Stack on slash-root.fr

Docker Swarm : Stack Drawio

Mon, 12 Sep 2022 07:21:23 +0200

Informations importantes

Avoir réalisé l'enregistrement DNS adéquat pour url.application.com
Nécéssite le stack pour traefik voir ici : /docker-swarm-stack-traefik/
Bien modifier ce qu'il faut dans le stack (voir commentaires)

Fichier stack.yml

version: '3.3'

services:
 drawio:
 image: jgraph/drawio
 networks:
 - traefik-public
 deploy:
 #resources:
 #limits:
 #cpus: '0.50'
 #memory: 1024M
 #reservations:
 #cpus: '0.25'
 #memory: 512M
 labels:
 - traefik.enable=true
 - traefik.docker.network=traefik-public
 - traefik.constraint-label=traefik-public
 # Indiquer l'URL d'accès à l'application
 - traefik.http.routers.drawio-http.rule=Host(<code>url.application.com</code>)
 - traefik.http.routers.drawio-http.entrypoints=http
 - traefik.http.routers.drawio-http.middlewares=https-redirect
 # Indiquer l'URL d'accès à l'application
 - traefik.http.routers.drawio-https.rule=Host(<code>url.application.com</code>)
 - traefik.http.routers.drawio-https.entrypoints=https
 - traefik.http.routers.drawio-https.tls=true
 - traefik.http.routers.drawio-https.tls.certresolver=le
 - traefik.http.middlewares.hsts-headers.headers.stsSeconds=315360000
 - traefik.http.middlewares.hsts-headers.headers.stsPreload=true
 - traefik.http.middlewares.hsts-headers.headers.stsIncludeSubdomains=true
 - traefik.http.middlewares.hsts-headers.headers.customFrameOptionsValue=SAMEORIGIN
 - traefik.http.middlewares.hsts-headers.headers.sslRedirect=true
 - traefik.http.middlewares.hsts-headers.headers.forceSTSHeader=true
 - traefik.http.middlewares.hsts-headers.headers.referrerPolicy=same-origin
 - traefik.http.routers.drawio-https.middlewares=hsts-headers
 - traefik.http.services.drawio.loadbalancer.server.port=8080

networks:
 traefik-public:
 external: true

Déploiement

docker stack deploy -c stack.yml drawio

Accès

https://url.application.com

Docker Swarm : Stack OpenVAS

Sun, 04 Sep 2022 12:16:16 +0200

Informations importantes

Nécéssite le stack pour traefik voir ici : /docker-swarm-stack-traefik/
Bien modifier ce qu'il faut dans le stack (voir commentaires)

Fichier stack.yml

version: '3.3'

services:

 app:
 image: immauss/openvas
 environment:
 # Indiquer un mot de passe pour le compte admin de l'application
 PASSWORD: MotDePasseTresSecure
 volumes:
 - /var/run/docker.sock:/var/run/docker.sock:ro
 - /etc/localtime:/etc/localtime:ro
 # Indiquer les volumes à monter. Si le volume est inexistant, il sera créé automatiquement. Attention si contexte de cluster (swarm), penser à placer une contrainte de label.
 - data:/data
 networks:
 # Indispensable pour communiquer avec traefik
 - traefik-public
 deploy:
 #resources:
 #limits:
 #cpus: '0.50'
 #memory: 1024M
 #reservations:
 #cpus: '0.25'
 #memory: 512M
 placement:
 constraints:
 - node.labels.openvas_data == true
 labels:
 # Activation de traefik
 - traefik.enable=true
 - traefik.docker.network=traefik-public
 - traefik.constraint-label=traefik-public
 # Indiquer l'URL de l'application (openvas.example.com)
 - traefik.http.routers.openvas-http.rule=Host(`openvas.example.com`)
 - traefik.http.routers.openvas-http.entrypoints=http
 - traefik.http.routers.openvas-http.middlewares=https-redirect
 # Indiquer l'URL de l'application (openvas.example.com)
 - traefik.http.routers.openvas-https.rule=Host(`openvas.example.com`)
 - traefik.http.routers.openvas-https.entrypoints=https
 - traefik.http.routers.openvas-https.tls=true
 - traefik.http.routers.openvas-https.tls.certresolver=le
 # Indiquer le nomagentapplication pour les headers à travers traefik
 - traefik.http.middlewares.hsts-headers.headers.stsSeconds=315360000
 - traefik.http.middlewares.hsts-headers.headers.stsPreload=true
 - traefik.http.middlewares.hsts-headers.headers.stsIncludeSubdomains=true
 - traefik.http.middlewares.hsts-headers.headers.customFrameOptionsValue=SAMEORIGIN
 - traefik.http.middlewares.hsts-headers.headers.sslRedirect=true
 - traefik.http.middlewares.hsts-headers.headers.forceSTSHeader=true
 - traefik.http.middlewares.hsts-headers.headers.referrerPolicy=same-origin
 - traefik.http.routers.openvas-https.middlewares=hsts-headers
 - traefik.http.services.openvas.loadbalancer.server.port=9392

