josedario87
850830a766
All checks were successful
deploy-meshcentral / deploy (push) Successful in 12s
- Remover REVERSE_PROXY y REVERSE_PROXY_TLS_PORT que sobrescribían config.json - MeshCentral ahora usará tlsPort: 443 definido en config.json - Esto permite que el TCP passthrough funcione correctamente
96 lines
4.4 KiB
YAML
96 lines
4.4 KiB
YAML
version: '3.8'
|
|
|
|
services:
|
|
meshcentral:
|
|
image: ghcr.io/ylianst/meshcentral:latest
|
|
container_name: ${APP_NAME:-meshcentral}
|
|
restart: unless-stopped
|
|
volumes:
|
|
- /srv/meshcentral/data:/opt/meshcentral/meshcentral-data
|
|
- /srv/meshcentral/files:/opt/meshcentral/meshcentral-files
|
|
- /srv/meshcentral/backup:/opt/meshcentral/meshcentral-backup
|
|
- /srv/meshcentral/config:/opt/meshcentral/meshcentral-config
|
|
environment:
|
|
- HOSTNAME=${APP_DOMAIN}
|
|
# REVERSE_PROXY removido - usamos config.json para configuración de puertos
|
|
- IFRAME=false
|
|
- ALLOWLOGINTOKEN=true
|
|
- LOCALSESSIONRECORDING=false
|
|
- MINIFY=true
|
|
- WEBRTC=true
|
|
- CLICKONCE=false
|
|
- ALLOWHIGHQUALITYDESKTOP=true
|
|
- DESKTOPASPECTRATIOS=1.33,1.5,1.6,1.7,1.778,2.0
|
|
- ALLOWFRAMING=false
|
|
- COOKIEENCODING=hex
|
|
- SESSIONRECORDINGCHUNKSIZE=1000000
|
|
ulimits:
|
|
nofile:
|
|
soft: 65536
|
|
hard: 65536
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=1
|
|
- net.ipv6.conf.default.disable_ipv6=1
|
|
dns_opt:
|
|
- use-vc
|
|
- ndots:1
|
|
extra_hosts:
|
|
- "authentik.nucleoriofrio.com:172.19.0.6"
|
|
networks:
|
|
- principal
|
|
- traefik-network
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=principal"
|
|
|
|
# ======================================================================
|
|
# HTTP Services & Routers - Para Web UI de usuarios
|
|
# ======================================================================
|
|
|
|
# Service - Conexión HTTP interna (Traefik maneja HTTPS hacia el exterior)
|
|
- "traefik.http.services.${APP_NAME}.loadbalancer.server.port=81"
|
|
|
|
# Router principal con Authentik Forward Auth para rutas de usuario
|
|
- "traefik.http.routers.${APP_NAME}.rule=Host(`${APP_DOMAIN}`) && !PathPrefix(`/agent.ashx`) && !PathPrefix(`/meshrelay.ashx`) && !PathPrefix(`/devicefile.ashx`) && !PathPrefix(`/amtactivate`) && !PathPrefix(`/meshsettings`) && !PathPrefix(`/devicepower.ashx`)"
|
|
- "traefik.http.routers.${APP_NAME}.entrypoints=websecure"
|
|
- "traefik.http.routers.${APP_NAME}.tls=true"
|
|
- "traefik.http.routers.${APP_NAME}.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.${APP_NAME}.service=${APP_NAME}"
|
|
- "traefik.http.routers.${APP_NAME}.priority=100"
|
|
- "traefik.http.routers.${APP_NAME}.middlewares=${APP_NAME}-headers"
|
|
|
|
# Router para agentes (sin autenticación) - mayor prioridad
|
|
- "traefik.http.routers.${APP_NAME}-agents.rule=Host(`${APP_DOMAIN}`) && (PathPrefix(`/agent.ashx`) || PathPrefix(`/meshrelay.ashx`) || PathPrefix(`/devicefile.ashx`) || PathPrefix(`/amtactivate`) || PathPrefix(`/meshsettings`) || PathPrefix(`/devicepower.ashx`))"
|
|
- "traefik.http.routers.${APP_NAME}-agents.entrypoints=websecure"
|
|
- "traefik.http.routers.${APP_NAME}-agents.tls=true"
|
|
- "traefik.http.routers.${APP_NAME}-agents.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.${APP_NAME}-agents.service=${APP_NAME}"
|
|
- "traefik.http.routers.${APP_NAME}-agents.priority=200"
|
|
- "traefik.http.routers.${APP_NAME}-agents.middlewares=${APP_NAME}-headers"
|
|
|
|
# Custom headers middleware
|
|
- "traefik.http.middlewares.${APP_NAME}-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
|
|
- "traefik.http.middlewares.${APP_NAME}-headers.headers.customrequestheaders.X-Forwarded-Host=${APP_DOMAIN}"
|
|
- "traefik.http.middlewares.${APP_NAME}-headers.headers.sslredirect=true"
|
|
|
|
# ======================================================================
|
|
# TCP Router & Service - Para agentes con TCP Passthrough
|
|
# ======================================================================
|
|
# Los agentes se conectarán a mesh-agents.nucleoriofrio.com
|
|
# y verán el certificado SSL de MeshCentral (no el de Traefik)
|
|
|
|
# TCP Router - SNI routing para subdominio de agentes
|
|
- "traefik.tcp.routers.${APP_NAME}-agents-tcp.rule=HostSNI(`${MESH_AGENTS_DOMAIN}`)"
|
|
- "traefik.tcp.routers.${APP_NAME}-agents-tcp.entrypoints=websecure"
|
|
- "traefik.tcp.routers.${APP_NAME}-agents-tcp.tls.passthrough=true"
|
|
- "traefik.tcp.routers.${APP_NAME}-agents-tcp.service=${APP_NAME}-tcp"
|
|
|
|
# TCP Service - Conexión directa al puerto HTTPS de MeshCentral
|
|
- "traefik.tcp.services.${APP_NAME}-tcp.loadbalancer.server.port=443"
|
|
|
|
networks:
|
|
principal:
|
|
external: true
|
|
traefik-network:
|
|
external: true
|