Add docker compose instructions to the docs

[alexjustesen]

I'd add a full docker-compose.yml example to the docs.

Originally posted by @alexdelprete in #54 (comment)

[filcuk]

Coming from #54, I'm sharing my Docker config, which allows Traefik to handle the certificates:

  speedtracker:
    image: ghcr.io/alexjustesen/speedtest-tracker:latest
    container_name: speedtracker
    restart: unless-stopped
    networks:
      - traefik
    volumes:
      - $DOCKERDIR/appdata/speedtracker:/config
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - SSL_MODE=off # Lets Traefik handle TLS
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.speedtracker-rtr.entrypoints=https"
      - "traefik.http.routers.speedtracker-rtr.rule=Host(`speedtracker.$DOMAINNAME0`)"
      - "traefik.http.routers.speedtracker-rtr.middlewares=chain-authelia@file"
      - "traefik.http.routers.speedtracker-rtr.service=speedtracker-svc"
      - "traefik.http.services.speedtracker-svc.loadbalancer.server.port=80"

With this and already running Traefik, it should work out of the box.

[alexdelprete]

I don't agree with this configuration: if you want to have SSL end-to-end, that configuration won't work. Traefik will handle TLS even if the container uses its self-signed certificate.

The default configuration is SSL_MODE=full (end-to-end encryption) and Traefik supports backend services with self-signed certificates. I didn't have to change anything to make it work, in full end-to-end encryption. I think the default is good.

The problem in your setup is that with SSL_MODE=full you can't even access the container directly with the browser, it's not a Traefik issue. So I wouldn't recommend using your specific config as a general example.

[alexdelprete]

BTW: if you use SSL_MODE=off, we're back at the old issue #34 (mixed SSL/non-SSL content) with browsers.

[alexdelprete]

@alexjustesen the best default option is SSL_MODE=mixed. So it's up to the user to choose: if a reverse-proxy is used connections on 443 are allowed, if not, connections on 80 is allowed. Best of all worlds. :)

That's the only warning/tip I would write in the docs.

[alexdelprete]

@alexjustesen regarding the docker-compose and certificate generation, the serversideup docs say this:

So this means that in order to make the certs persistent, that path has to be mounted in docker. This is also needed in case a user wants to use his specific certificates. This should definitely be added to the documentation.

So with this compose file, from the second start you can see from the logs below that certificates are not regenerated.

version: '3.3'
services:
  speedtest-tracker:
    image: ghcr.io/alexjustesen/speedtest-tracker:v0.1.0-alpha.9
    container_name: speedtest-tracker
    restart: unless-stopped
    ports:
      - 8008:443
    environment:
      TZ: Europe/Rome
      PUID: 1000
      PGID: 1000
      DB_CONNECTION: mysql
      DB_HOST: mariadb.axel.dom
      DB_PORT: 3306
      DB_DATABASE: speedtest_tracker
      DB_USERNAME: xxxxxxxxxx
      DB_PASSWORD: yyyyyyyyyy
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - $PWD/config:/config
      - $PWD/certs:/etc/ssl/web

You can see no SSL cert is generated at the beginning because the mounted folder preserved them:

Brought to you by serversideup.net
--------------------------------------------------------------------
To support Server Side Up projects visit:
https://serversideup.net/sponsor
-------------------------------------
GID/UID
-------------------------------------
User uid:    1000
User gid:    1000
-------------------------------------
🔐 SSL_MODE has set to FULL, setting the web server to work in HTTPS only...
🏃‍♂️ Checking for Laravel automations...
🔐 Linking the storage...
   INFO  The [public/storage] link has been connected to [storage/app/public].
🐇  Configuring Speedtest Tracker...
✅  Environment file exists
🔗  Creating symlinks to config and log files
✅  App key exists
🔒  Fixing app path file permissions
💰  Building the cache...
[21-Oct-2022 18:42:24] NOTICE: fpm is running, pid 106
[21-Oct-2022 18:42:24] NOTICE: ready to handle connections
[21-Oct-2022 18:42:24] NOTICE: systemd monitor interval set to 10000ms
🚛  Migrating the database...
✅  All set, starting Speedtest Tracker container...
⏰  Starting the cron service...
💪  Starting the queue worker...
127.0.0.1 - - [21/Oct/2022:18:42:25 +0200] "GET /ping HTTP/1.1" 301 162 "-" "curl/7.81.0"

[duckunix]

Just for completeness, I just got this working with Traefik V1.7.16:

  bandwidth:
    container_name: bandwidth
    hostname: bandwidth.mydomain.org
    image: 'ghcr.io/alexjustesen/speedtest-tracker:latest'
    environment:
      - PGID=${PGID}
      - PUID=${PUID}
      - TZ=${TZ}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - $PWD/bandwidth:/config
      - $PWD/bandwidth/certs:/etc/ssl/web
    restart: unless-stopped
    networks:
      proxy:
    labels:
      - "traefik.enable=true"
      - "traefik.frontend.headers.customResponseHeaders=X-Robots-Tag: noindex, nofollow"
      - "traefik.port=443"
      - "traefik.protocol=https"
      - "traefik.frontend.rule=Host:bandwidth.mydomain.org"
      - "traefik.docker.network=proxy"