networks:
 traefik-public:
 external: true

volumes:
 data:
 driver: local

Déploiement

docker stack deploy -c stack.yml openvas

Docker Swarm : Stack Keycloak (v19 latest)

Mon, 22 Aug 2022 10:39:09 +0200

Informations importantes

Nécéssite le stack pour traefik voir ici : /docker-swarm-stack-traefik/
Cette stack est faites pour du développement (avec persistance des données) et non de la production
Bien modifier ce qu'il faut dans le stack (voir commentaires)

Fichier stack.yml

version: '3.3'

services:

 app:
 image: quay.io/keycloak/keycloak:latest
 security_opt:
 - no-new-privileges:true
 command: start-dev
 environment:
 PROXY_ADDRESS_FORWARDING: "true"
 KC_FEATURES: token-exchange
 KC_PROXY: passthrough
 KEYCLOAK_ADMIN: admin
 # Indiquer un mot de passe pour le compte admin sur l'application keycloak
 KEYCLOAK_ADMIN_PASSWORD: MotDePasseTresSecure

 volumes:
 - /var/run/docker.sock:/var/run/docker.sock:ro
 - /etc/localtime:/etc/localtime:ro
 # Indiquer les volumes à monter. Si le volume est inexistant, il sera créé automatiquement. Attention si contexte de cluster (swarm), penser à placer une contrainte de label.
 - conf:/opt/keycloak/conf
 - data:/opt/keycloak/data
 - providers:/opt/keycloak/providers
 - themes:/opt/keycloak/themes
 networks:
 # Indispensable pour communiquer avec traefik
 - traefik-public
 deploy:
 #resources:
 #limits:
 #cpus: '0.50'
 #memory: 1024M
 #reservations:
 #cpus: '0.25'
 #memory: 512M
 placement:
 constraints:
 - node.labels.keycloak_quay-io_conf == true
 - node.labels.keycloak_quay-io_data == true
 - node.labels.keycloak_quay-io_providers == true
 - node.labels.keycloak_quay-io_themes == true
 labels:
 # Activation de traefik
 - traefik.enable=true
 - traefik.docker.network=traefik-public
 - traefik.constraint-label=traefik-public
 # Indiquer l'URL de l'application (keycloak.example.com)
 - traefik.http.routers.keycloak_quay-io-http.rule=Host(`keycloak.example.com`)
 - traefik.http.routers.keycloak_quay-io-http.entrypoints=http
 - traefik.http.routers.keycloak_quay-io-http.middlewares=https-redirect
 # Indiquer l'URL de l'application (keycloak.example.com)
 - traefik.http.routers.keycloak_quay-io-https.rule=Host(`keycloak.example.com`)
 - traefik.http.routers.keycloak_quay-io-https.entrypoints=https
 - traefik.http.routers.keycloak_quay-io-https.tls=true
 - traefik.http.routers.keycloak_quay-io-https.tls.certresolver=le
 - traefik.http.middlewares.hsts-headers.headers.stsSeconds=315360000
 - traefik.http.middlewares.hsts-headers.headers.stsPreload=true
 - traefik.http.middlewares.hsts-headers.headers.stsIncludeSubdomains=true
 - traefik.http.middlewares.hsts-headers.headers.customFrameOptionsValue=SAMEORIGIN
 - traefik.http.middlewares.hsts-headers.headers.sslRedirect=true
 - traefik.http.middlewares.hsts-headers.headers.forceSTSHeader=true
 - traefik.http.middlewares.hsts-headers.headers.referrerPolicy=same-origin
 - traefik.http.routers.keycloak_quay-io-https.middlewares=hsts-headers
 - traefik.http.services.keycloak_quay-io.loadbalancer.server.port=8080

networks:
 traefik-public:
 external: true

volumes:
 conf:
 driver: local
 data:
 driver: local
 providers:
 driver: local
 themes:
 driver: local

