cryptgeon

To deploy Cryptgeon using Traefik as a reverse proxy, you need an existing Traefik installation (v2 or v3) configured with an external Docker network (e.g., proxy), a certificate resolver (e.g., le), and an HTTPS entrypoint (e.g., secure).

This setup uses Valkey (a Redis alternative) as the backend. To ensure data stays in RAM only and avoids persistent disk storage, the Valkey service must be configured with --save "" and --appendonly no, and use a tmpfs mount on /data.

version: '3.8'

networks:
  proxy:
    external: true

services:
  redis:
    image: valkey/valkey:7-alpine
    # This is required to stay in RAM only.
    command: valkey-server --save "" --appendonly no
    # Set a size limit to prevent memory exhaustion:
    # --maxmemory 1gb --maxmemory-policy allkeys-lru
    # This prevents the creation of an anonymous volume.
    tmpfs:
      - /data

  app:
    image: cupcakearmy/cryptgeon:latest
    restart: unless-stopped
    depends_on:
      - redis
    networks:
      - default
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.cryptgeon.rule=Host(`example.org`)
      - traefik.http.routers.cryptgeon.entrypoints=secure
      - traefik.http.routers.cryptgeon.tls.certresolver=le

Traefik manages HTTPS certificates and routing via Docker labels. To set up Traefik with automatic HTTP to HTTPS redirection and ACME (Let's Encrypt) support, use the following configuration files.

Directory Structure:

/foo/bar/traefik/
├── docker-compose.yaml
└── traefik.yaml

Setup Steps:

1. Create a Docker network named proxy.
2. Deploy Traefik using the provided docker-compose.yaml and traefik.yaml configurations.
3. Use the le certificate resolver for ACME via the insecure (HTTP) entrypoint.

# docker-compose.yaml
version: '3.8'
services:
  traefik:
    image: traefik:2.6
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik.yaml:/etc/traefik/traefik.yaml:ro
      - ./data:/data
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.http_catchall.rule=HostRegexp(`{any:.+}`)'
      - 'traefik.http.routers.http_catchall.entrypoints=insecure'
      - 'traefik.http.routers.http_catchall.middlewares=https_redirect'
      - 'traefik.http.middlewares.https_redirect.redirectscheme.scheme=https'
      - 'traefik.http.middlewares.https_redirect.redirectscheme.permanent=true'

networks:
  default:
    external: true
    name: proxy

# traefik.yaml
api:
  dashboard: true

entryPoints:
  insecure:
    address: ':80'
  secure:
    address: ':443'

providers:
  docker:
    endpoint: 'unix:///var/run/docker.sock'
    network: 'proxy'
    exposedByDefault: false

certificatesResolvers:
  le:
    acme:
      email: me@example.org
      storage: /data/acme.json
      httpChallenge:
        entryPoint: insecure

docker network create proxy
docker-compose up -d

You can hide the Cryptgeon service behind authentication using Traefik middleware. This is useful for restricting access to the service. In the example below, a basicauth middleware named cryptgeon-auth is applied to the router.

Note that when defining users in a Docker Compose file, the $ character in the hashed password must be escaped by using $$.

services:
  traefik:
    image: traefik:v3.0
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
    ports:
      - "80:80"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  redis:
    image: valkey/valkey:7-alpine
    command: valkey-server --save "" --appendonly no
    tmpfs:
      - /data

  cryptgeon:
    image: cupcakearmy/cryptgeon
    depends_on:
      - redis
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.cryptgeon.rule=Host(`cryptgeon.localhost`)"
      - "traefik.http.routers.cryptgeon.entrypoints=web"
      - "traefik.http.routers.cryptgeon.middlewares=cryptgeon-auth"
      - "traefik.http.middlewares.cryptgeon-auth.basicauth.users=user:$$2y$$05$$juUw0zgc5ebvJ00MFPVVLujF6P.rcEMbGZ99Jfq6ZWEa1dgetacEq"

The simplest way to deploy Cryptgeon is using Docker. Note: Cryptgeon must be used over HTTPS, otherwise browsers may not support the required encryption algorithms.

This configuration includes a Redis service configured to stay in RAM only (no persistence) and the Cryptgeon application service.

# docker-compose.yml
version: "3.8"

services:
  redis:
    image: redis:7-alpine
    # This is required to stay in RAM only.
    command: redis-server --save "" --appendonly no
    # Set a size limit. See link below on how to customise.
    # https://redis.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
    # --maxmemory 1gb --maxmemory-policy allkeys-lrulpine
    # This prevents the creation of an anonymous volume.
    tmpfs:
      - /data

  app:
    image: cupcakearmy/cryptgeon:latest
    depends_on:
      - redis
    environment:
      SIZE_LIMIT: 4 MiB
    ports:
      - 80:8000

To deploy Cryptgeon behind Traefik 2, use the following configuration. This example assumes:

• An external Docker proxy network named proxy.
• A certificate resolver named le.
• An HTTPS entrypoint named secure.
• A domain named example.org.

version: "3.8"

networks:
  proxy:
    external: true

services:
  redis:
    image: redis:7-alpine
    # This is required to stay in RAM only.
    command: redis-server --save "" --appendonly no
    # Set a size limit. See link below on how to customise.
    # https://redis.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
    # --maxmemory 1gb --maxmemory-policy allkeys-lrulpine
    # This prevents the creation of an anonymous volume.
    tmpfs:
      - /data

  app:
    image: cupcakearmy/cryptgeon:latest
    restart: unless-stopped
    depends_on:
      - redis
    networks:
      - default
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.cryptgeon.rule=Host(`example.org`)
      - traefik.http.routers.cryptgeon.entrypoints=secure
      - traefik.http.routers.cryptgeon.tls.certresolver=le

Cryptgeon requires a Redis-compatible backend (the example uses Valkey) and a proxy (Traefik) to handle TLS.

Key Configuration Details:

• Valkey/Redis: Must be configured to stay in RAM only by disabling persistence (--save "" --appendonly no) and using a tmpfs mount for /data to prevent anonymous volume creation.
• Environment Variables: Use SIZE_LIMIT to restrict the size of uploaded data (e.g., 4 MiB).
• Traefik Labels: You must provide labels to route traffic to the app service using your specific domain and the secure entrypoint with the le certificate resolver.

Deployment Steps:

1. Create a directory for Cryptgeon.
2. Create a docker-compose.yaml using the template below.
3. Run docker-compose up -d.

version: '3.8'

networks:
  proxy:
    external: true

services:
  redis:
    image: valkey/valkey:7-alpine
    command: valkey-server --save "" --appendonly no
    tmpfs:
      - /data

  app:
    image: cupcakearmy/cryptgeon:latest
    restart: unless-stopped
    depends_on:
      - redis
    environment:
      SIZE_LIMIT: 4 MiB
    networks:
      - default
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.cryptgeon.rule=Host(`cryptgeon.example.org`)
      - traefik.http.routers.cryptgeon.entrypoints=secure
      - traefik.http.routers.cryptgeon.tls.certresolver=le

docker-compose up -d