traefik.yaml

api:
  dashboard: true
  insecure: true
# Log level INFO|DEBUG|ERROR
log:
  level: INFO
#Enable write to log:
accessLog:
  filePath: "/etc/traefik/access.log"
global:
  checkNewVersion: true
  sendAnonymousUsage: true
serversTransport:
  insecureSkipVerify: true
entryPoints:
  # Not used in apps, but redirect everything from HTTP to HTTPS
  http:
    address: :80

  # HTTPS endpoint, with domain wildcard
  https:
    address: :443
    forwardedHeaders:
      # Reuse list of Cloudflare Trusted IP's above for HTTPS requests
      trustedIPs: &trustedIps
        <bunch of CF-IPs>
        # End of Cloudlare public IP list
    http:
      tls:
        # Generate a wildcard domain certificate
        certResolver: letsencrypt
        domains:
          - main: domain.de
            sans:
              - '*.domain.de'
      middlewares:
        - securityHeaders@file
        - auth@file    #Authelia
#==================================================================================================#
providers:
  providersThrottleDuration: 2s
  # File provider for connecting things that are outside of docker / defining middleware
  file:
    filename: /etc/traefik/fileConfig.yml
    watch: true
  # Docker provider for connecting all apps that are inside of the docker network
  docker:
    watch: true
    network: proxy
    # Default host rule to containername.domain.example
    #defaultRule: "Host(`{{ index .Labels \"com.docker.compose.service\"}}.domain.de`)" #Auskommentiert -> Mach es selbst!
    swarmModeRefreshSeconds: 15s
    exposedByDefault: false
#==================================================================================================#
# Use letsencrypt to generate ssl serficiates
certificatesResolvers:
  letsencrypt:
    acme:
      email: [email protected]
      storage: /etc/traefik/acme.json
      dnsChallenge:
        provider: cloudflare
        #CF_API_KEY: <token>
        #Used to make sure the dns challenge is propagated to the rights dns servers
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"
#==================================================================================================#
tls:
  options:
    # To use with the label "traefik.http.routers.myrouter.tls.options=modern@file"
    modern:
      minVersion: "VersionTLS13"                          # Minimum TLS Version
      sniStrict: true                                     # Strict SNI Checking
    default:
      cipherSuites:
        - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
        - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
        - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
        - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
        - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"
        - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
      minVersion: "VersionTLS12"                          # Minimum TLS Version
      sniStrict: true                                     # Strict SNI Checking