Déploiement

docker stack deploy -c stack.yml keycloak

Docker Swarm : Stack Nextcloud

Thu, 18 Aug 2022 13:00:13 +0200

Changelog

22/08/2022 : Fix traefik headers as same origin, trusted proxy, redirectregex

Informations importantes

Nécéssite le stack pour traefik voir ici : /docker-swarm-stack-traefik/
Bien modifier ce qu'il faut dans le stack (voir commentaires)

Fichier stack.yml

version: '3.3'

services:

 mariadb:
 image: mariadb
 command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --skip-innodb-read-only-compressed
 environment:
 # Indiquer les mots de passe souhaités
 MYSQL_ROOT_PASSWORD: MotDePasseTresSecure
 MYSQL_PASSWORD: MotDePasseTresSecure
 MYSQL_DATABASE: nextcloud
 MYSQL_USER: nextcloud
 volumes:
 - /var/run/docker.sock:/var/run/docker.sock:ro
 - /etc/localtime:/etc/localtime:ro
 # Indiquer les volumes à monter. Si le volume est inexistant, il sera créé automatiquement. Attention si contexte de cluster (swarm), penser à placer une contrainte de label.
 - mariadb:/var/lib/mysql
 networks:
 - net
 deploy:
 #resources:
 #limits:
 #cpus: '0.50'
 #memory: 1024M
 #reservations:
 #cpus: '0.25'
 #memory: 512M
 placement:
 constraints:
 #- node.role == worker
 - node.labels.nextcloud_mariadb == true

 app:
 image: nextcloud
 environment:
 # Indiquer le mot de passe inscrit précédement
 MYSQL_PASSWORD: MotDePasseTresSecure
 MYSQL_DATABASE: nextcloud
 MYSQL_USER: nextcloud
 MYSQL_HOST: mariadb
 TRUSTED_PROXIES: traefik
 # Indiquer le domaine souhaité de l'application
 OVERWRITEHOST: nextcloud.example.com
 OVERWRITEPROTOCOL: https
 volumes:
 - /var/run/docker.sock:/var/run/docker.sock:ro
 - /etc/localtime:/etc/localtime:ro
 # Indiquer les volumes à monter. Si le volume est inexistant, il sera créé automatiquement. Attention si contexte de cluster (swarm), penser à placer une contrainte de label.
 - nextcloud:/var/www/html
 networks:
 - net
 # Indispensable pour communiquer avec traefik
 - traefik-public
 deploy:
 #resources:
 #limits:
 #cpus: '0.50'
 #memory: 1024M
 #reservations:
 #cpus: '0.25'
 #memory: 512M
 placement:
 constraints:
 #- node.role == worker
 - node.labels.nextcloud_nextcloud == true
 labels:
 # Activation de traefik
 - traefik.enable=true
 - traefik.docker.network=traefik-public
 - traefik.constraint-label=traefik-public
 # Indiquer le domaine souhaité pour l'application
 - traefik.http.routers.nextcloud-http.rule=Host(`nextcloud.example.com`)
 - traefik.http.routers.nextcloud-http.entrypoints=http
 - traefik.http.routers.nextcloud-http.middlewares=https-redirect
 # Indiquer le domaine souhaité pour l'application
 - traefik.http.routers.nextcloud-https.rule=Host(`nextcloud.example.com`)
 - traefik.http.routers.nextcloud-https.entrypoints=https
 - traefik.http.routers.nextcloud-https.tls=true
 - traefik.http.routers.nextcloud-https.tls.certresolver=le
 # Middleware pour nextcloud
 - traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.permanent=true
 - traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.regex=https://(.*)/.well-known/(card|cal)dav
 - traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.replacement=https://$${1}/remote.php/dav/
 - traefik.http.middlewares.hsts-headers.headers.stsSeconds=315360000
 - traefik.http.middlewares.hsts-headers.headers.stsPreload=true
 - traefik.http.middlewares.hsts-headers.headers.stsIncludeSubdomains=true
 - traefik.http.middlewares.hsts-headers.headers.customFrameOptionsValue=SAMEORIGIN
 - traefik.http.middlewares.hsts-headers.headers.sslRedirect=true
 - traefik.http.middlewares.hsts-headers.headers.forceSTSHeader=true
 - traefik.http.middlewares.hsts-headers.headers.referrerPolicy=same-origin
 - traefik.http.routers.nextcloud-https.middlewares=hsts-headers,nextcloud-redirectregex
 # Indiquer le port utiliser de l'application
 - traefik.http.services.nextcloud.loadbalancer.server.port=80

