From 5a3c073def176fd741d6935e724468fc91bdad3e Mon Sep 17 00:00:00 2001
From: Felix Ableitner <me@nutomic.com>
Date: Mon, 11 Mar 2019 15:28:12 +0100
Subject: [PATCH] Initial commit with config for testing.peertube.social

---
 .env                | 17 ++++++++++
 .gitignore          |  1 +
 docker-compose.yaml | 64 ++++++++++++++++++++++++++++++++++++++
 traefik.toml        | 75 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 157 insertions(+)
 create mode 100644 .env
 create mode 100644 .gitignore
 create mode 100644 docker-compose.yaml
 create mode 100644 traefik.toml

diff --git a/.env b/.env
new file mode 100644
index 0000000..4be50bd
--- /dev/null
+++ b/.env
@@ -0,0 +1,17 @@
+PEERTUBE_DB_USERNAME=peertube
+PEERTUBE_DB_PASSWORD=WBUe8qGIIQFUIkcg
+PEERTUBE_WEBSERVER_HOSTNAME=testing.peertube.social
+PEERTUBE_WEBSERVER_PORT=443
+PEERTUBE_WEBSERVER_HTTPS=true
+PEERTUBE_TRUST_PROXY=["127.0.0.1"]
+# If you need more than one IP as trust_proxy
+# pass them as a comma separated array:
+#PEERTUBE_TRUST_PROXY=["127.0.0.1", "loopback", "192.168.1.0/24"]
+#PEERTUBE_SMTP_USERNAME=
+#PEERTUBE_SMTP_PASSWORD=
+PEERTUBE_SMTP_HOSTNAME=postfix
+PEERTUBE_SMTP_PORT=25
+PEERTUBE_SMTP_FROM=info@testing.peertube.social
+PEERTUBE_SMTP_TLS=false
+#PEERTUBE_SMTP_DISABLE_STARTTLS=false
+PEERTUBE_ADMIN_EMAIL=info@testing.peertube.social
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..1e14d28
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+docker-volume/
diff --git a/docker-compose.yaml b/docker-compose.yaml
new file mode 100644
index 0000000..d9594a2
--- /dev/null
+++ b/docker-compose.yaml
@@ -0,0 +1,64 @@
+version: "3.3"
+
+services:
+
+  traefik:
+    image: traefik:1.7-alpine
+    command: --docker # Tells Træfik to listen to docker
+    ports:
+      - "80:80"     # The HTTP port
+      - "443:443"   # The HTTPS port
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
+      - ./docker-volume/traefik/acme.json:/etc/acme.json
+      - ./traefik.toml:/traefik.toml
+    restart: "always"
+    # If you want to use the Traefik dashboard, you should expose it on a 
+    # subdomain with HTTPS and authentification:
+    # https://medium.com/@xavier.priour/secure-traefik-dashboard-with-https-and-password-in-docker-5b657e2aa15f
+    # https://github.com/containous/traefik/issues/880#issuecomment-310301168
+
+  peertube:
+    image: chocobozzz/peertube:v1.2.1-stretch
+    env_file:
+      - .env
+    labels:
+      traefik.enable: "true"
+      traefik.frontend.rule: "Host:${PEERTUBE_WEBSERVER_HOSTNAME}"
+      traefik.port: "9000"
+    volumes:
+      - ./docker-volume/data:/data
+      - ./docker-volume/config:/config
+    depends_on:
+      - postgres
+      - redis
+      - postfix
+    restart: "always"
+
+  postgres:
+    image: postgres:10-alpine
+    environment:
+      POSTGRES_USER: ${PEERTUBE_DB_USERNAME}
+      POSTGRES_PASSWORD: ${PEERTUBE_DB_PASSWORD}
+      POSTGRES_DB: peertube
+    volumes:
+      - ./docker-volume/db:/var/lib/postgresql/data
+    restart: "always"
+    labels:
+      traefik.enable: "false"
+
+  redis:
+    image: redis:5-alpine
+    volumes:
+      - ./docker-volume/redis:/data
+    restart: "always"
+    labels:
+      - "traefik.enable=false"
+
+  postfix:
+    image: mwader/postfix-relay
+    environment:
+      - POSTFIX_myhostname=${PEERTUBE_WEBSERVER_HOSTNAME}
+    labels:
+      traefik.enable: "false"
+    restart: "always"
diff --git a/traefik.toml b/traefik.toml
new file mode 100644
index 0000000..ffcac5e
--- /dev/null
+++ b/traefik.toml
@@ -0,0 +1,75 @@
+# Uncomment this line in order to enable debugging through logs
+# debug = true
+defaultEntryPoints = ["http", "https"]
+
+[entryPoints]
+  [entryPoints.http]
+  address = ":80"
+    [entryPoints.http.redirect]
+    entryPoint = "https"
+  [entryPoints.https]
+  address = ":443"
+    [entryPoints.https.tls]
+    MinVersion = "VersionTLS12"
+    CurvePreferences = [
+      "CurveP521",
+      "CurveP384",
+      "CurveP256"
+    ]
+    PreferServerCipherSuites = true
+    CipherSuites = [
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+      "TLS_RSA_WITH_AES_256_GCM_SHA384",
+      "TLS_RSA_WITH_AES_256_CBC_SHA"
+    ]
+    FrameDeny = false # here we don't want to deny frames since we have an embed
+    STSIncludeSubdomains = true
+    STSSeconds = 315360000
+    STSPreload = true
+    ContentTypeNosniff = true
+    BrowserXssFilter = true
+
+
+# Enable ACME (Let's Encrypt): automatic SSL.
+[acme]
+
+# Email address used for registration.
+#
+# Required
+#
+email = "me@nutomic.com"
+
+# File or key used for certificates storage.
+#
+# Required
+#
+storage = "/etc/acme.json"
+# or `storage = "traefik/acme/account"` if using KV store.
+
+# Entrypoint to proxy acme apply certificates to.
+# WARNING, if the TLS-SNI-01 challenge is used, it must point to an entrypoint on port 443
+#
+# Required
+#
+entryPoint = "https"
+
+# Domains list.
+#
+[[acme.domains]]
+  main = "testing.peertube.social"
+
+# Use a HTTP-01 acme challenge rather than TLS-SNI-01 challenge
+#
+# Optional but recommend
+#
+[acme.httpChallenge]
+
+  # EntryPoint to use for the challenges.
+  #
+  # Required
+  #
+  entryPoint = "http"