pipistrelloandClaude Opus 4.8
1d6be15448
Static instructions site for client 05 served at help.osk.team. Markdown + images built by Zensical (zensical build) into public/, served by nginx behind Traefik. Content is bind-mounted from /mnt/containers/help-osk-docs (absolute host path — Portainer GitOps can't resolve relative mounts). Adds the help/help-osk router+service to traefik/dynamic/web.yml (TLS via Let's Encrypt, public/open). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
65 lines
2.0 KiB
YAML
65 lines
2.0 KiB
YAML
# HTTP routers for the web dashboards — Traefik TERMINATES TLS here and
|
|
# auto-issues Let's Encrypt certs (resolver "le"). These hosts have no
|
|
# Windows-Integrated auth, so termination is fine.
|
|
#
|
|
# ACME http-01 requires each Host below to be publicly resolvable and reachable
|
|
# on :80 through the edge. For internal-only dashboards, use a dnsChallenge or a
|
|
# default cert instead (see traefik.yml).
|
|
|
|
http:
|
|
routers:
|
|
flame:
|
|
entryPoints: ["websecure"]
|
|
rule: "Host(`start.osk.team`)"
|
|
service: flame
|
|
tls:
|
|
certResolver: le
|
|
|
|
help: # client 05 instructions site (public, open)
|
|
entryPoints: ["websecure"]
|
|
rule: "Host(`help.osk.team`)"
|
|
service: help-osk
|
|
tls:
|
|
certResolver: le
|
|
|
|
portainer:
|
|
entryPoints: ["websecure"]
|
|
rule: "Host(`portainer.osk.team`)"
|
|
service: portainer
|
|
tls:
|
|
certResolver: le
|
|
|
|
traefik-dashboard:
|
|
entryPoints: ["websecure"]
|
|
rule: "Host(`traefik.osk.team`)"
|
|
service: api@internal
|
|
middlewares: ["dash-auth"]
|
|
tls:
|
|
certResolver: le
|
|
|
|
services:
|
|
flame:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://flame:5005"
|
|
help-osk:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://help-osk:80" # nginx container on reverseproxy-nw
|
|
portainer:
|
|
# Portainer must share a network with Traefik. Either add the portainer
|
|
# container to reverseproxy-nw, or point this at the host IP instead:
|
|
# - url: "https://192.168.0.8:9443" (+ serversTransport insecureSkipVerify)
|
|
loadBalancer:
|
|
serversTransport: insecure
|
|
servers:
|
|
- url: "https://192.168.0.8:9443"
|
|
|
|
middlewares:
|
|
dash-auth:
|
|
basicAuth:
|
|
# Generate: htpasswd -nbB admin 'yourpassword' (escape $ as $$ only in
|
|
# docker-compose labels — in this YAML file use the raw single-$ hash).
|
|
users:
|
|
- "admin:$2y$05$HjhBPjFYOxYTWS37DScedenZRiRZ.qbxMsf10XQVujzCljE9VbQfG"
|