networks:
 net:
 driver: overlay
 attachable: true
 traefik-public:
 external: true

volumes:
 mariadb:
 driver: local
 nextcloud:
 driver: local

Déploiement

docker stack deploy -c stack.yml nextcloud

Docker Swarm : Stack Keycloak (v16 depreciated)

Thu, 18 Aug 2022 11:47:44 +0200

Changelog

22/08/2022 : Ajout information depreciated

Informations importantes

Nécessite le stack pour traefik voir ici : /docker-swarm-stack-traefik/
Bien modifier ce qu'il faut dans le stack (voir commentaires)

Ce stack utilise une image docker provenant de jboss qui est un keycloak en v16. La dernière version actuelle est la v19. Stack disponible ici : /docker-swarm-stack-keycloak-v19-latest/

Fichier stack.yml

version: '3.3'

services:
 postgres:
 image: postgres
 environment:
 POSTGRES_DB: keycloak
 POSTGRES_USER: keycloak
 # Indiquer le mot de passe souhaité
 POSTGRES_PASSWORD: MotDePasseTresSecure
 volumes:
 - /var/run/docker.sock:/var/run/docker.sock:ro
 - /etc/localtime:/etc/localtime:ro
 - postgres_data:/var/lib/postgresql/data
 networks:
 - net
 deploy:
 #resources:
 #limits:
 #cpus: '0.50'
 #memory: 1024M
 #reservations:
 #cpus: '0.25'
 #memory: 512M
 placement:
 constraints:
 # Label à appliquer au noeud (A retirer si utilisation de glusterfs / ceph)
 - node.labels.keycloak_postgres_data == true

 keycloak:
 image: jboss/keycloak:latest
 environment:
 PROXY_ADDRESS_FORWARDING: 'true'
 DB_VENDOR: POSTGRES
 DB_ADDR: postgres
 DB_DATABASE: keycloak
 DB_USER: keycloak
 # Indiquer le mot de passe inscrit dans le service postgre
 DB_PASSWORD: MotDePasseTresSecure
 KEYCLOAK_USER: admin
 # Indiquer le mot de passe souhaité
 KEYCLOAK_PASSWORD: MotDePasseTresSecure
 volumes:
 - /var/run/docker.sock:/var/run/docker.sock:ro
 - /etc/localtime:/etc/localtime:ro
 networks:
 - net
 # Réseau utilisé par le conteneur traefik
 - traefik-public
 deploy:
 #resources:
 #limits:
 #cpus: '0.50'
 #memory: 1024M
 #reservations:
 #cpus: '0.25'
 #memory: 512M
 labels:
 # Activation de traefik
 - traefik.enable=true
 - traefik.docker.network=traefik-public
 - traefik.constraint-label=traefik-public
 # Modifier le domaine de l'application keyclaok
 - traefik.http.routers.keycloak-http.rule=Host(`keycloak.example.com`)
 - traefik.http.routers.keycloak-http.entrypoints=http
 - traefik.http.routers.keycloak-http.middlewares=https-redirect
 - traefik.http.routers.keycloak-https.rule=Host(`keycloak.example.com`)
 - traefik.http.routers.keycloak-https.entrypoints=https
 - traefik.http.routers.keycloak-https.tls=true
 - traefik.http.routers.keycloak-https.tls.certresolver=le
 # Indiquer le port utiliser de l'application
 - traefik.http.services.keycloak.loadbalancer.server.port=8080

networks:
 net:
 driver: overlay
 attachable: true
 traefik-public:
 external: true

volumes:
 postgres_data:
 driver: local

Déploiement

docker stack deploy -c stack.yml keycloak

Docker Swarm : Stack Rocket.Chat

Thu, 18 Aug 2022 11:34:33 +0200

Informations importantes

Nécéssite le stack pour traefik voir ici : /docker-swarm-stack-traefik/
Bien modifier ce qu'il faut dans le stack (voir commentaires)

