Traefik - Wireguad

Traefik is an open source reverse proxy server. Wireguard is the best VPN server i've tried

Docker Compose

version: "3.6"
services:
  traefik-wg-server:
    image: "subekti13/traefik-wg:latest"
    container_name: "traefik-wireguard"
    devices:
      - "/dev/net/tun:/dev/net/tun"
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - CLOUDFLARE_EMAIL=hall.frank53@yahoo.com
      - WIREGUARD=1
      - WG_HOST=103.187.146.29
      - PASSWORD=pppp
      - WG_DEFAULT_ADDRESS=10.8.0.x
      - WG_PERSISTENT_KEEPALIVE=25
      - CLOUDFLARE_API_KEY=0bc3ebc70c2a2ee8d5a1a78d9e05d4306cb85
      - DEBUG=Server,WireGuard
    networks:
      - "proxy"
    ports:
      - "443:443/tcp"
      - "51820:51820/udp"
      - "80:80/tcp"
    restart: "unless-stopped"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/docker-data/traefik-server/acme.json:/acme.json"
      - "/docker-data/traefik-server/traefik.toml:/traefik.toml"
      - "/docker-data/traefik-server/configs:/configs"
      - "/docker-data/traefik-server/wg:/etc/wireguard"
networks:
  proxy:
    external: true
    name: "proxy"

Required Files

acme.json

path: /docker-data/traefik-server/acme.json

create empty files

traefik.toml

path: /docker-data/traefik-server/traefik.toml

[api]
dashboard = true

[entryPoints.web]
address = ":80"

[entryPoints.web.http.redirections.entryPoint]
to = "websecure"

[entryPoints.websecure]
address = ":443"

  [entryPoints.websecure.http]
  middlewares = [ "secureHeaders@file" ]

    [entryPoints.websecure.http.tls]
    certResolver = "letsencrypt-cloudflare"

[providers.docker]
endpoint = "unix:///var/run/docker.sock"
exposedByDefault = false

[providers.file]
filename = "/configs/traefik_dynamic.toml"

[certificatesResolvers.letsencrypt-cloudflare.acme]
email = "ghost.of.inu@gmail.com"
storage = "acme.json"
keyType = "EC384"

  [certificatesResolvers.letsencrypt-cloudflare.acme.dnsChallenge]
  provider = "cloudflare"

traefik_dynamic.toml

path: /docker-data/traefik-server/configs/traefik_dynamic.toml

[http.middlewares.secureHeaders.headers]
sslRedirect = true
forceSTSHeader = true
stsIncludeSubdomains = true
stsPreload = true
stsSeconds = 31_536_000

[tls.options.default]
cipherSuites = [
  "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
  "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
  "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
  "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
  "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
  "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
]
minVersion = "VersionTLS12"

[http.middlewares.user-auth.basicAuth]
users = [ "urip:$apr1$k56gb9yi$lwGzQbBu93S6nL6cd693m." ]

# Dynamic Routes

[http.routers.traefik]
service = "api@internal"
rule = "Host(`traefik.uripsub.dev`)"
middlewares = "user-auth@file" 
entrypoints = "websecure"

[http.routers.wg]
service = "wg-service"
rule = "Host(`wg.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.wg-service.loadBalancer.servers]]
url = "http://traefik-wg-server:51821/"

[http.routers.portainer]
service = "portainer-service"
rule = "Host(`portainer.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.portainer-service.loadBalancer.servers]]
url = "http://103.150.197.128:9000/"

[http.routers.bookmark]
service = "bookmark-service"
rule = "Host(`bm.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.bookmark-service.loadBalancer.servers]]
url = "http://bookmark:2000/"

[http.routers.file]
service = "file-service"
rule = "Host(`file.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.file-service.loadBalancer.servers]]
url = "http://filebrowser:80/"

[http.routers.bitwarden]
service = "bitwarden-service"
rule = "Host(`bw.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.bitwarden-service.loadBalancer.servers]]
url = "http://bitwardenrs:80/"

[http.routers.drive-stream]
service = "drive-stream"
rule = "Host(`drive-stream.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.drive-stream.loadBalancer.servers]]
url = "http://drive-stream-service:3001/"

# [http.routers.blog]
# service = "blog-service"
# rule = "Host(`blog.uripsub.dev`)"
# entrypoints = "websecure"
# [[http.services.blog-service.loadBalancer.servers]]
# url = "http://blog:2368/"

# [http.routers.konga]
# service = "konga-service"
# rule = "Host(`konga.uripsub.dev`)"
# entrypoints = "websecure"
# [[http.services.konga-service.loadBalancer.servers]]
# url = "http://10.8.0.2:7337/"


# [http.routers.kong]
# service = "kong-service"
# rule = "Host(`api.uripsub.dev`)"
# entrypoints = "websecure"
# [[http.services.kong-service.loadBalancer.servers]]
# url = "http://10.8.0.2:7000/"

#######################################
###                                 ###
###           LOCAL SERVER          ###
###                                 ###
#######################################

[http.routers.local-file]
service = "local-file-service"
rule = "Host(`file.local.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.local-file-service.loadBalancer.servers]]
url = "http://10.8.0.2:83/"

[http.routers.local-blog]
service = "local-blog-service"
rule = "Host(`blog.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.local-blog-service.loadBalancer.servers]]
url = "http://10.8.0.2:3011/"

[http.routers.local-portainer]
service = "local-portainer-service"
rule = "Host(`portainer.local.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.local-portainer-service.loadBalancer.servers]]
url = "http://10.8.0.2:9000/"

[http.routers.local-wa]
service = "local-wa-service"
rule = "Host(`wa.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.local-wa-service.loadBalancer.servers]]
url = "http://10.8.0.2:30/"

[http.routers.tasks]
service = "tasks-service"
rule = "Host(`tasks.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.tasks-service.loadBalancer.servers]]
url = "http://10.8.0.2:88/"

[http.routers.delegeasi-nest]
service = "delegasi-nest-service"
rule = "Host(`ops-delegasi.local.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.delegasi-nest-service.loadBalancer.servers]]
url = "http://10.8.0.2:89/"

[http.routers.local-nginx-test]
service = "local-nginx-test"
rule = "Host(`nginx-test.local.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.local-nginx-test.loadBalancer.servers]]
url = "http://10.8.0.2:8000/"

[http.routers.droppy]
service = "droppy"
rule = "Host(`droppy.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.droppy.loadBalancer.servers]]
url = "http://10.8.0.2:8989/"

[http.routers.cv]
service = "cv"
rule = "Host(`cv.uripsub.dev`)"
entrypoints = "websecure"
[[http.services.cv.loadBalancer.servers]]
url = "http://10.8.0.2:8001/"