Kangie , 10 months ago

Here’s the secret to stuff like this:

Run a single reverse proxy / edge router for all of your containerised services.

I recommend Traefik - gitlab.com/…/traefik-grafana-prometheus-docker

You can configure services with labels attached to the container and (almost) never expose ports directly. It also lets you host an arbitrary number of services listening on 80/443.

An example config might look like this:

<span style="color:#323232;"># docker-compose.yml
</span><span style="color:#323232;">version: '3.9'
</span><span style="color:#323232;">
</span><span style="color:#323232;">services:
</span><span style="color:#323232;">  bitwarden:
</span><span style="color:#323232;">    image: vaultwarden/server:latest
</span><span style="color:#323232;">    restart: always
</span><span style="color:#323232;">    volumes:
</span><span style="color:#323232;">      - /data/vaultwarden/:/data
</span><span style="color:#323232;">    environment:
</span><span style="color:#323232;">#      - ADMIN_TOKEN=
</span><span style="color:#323232;">      - WEBSOCKET_ENABLED=true
</span><span style="color:#323232;">    networks:
</span><span style="color:#323232;">      - proxy
</span><span style="color:#323232;">    labels:
</span><span style="color:#323232;">      - traefik.enable=true
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-ui-https.tls.certresolver=letsencrypt
</span><span style="color:#323232;">      - traefik.http.middlewares.redirect-https.redirectScheme.scheme=https
</span><span style="color:#323232;">      - traefik.http.middlewares.redirect-https.redirectScheme.permanent=true
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-ui-https.rule=Host(`my.domain.com`)
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-ui-https.entrypoints=websecure
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-ui-https.tls=true
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-ui-https.service=bitwarden-ui
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-ui-http.rule=Host(`my.domain.com`)
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-ui-http.entrypoints=web
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-ui-http.middlewares=redirect-https
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-ui-http.service=bitwarden-ui
</span><span style="color:#323232;">      - traefik.http.services.bitwarden-ui.loadbalancer.server.port=80
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-websocket-https.rule=Host(`my.domain.com) &amp;&amp; Path(`/notifications/hub`)
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-websocket-https.entrypoints=websecure
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-websocket-https.tls=true
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-websocket-https.service=bitwarden-websocket
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-websocket-http.rule=Host(`my.domain.com`) &amp;&amp; Path(`/notifications/hub`)
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-websocket-http.entrypoints=web
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-websocket-http.middlewares=redirect-https
</span><span style="color:#323232;">      - traefik.http.routers.bitwarden-websocket-http.service=bitwarden-websocket
</span><span style="color:#323232;">      - traefik.http.services.bitwarden-websocket.loadbalancer.server.port=3012
</span>