiple ways to do this, e.g. in the tuwunel.toml file, and in a separate 38 # reverse proxy, but since you do not have a reverse proxy and following this guide, this example is included 39 TUWUNEL_WELL_KNOWN: | 40 { 41 client=https://docker-synapse.minervajuppiter.net, 42 server=docker-synapse.minervajuppiter.net:443 43 } 44 #cpuset: "0-4" # Uncomment to limit to specific CPU cores 45 ulimits: # tuwunel uses quite a few file descriptors, and on some systems it defaults to 1024, so you can tell docker to increase it 46 nofile: 47 soft: 1048567 48 hard: 1048567 49 50 ### Uncomment if you want to use your own Element-Web App. 51 ### Note: You need to provide a config.json for Element and you also need a second 52 ### Domain or Subdomain for the communication between Element and tuwunel 53 ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md 54 # element-web: 55 # image: vectorim/element-web:latest 56 # restart: unless-stopped 57 # volumes: 58 # - ./element_config.json:/app/config.json 59 # networks: 60 # - proxy 61 # depends_on: 62 # - homeserver 63 watchtower: 64 image: nickfedor/watchtower:latest 65 restart: unless-stopped 66 volumes: 67 - /var/run/docker.sock:/var/run/docker.sock 68 69 traefik: 70 image: "traefik:latest" 71 container_name: "traefik" 72 restart: "unless-stopped" 73 ports: 74 - "80:80" 75 - "443:443" 76 volumes: 77 - "/var/run/docker.sock:/var/run/docker.sock:z" 78 - "acme:/etc/traefik/acme" 79 #- "./traefik_config:/etc/traefik:z" 80 labels: 81 - "traefik.enable=true" 82 83 # middleware redirect 84 - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https" 85 # global redirect to https 86 - "traefik.http.routers.redirs.rule=hostregexp(`{host:.+}`)" 87 - "traefik.http.routers.redirs.entrypoints=web" 88 - "traefik.http.routers.redirs.middlewares=redirect-to-https" 89 90 configs: 91 - source: dynamic.yml 92 target: /etc/traefik/dynamic.yml 93 94 environment: 95 TRAEFIK_LOG_LEVEL: DEBUG 96 TRAEFIK_ENTRYPOINTS_WEB: true 97 TRAEFIK_ENTRYPOINTS_WEB_ADDRESS: ":80" 98 TRAEFIK_ENTRYPOINTS_WEB_HTTP_REDIRECTIONS_ENTRYPOINT_TO: websecure 99 100 TRAEFIK_ENTRYPOINTS_WEBSECURE: true 101 TRAEFIK_ENTRYPOINTS_WEBSECURE_ADDRESS: ":443" 102 TRAEFIK_ENTRYPOINTS_WEBSECURE_HTTP_TLS_CERTRESOLVER: letsencrypt 103 #TRAEFIK_ENTRYPOINTS_WEBSECURE_HTTP_MIDDLEWARES: secureHeaders@file # if you want to enabled STS 104 105 TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT: true 106 TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL: # Set this to the email you want to receive certificate expiration emails for 107 TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_KEYTYPE: EC384 108 TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE: true 109 TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE_ENTRYPOINT: web 110 TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_STORAGE: "/etc/traefik/acme/acme.json" 111 112 TRAEFIK_PROVIDERS_DOCKER: true 113 TRAEFIK_PROVIDERS_DOCKER_ENDPOINT: "unix:///var/run/docker.sock" 114 TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT: false 115 116 TRAEFIK_PROVIDERS_FILE: true 117 TRAEFIK_PROVIDERS_FILE_FILENAME: "/etc/traefik/dynamic.yml" 118 119 configs: 120 dynamic.yml: 121 content: | 122 # Optionally set STS headers, like in https://hstspreload.org 123 # http: 124 # middlewares: 125 # secureHeaders: 126 # headers: 127 # forceSTSHeader: true 128 # stsIncludeSubdomains: true 129 # stsPreload: true 130 # stsSeconds: 31536000 131 tls: 132 options: 133 default: 134 cipherSuites: 135 - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 136 - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 137 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 138 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 139 - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 140 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 141 minVersion: VersionTLS12 142 143 volumes: 144 db: 145 acme: 146 147 networks: 148 proxy: 149 150 # vim: ts=2:sw=2:expandtab