Robert Syrnicki
3a9d18fcd5
wg-easy + Traefik docker-compose stack (Phase 1) plus a stdlib-only control-plane API for box registration, WireGuard peer provisioning via wg-easy, and per-box route publish/unpublish backed by Traefik's file provider (Phase 2, single-tenant mode). SQLite holds accounts/boxes/routes so a later multi-tenant shared instance is the same schema with more rows, not a reshape. wg-easy's actual REST API was verified against its source rather than assumed: it has no bearer-token auth (session-cookie login via POST /api/auth/password) and no way to accept an externally-generated public key (it always mints the keypair itself, private key included) — both corrected from the original plan during implementation.
47 lines
1.4 KiB
YAML
47 lines
1.4 KiB
YAML
# Shared multi-tenant mode: one wildcard cert for *.<GATEWAY_BASE_DOMAIN>,
|
|
# issued once via DNS-01, used as the default cert for every router. This
|
|
# avoids Let's Encrypt's ~50-certs/registered-domain/week limit that
|
|
# per-subdomain HTTP-01 would blow through at real shared-tenant volume.
|
|
#
|
|
# DNS-01 needs a provider. Traefik reads provider credentials from
|
|
# provider-specific env vars (e.g. CF_DNS_API_TOKEN for Cloudflare) passed
|
|
# through to the traefik container — see
|
|
# https://doc.traefik.io/traefik/https/acme/#providers for the full list.
|
|
# `provider:` below is a placeholder; set it to whatever DNS host actually
|
|
# serves GATEWAY_BASE_DOMAIN for the real shared deployment.
|
|
#
|
|
# The wildcard cert itself is requested via a dynamic-config
|
|
# `tls.stores.default.defaultGeneratedCert` entry (traefik/dynamic/), since
|
|
# it needs GATEWAY_BASE_DOMAIN interpolated at deploy time — see
|
|
# ops/deploy.sh.
|
|
|
|
entryPoints:
|
|
web:
|
|
address: ":80"
|
|
http:
|
|
redirections:
|
|
entryPoint:
|
|
to: websecure
|
|
scheme: https
|
|
websecure:
|
|
address: ":443"
|
|
|
|
providers:
|
|
file:
|
|
directory: /etc/traefik/dynamic
|
|
watch: true
|
|
|
|
certificatesResolvers:
|
|
le-dns:
|
|
acme:
|
|
email: admin@example.com # overridden per-deployment; see ops/deploy.sh
|
|
storage: /acme/acme.json
|
|
dnsChallenge:
|
|
provider: cloudflare # placeholder — set to the real deployment's DNS provider
|
|
|
|
api:
|
|
dashboard: false
|
|
insecure: false
|
|
|
|
log:
|
|
level: INFO
|