vault backup: 2026-01-05 13:03:55

2026-01-05 13:03:55 +08:00
parent 21460fc35d
commit be7c6cdcc9
589 changed files with 396508 additions and 27 deletions
@@ -0,0 +1,94 @@
+
+```
+version: "3.8"
+
+services:
+  squid:
+    image: ubuntu/squid:latest
+    container_name: squid-proxy
+    restart: unless-stopped
+    volumes:
+      - ./config/squid.conf:/etc/squid/squid.conf:ro
+      - squid_cache:/var/spool/squid
+      - squid_logs:/var/log/squid
+    networks:
+      - proxy-net
+      - traefik
+    # 只在本地暴露端口（可选，用于调试）
+    ports:
+    #  - "127.0.0.1:3128:3128"
+    healthcheck:
+      test: ["CMD", "squidclient", "-h", "localhost", "mgr:info", "||", "exit", "1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik"
+      
+      # Squid 管理界面路由
+      #- "traefik.http.routers.squid-mgr.rule=Host(`squid.yourdomain.com`) && PathPrefix(`/squid-internal-mgr`)"
+      #- "traefik.http.routers.squid-mgr.entrypoints=websecure"
+      #- "traefik.http.routers.squid-mgr.tls.certresolver=letsencrypt"
+      #- "traefik.http.routers.squid-mgr.middlewares=squid-auth"
+      #- "traefik.http.services.squid-mgr.loadbalancer.server.port=3128"
+      
+      # Basic Auth 中间件
+      #- "traefik.http.middlewares.squid-auth.basicauth.users=admin:$$apr1$$8EVjn/nj$$GiLUZqcbueTFeD23SuB6x0"
+
+  nghttpx:
+    image: jehrhart/nghttp2docker
+    container_name: nghttpx-proxy
+    restart: unless-stopped
+    volumes:
+      - ./config/nghttpx.conf:/nghttpx/nghttpx.conf:ro
+    command: nghttpx --conf /nghttpx/nghttpx.conf
+    depends_on:
+      squid:
+        condition: service_healthy
+    networks:
+      - proxy-net
+      - traefik
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/", "||", "exit", "1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik"
+      
+      # HTTP/2 代理主路由
+      - "traefik.http.routers.nghttpx.rule=Host(`proxy.yourdomain.com`)"
+      - "traefik.http.routers.nghttpx.entrypoints=websecure"
+      - "traefik.http.routers.nghttpx.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.nghttpx.tls.options=modern@file"
+      - "traefik.http.services.nghttpx.loadbalancer.server.port=8080"
+      
+      # HTTP 到 HTTPS 重定向
+      - "traefik.http.routers.nghttpx-http.rule=Host(`proxy.yourdomain.com`)"
+      - "traefik.http.routers.nghttpx-http.entrypoints=web"
+      - "traefik.http.routers.nghttpx-http.middlewares=redirect-to-https@docker"
+      
+      # 中间件
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
+      
+      # 可选：添加速率限制
+      - "traefik.http.routers.nghttpx.middlewares=rate-limit@docker"
+      - "traefik.http.middlewares.rate-limit.ratelimit.average=100"
+      - "traefik.http.middlewares.rate-limit.ratelimit.burst=50"
+
+networks:
+  traefik:
+    external: true
+
+volumes:
+  squid_cache:
+    driver: local
+  squid_logs:
+    driver: local
+
+```