Hello,
I am completely lost and fighting with this pb for weeks.
I am using Traefik and crowdsec using compose file until I manage to use them on rootless mode.
So new proxmox VM, installation of the docker in rootless mode, it seems to be so fare ok.
~$ docker context show
rootless
theboss@proxmox-ve-node1-serverdockers:~$
Few weeks ago, i have installed Gotify to send me notifications if there is any input from Crowdsec … I was a bit surprised not to have any notification. I checked on the security engine and see that there were 0 alert …
Then I checked the logs’s traefik and saw that it was not normal … Nothing on it when IO was testing with my web site.
My traefik logs today:
2024-05-15T15:59:29+03:00 ERR Plugins are disabled because an error has occurred. error="unable to create plugins client: unable to create directory /plugins-storage/sources: mkdir plugins-storage: read-only file system"
2024-05-15T15:59:29+03:00 INF Starting provider aggregator aggregator.ProviderAggregator
2024-05-15T15:59:29+03:00 INF Starting provider *file.Provider
2024-05-15T15:59:29+03:00 INF Starting provider *traefik.Provider
2024-05-15T15:59:29+03:00 INF Starting provider *acme.ChallengeTLSALPN
2024-05-15T15:59:29+03:00 INF Starting provider *docker.Provider
2024-05-15T15:59:29+03:00 INF Starting provider *acme.Provider
2024-05-15T15:59:29+03:00 INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=dns-cloudflare.acme
The volumes of my traefik compose file
services:
traefik:
image: traefik:v3.0.0
container_name: traefik
restart: unless-stopped
security_opt:
- no-new-privileges:true
read_only: true
mem_limit: 2G
cpus: 0.75
depends_on:
- dockerproxy
networks:
- $MYNET
- socket-t
ports:
- 1180:80
- 11443:443
- 8087:8080
- 1181:1181
- 11444:11444
environment:
CF_API_EMAIL: $EMAIL
CF_DNS_API_TOKEN: $TOKEN
TZ: Europe/Helsinki
GID: ${GID-988}
volumes:
- /etc/localtime:/etc/localtime:ro
- $BASE/logs/crowdsec/:$BASE/logs/crowdsec/
- $BASE/traefik/data/traefik.yml:/traefik.yml:ro
- $BASE/traefik/data/dynamic_conf.yml:/dynamic_conf.yml:ro
- $BASE/letsencrypt:/letsencrypt
labels:
- "traefik.enable=true"
- "traefik.docker.network=$MYNET"
- "traefik.http.routers.traefik.entrypoints=http"
- "traefik.http.routers.traefik.rule=Host(`traefik.$MYDOMAIN`)"
- "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
- "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
- "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
- "traefik.http.routers.traefik-secure.entrypoints=https"
- "traefik.http.routers.traefik-secure.rule=Host(`traefik.$MYDOMAIN`)"
- "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
- "traefik.http.routers.traefik-secure.tls=true"
- "traefik.http.routers.traefik-secure.tls.certresolver=dns-cloudflare"
- "traefik.http.routers.traefik-secure.tls.domains[0].main=$MYDOMAIN"
- "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.$MYDOMAIN"
- "traefik.http.routers.traefik-secure.service=api@internal"
# middlewares
- "traefik.http.middlewares.traefik-auth.basicauth.removeheader=true"
- "traefik.http.middlewares.traefik-auth.basicauth.users=login:xxxxxxxxxxxx"
# middlewares security headers
- "traefik.http.middlewares.security-headers.headers.accesscontrolallowmethods=GET, OPTIONS, PUT"
- "traefik.http.middlewares.security-headers.headers.accesscontrolmaxage=100"
- "traefik.http.middlewares.security-headers.headers.addvaryheader=true"
- "traefik.http.middlewares.security-headers.headers.hostsproxyheaders=X-Forwarded-Host"
- "traefik.http.middlewares.security-headers.headers.sslredirect=true"
- "traefik.http.middlewares.security-headers.headers.sslproxyheaders.X-Forwarded-Proto=https"
- "traefik.http.middlewares.security-headers.headers.stsseconds=63072000"
- "traefik.http.middlewares.security-headers.headers.stsincludesubdomains=true"
- "traefik.http.middlewares.security-headers.headers.stspreload=true"
- "traefik.http.middlewares.security-headers.headers.forcestsheader=true"
- "traefik.http.middlewares.security-headers.headers.framedeny=true"
- "traefik.http.middlewares.security-headers.headers.contenttypenosniff=true"
- "traefik.http.middlewares.security-headers.headers.browserxssfilter=true"
- "traefik.http.middlewares.security-headers.headers.referrerpolicy=same-origin"
- "traefik.http.middlewares.security-headers.headers.featurepolicy=camera 'none'; geolocation 'none'; microphone 'none'; payment 'none'; usb 'none'; vr 'none';"
- "traefik.http.middlewares.security-headers.headers.customresponseheaders.X-Robots-Tag=none,noarchive,nosnippet,notranslate,noimageindex"
dockerproxy:
image: wollomatic/socket-proxy:1.3.1
container_name: t-docker-socket-proxy
command:
- '-loglevel=debug'
- '-allowfrom=0.0.0.0/0'
- '-listenip=0.0.0.0'
- '-allowGET=/v1\..{1,2}/(version|containers/.*|events.*)'
- '-watchdoginterval=3600'
- '-stoponwatchdog'
- '-shutdowngracetime=10'
restart: unless-stopped
read_only: true
mem_limit: 64M
cap_drop:
- ALL
security_opt:
- no-new-privileges
user: 65534:988 # change gid from 998 to the gid of the docker group on your host
volumes:
#- /var/run/docker.sock:/var/run/docker.sock:ro
- /run/user/1000/docker.sock:/var/run/docker.sock:ro
networks:
- socket-t
networks:
mynet:
name: $MYNET
external: true
socket-t:
driver: bridge
internal: true
attachable: false
Thx