Fichier stack.yml

version: '3.3'

services:

 rocketchat:
 image: registry.rocket.chat/rocketchat/rocket.chat:latest
 environment:
 MONGO_URL: "mongodb://mongodb:27017/rocketchat?replicaSet=rs0"
 MONGO_OPLOG_URL: "mongodb://mongodb:27017/local?replicaSet=rs0"
 # Modifier l'URL d'accès à l'application RocketChat
 ROOT_URL: https://rocketchat.example.com
 PORT: 3000
 volumes:
 - /var/run/docker.sock:/var/run/docker.sock:ro
 - /etc/localtime:/etc/localtime:ro
 - uploads:/app/uploads
 networks:
 - net
 # Réseau utilisé par le conteneur traefik
 - traefik-public
 deploy:
 #resources:
 #limits:
 #cpus: '0.50'
 #memory: 1024M
 #reservations:
 #cpus: '0.25'
 #memory: 512M
 placement:
 constraints:
 # Label à appliquer au noeud (A retirer si utilisation de glusterfs / ceph)
 - node.labels.rocketchat_uploads == true
 labels:
 # Activation de traefik
 - traefik.enable=true
 - traefik.docker.network=traefik-public
 - traefik.constraint-label=traefik-public
 # Modifier le domaine de l'application RocketChat
 - traefik.http.routers.rocketchat-http.rule=Host(`rocketchat.example.com`)
 - traefik.http.routers.rocketchat-http.entrypoints=http
 - traefik.http.routers.rocketchat-http.middlewares=https-redirect
 # Modifier le domaine de l'application RocketChat
 - traefik.http.routers.rocketchat-https.rule=Host(`rocketchat.example.com`)
 - traefik.http.routers.rocketchat-https.entrypoints=https
 - traefik.http.routers.rocketchat-https.tls=true
 - traefik.http.routers.rocketchat-https.tls.certresolver=le
 - traefik.http.services.rocketchat.loadbalancer.server.port=3000

 mongodb:
 image: docker.io/bitnami/mongodb:4.4
 environment:
 MONGODB_REPLICA_SET_MODE: primary
 MONGODB_REPLICA_SET_NAME: rs0
 MONGODB_PORT_NUMBER: 27017
 MONGODB_INITIAL_PRIMARY_HOST: mongodb
 MONGODB_INITIAL_PRIMARY_PORT_NUMBER: 27017
 MONGODB_ADVERTISED_HOSTNAME: mongodb
 MONGODB_ENABLE_JOURNAL: "true"
 ALLOW_EMPTY_PASSWORD: "yes"
 volumes:
 - /var/run/docker.sock:/var/run/docker.sock:ro
 - /etc/localtime:/etc/localtime:ro
 - mongodb_data:/bitnami/mongodb
 networks:
 - net
 deploy:
 #resources:
 #limits:
 #cpus: '0.50'
 #memory: 1024M
 #reservations:
 #cpus: '0.25'
 #memory: 512M
 placement:
 constraints:
 # Label à appliquer au noeud (A retirer si utilisation de glusterfs / ceph)
 - node.labels.rocketchat_mongodb_data == true

networks:
 net:
 driver: overlay
 attachable: true
 # Réseau utilisé par le conteneur traefik
 traefik-public:
 external: true

volumes:
 mongodb_data:
 driver: local
 uploads:
 driver: local

Deploiement

docker stack deploy -c stack.yml rocketchat

Docker Swarm : Stack Traefik

Thu, 18 Aug 2022 11:28:10 +0200

Export variables

export EMAIL=mon@email.com
export DOMAIN=traefik.example.com
export USERNAME=admin
export PASSWORD=MotDePasseTresSecure
export HASHED_PASSWORD=$(openssl passwd -apr1 "$PASSWORD")

