Robert Syrnicki
3a9d18fcd5
wg-easy + Traefik docker-compose stack (Phase 1) plus a stdlib-only control-plane API for box registration, WireGuard peer provisioning via wg-easy, and per-box route publish/unpublish backed by Traefik's file provider (Phase 2, single-tenant mode). SQLite holds accounts/boxes/routes so a later multi-tenant shared instance is the same schema with more rows, not a reshape. wg-easy's actual REST API was verified against its source rather than assumed: it has no bearer-token auth (session-cookie login via POST /api/auth/password) and no way to accept an externally-generated public key (it always mints the keypair itself, private key included) — both corrected from the original plan during implementation.
34 lines
718 B
YAML
34 lines
718 B
YAML
# Single-tenant mode: one operator's own domain, HTTP-01 challenge per
|
|
# subdomain. Fine at self-hosted scale — nowhere near Let's Encrypt's
|
|
# ~50-certs/registered-domain/week limit with a handful of published apps.
|
|
|
|
entryPoints:
|
|
web:
|
|
address: ":80"
|
|
http:
|
|
redirections:
|
|
entryPoint:
|
|
to: websecure
|
|
scheme: https
|
|
websecure:
|
|
address: ":443"
|
|
|
|
providers:
|
|
file:
|
|
directory: /etc/traefik/dynamic
|
|
watch: true
|
|
|
|
certificatesResolvers:
|
|
le:
|
|
acme:
|
|
email: admin@example.com # overridden per-deployment; see ops/deploy.sh
|
|
storage: /acme/acme.json
|
|
httpChallenge:
|
|
entryPoint: web
|
|
|
|
api:
|
|
dashboard: false
|
|
insecure: false
|
|
|
|
log:
|
|
level: INFO
|