Initial commit: Infisical (secrets.kzbrd.ru) — docker-compose + Traefik labels + IP-whitelist

docker-compose.yml

@@ -0,0 +1,68 @@
+name: infisical
+
+services:
+  backend:
+    image: infisical/infisical:latest
+    container_name: infisical-backend
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    env_file: .env
+    environment:
+      - NODE_ENV=production
+    networks:
+      - traefik_proxy
+      - infisical
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik_proxy"
+      - "traefik.http.routers.infisical.rule=Host(`secrets.kzbrd.ru`)"
+      - "traefik.http.routers.infisical.entrypoints=websecure"
+      - "traefik.http.routers.infisical.tls=true"
+      - "traefik.http.routers.infisical.tls.certresolver=myresolver"
+      - "traefik.http.routers.infisical.middlewares=local-ip-whitelist"
+      - "traefik.http.services.infisical.loadbalancer.server.port=8080"
+      # IP whitelist middleware — same Docker provider as router (no @file needed)
+      - "traefik.http.middlewares.local-ip-whitelist.ipwhitelist.sourcerange=192.168.1.0/24, 127.0.0.1/32, 172.19.0.0/16"
+
+  redis:
+    image: redis:7-alpine
+    container_name: infisical-dev-redis
+    env_file: .env
+    restart: always
+    environment:
+      - ALLOW_EMPTY_PASSWORD=yes
+    networks:
+      - infisical
+    volumes:
+      - redis_data:/data
+
+  db:
+    image: postgres:14-alpine
+    container_name: infisical-db
+    restart: always
+    env_file: .env
+    volumes:
+      - pg_data:/var/lib/postgresql/data
+    networks:
+      - infisical
+    healthcheck:
+      test: "pg_isready --username=infisical && psql --username=infisical --list"
+      interval: 5s
+      timeout: 10s
+      retries: 10
+
+volumes:
+  pg_data:
+    driver: local
+  redis_data:
+    driver: local
+
+networks:
+  traefik_proxy:
+    external: true
+  infisical:
+    driver: bridge