Fichier stack.yml

version: '3.3'

services:

 traefik:
 # Use the latest Traefik image
 image: traefik:latest
 ports:
 # Listen on port 80, default for HTTP, necessary to redirect to HTTPS
 - target: 80
 published: 80
 mode: host
 # Listen on port 443, default for HTTPS
 - target: 443
 published: 443
 mode: host
 deploy:
 placement:
 constraints:
 # Make the traefik service run only on the node with this label
 # as the node with it has the volume for the certificates
 - node.labels.traefik-public.traefik-public-certificates == true
 labels:
 # Enable Traefik for this service, to make it available in the public network
 - traefik.enable=true
 # Use the traefik-public network (declared below)
 - traefik.docker.network=traefik-public
 # Use the custom label "traefik.constraint-label=traefik-public"
 # This public Traefik will only use services with this label
 # That way you can add other internal Traefik instances per stack if needed
 - traefik.constraint-label=traefik-public
 # admin-auth middleware with HTTP Basic auth
 # Using the environment variables USERNAME and HASHED_PASSWORD
 - traefik.http.middlewares.admin-auth.basicauth.users=${USERNAME?Variable not set}:${HASHED_PASSWORD?Variable not set}
 # https-redirect middleware to redirect HTTP to HTTPS
 # It can be re-used by other stacks in other Docker Compose files
 - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
 - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
 # traefik-http set up only to use the middleware to redirect to https
 # Uses the environment variable DOMAIN
 - traefik.http.routers.traefik-public-http.rule=Host(`${DOMAIN?Variable not set}`)
 - traefik.http.routers.traefik-public-http.entrypoints=http
 - traefik.http.routers.traefik-public-http.middlewares=https-redirect
 # traefik-https the actual router using HTTPS
 # Uses the environment variable DOMAIN
 - traefik.http.routers.traefik-public-https.rule=Host(`${DOMAIN?Variable not set}`)
 - traefik.http.routers.traefik-public-https.entrypoints=https
 - traefik.http.routers.traefik-public-https.tls=true
 # Use the special Traefik service api@internal with the web UI/Dashboard
 - traefik.http.routers.traefik-public-https.service=api@internal
 # Use the "le" (Let's Encrypt) resolver created below
 - traefik.http.routers.traefik-public-https.tls.certresolver=le
 # Enable HTTP Basic auth, using the middleware created above
 - traefik.http.routers.traefik-public-https.middlewares=admin-auth
 # Define the port inside of the Docker service to use
 - traefik.http.services.traefik-public.loadbalancer.server.port=8080
 volumes:
 # Add Docker as a mounted volume, so that Traefik can read the labels of other services
 - /var/run/docker.sock:/var/run/docker.sock:ro
 # Mount the volume to store the certificates
 - traefik-public-certificates:/certificates
 command:
 # Enable Docker in Traefik, so that it reads labels from Docker services
 - --providers.docker
 # Add a constraint to only use services with the label "traefik.constraint-label=traefik-public"
 - --providers.docker.constraints=Label(`traefik.constraint-label`, `traefik-public`)
 # Do not expose all Docker services, only the ones explicitly exposed
 - --providers.docker.exposedbydefault=false
 # Enable Docker Swarm mode
 - --providers.docker.swarmmode
 # Create an entrypoint "http" listening on address 80
 - --entrypoints.http.address=:80
 # Create an entrypoint "https" listening on address 443
 - --entrypoints.https.address=:443
 # Create the certificate resolver "le" for Let's Encrypt, uses the environment variable EMAIL
 - --certificatesresolvers.le.acme.email=${EMAIL?Variable not set}
 # Store the Let's Encrypt certificates in the mounted volume
 - --certificatesresolvers.le.acme.storage=/certificates/acme.json
 # Use the TLS Challenge for Let's Encrypt
 - --certificatesresolvers.le.acme.tlschallenge=true
 # Enable the access log, with HTTP requests
 - --accesslog
 # Enable the Traefik log, for configurations and errors
 - --log
 # Enable the Dashboard and API
 - --api
 # Set CA Server fir Let's Encrypt
 # - --certificatesresolvers.le.acme.caServer=
 networks:
 # Use the public network created to be shared between Traefik and
 # any other service that needs to be publicly available with HTTPS
 - traefik-public

volumes:
 # Create a volume to store the certificates, there is a constraint to make sure
 # Traefik is always deployed to the same Docker node with the same volume containing
 # the HTTPS certificates
 traefik-public-certificates:

networks:
 # Use the previously created public network "traefik-public", shared with other
 # services that need to be publicly available via this Traefik
 traefik-public:
 external: true

Déploiement

docker stack deploy -c stack.yml traefik