Add reverse proxy SSL guides for Caddy, Nginx, and Traefik.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-29 03:55:37 +03:00
parent b1e31430b5
commit 93bbbf8ce8
12 changed files with 434 additions and 1 deletions
@@ -0,0 +1,62 @@
+# Пример: Traefik v3 + Let's Encrypt (HTTP challenge)
+#
+# Запуск:
+#   docker compose -f docker-compose.yml -f deploy/traefik/docker-compose.traefik.yml up -d --build
+#
+# В .env обязательны:
+#   DOMAIN=panel.example.com
+#   ACME_EMAIL=admin@example.com
+#
+# Если используете Dokploy — у него уже есть Traefik.
+# Тогда НЕ поднимайте этот compose, а только повесьте labels на сервис app
+# (см. labels.example.yml / README).
+
+services:
+  traefik:
+    image: traefik:v3.3
+    container_name: vpn-panel-traefik
+    restart: unless-stopped
+    command:
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --providers.docker.network=vpn-panel-net
+      - --entrypoints.web.address=:80
+      - --entrypoints.websecure.address=:443
+      - --entrypoints.web.http.redirections.entrypoint.to=websecure
+      - --entrypoints.web.http.redirections.entrypoint.scheme=https
+      - --certificatesresolvers.le.acme.httpchallenge=true
+      - --certificatesresolvers.le.acme.httpchallenge.entrypoint=web
+      - --certificatesresolvers.le.acme.email=${ACME_EMAIL:-admin@example.com}
+      - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
+      - --api.dashboard=false
+      - --log.level=INFO
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - traefik_letsencrypt:/letsencrypt
+    networks:
+      - vpn-net
+
+  app:
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=vpn-panel-net
+      - traefik.http.routers.vpn-panel.rule=Host(`${DOMAIN:-panel.example.com}`)
+      - traefik.http.routers.vpn-panel.entrypoints=websecure
+      - traefik.http.routers.vpn-panel.tls=true
+      - traefik.http.routers.vpn-panel.tls.certresolver=le
+      - traefik.http.services.vpn-panel.loadbalancer.server.port=8080
+      - traefik.http.middlewares.vpn-panel-headers.headers.stsSeconds=31536000
+      - traefik.http.middlewares.vpn-panel-headers.headers.stsIncludeSubdomains=true
+      - traefik.http.middlewares.vpn-panel-headers.headers.contentTypeNosniff=true
+      - traefik.http.middlewares.vpn-panel-headers.headers.frameDeny=true
+      - traefik.http.routers.vpn-panel.middlewares=vpn-panel-headers
+
+volumes:
+  traefik_letsencrypt:
+
+networks:
+  vpn-net:
+    name: vpn-panel-net