Comment configurer Owntracks avec reverse proxy Traefik (mode HTTP) en seulement 3 minutes

Owntracks est l’une des rares applications de suivi de localisation open-source qui sont disponibles à la fois pour Android et iOS. C’est un excellent moyen de suivre votre localisation et de la partager avec d’autres.

Pour la configuration Traefik, voir Configuration simple Traefik docker-compose avec Lets Encrypt Cloudflare DNS-01 & TLS-ALPN-01 & HTTP-01 challenges

D’abord, créez docker-compose.yml

docker-compose.yml

services:
  otrecorder:
    image: owntracks/recorder
    volumes:
      - ./otrecorder_config:/config
      - ./otrecorder_store:/store
    environment:
      OTR_HOST: "mosquitto"
      OTR_USER: "otrecorder"
      OTR_PASS: "${MOSQUITTO_OTRECODER_PASSWORD}"
    depends_on:
      - mosquitto
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.owntracks.rule=Host(`owntracks.mydomain.com`)"
      - "traefik.http.routers.owntracks.entrypoints=websecure"
      - "traefik.http.routers.owntracks.tls.certresolver=cloudflare-ec384"
      - "traefik.http.routers.owntracks.tls.domains[0].main=mydomain.com"
      - "traefik.http.routers.owntracks.tls.domains[0].sans=*.mydomain.com"
      - "traefik.http.services.owntracks.loadbalancer.server.port=8083"
      - "traefik.http.middlewares.owntracks-compress.compress=true"
      - "traefik.http.routers.owntracks.middlewares=owntracks-compress,owntracks-auth"
      - "traefik.http.middlewares.owntracks-auth.basicauth.users=owntracks:$$apr1$$WE6pu5/y$90pvQQXZrTlFRpQGAKb15.

    restart: unless-stopped

  mosquitto:
    image: eclipse-mosquitto
    volumes:
      - ./mosquitto_data:/mosquitto/data
      - ./mosquitto_logs:/mosquitto/logs
      - ./mosquitto_config:/mosquitto/config
    restart: unless-stopped

services:
  otrecorder:
    image: owntracks/recorder
    volumes:
      - ./otrecorder_config:/config
      - ./otrecorder_store:/store
    environment:
      OTR_HOST: "mosquitto"
      OTR_USER: "otrecorder"
      OTR_PASS: "${MOSQUITTO_OTRECODER_PASSWORD}"
    depends_on:
      - mosquitto
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.owntracks.rule=Host(`owntracks.mydomain.com`)"
      - "traefik.http.routers.owntracks.entrypoints=websecure"
      - "traefik.http.routers.owntracks.tls.certresolver=cloudflare-ec384"
      - "traefik.http.routers.owntracks.tls.domains[0].main=mydomain.com"
      - "traefik.http.routers.owntracks.tls.domains[0].sans=*.mydomain.com"
      - "traefik.http.services.owntracks.loadbalancer.server.port=8083"
      - "traefik.http.middlewares.owntracks-compress.compress=true"
      - "traefik.http.routers.owntracks.middlewares=owntracks-compress,owntracks-auth"
      - "traefik.http.middlewares.owntracks-auth.basicauth.users=owntracks:$$apr1$$WE6pu5/y$90pvQQXZrTlFRpQGAKb15.

    restart: unless-stopped

  mosquitto:
    image: eclipse-mosquitto
    volumes:
      - ./mosquitto_data:/mosquitto/data
      - ./mosquitto_logs:/mosquitto/logs
      - ./mosquitto_config:/mosquitto/config
    restart: unless-stopped

Rappelez-vous de remplacer mydomain.com par votre domaine actuel !

Vous pouvez utiliser n’importe quelle configuration de certificat. Cet exemple utilise le challenge DNS-01 afin que nous puissions obtenir un certificat wildcard pour *.mydomain.com (qui peut être partagé avec d’autres sous-domaines). Si vous n’avez pas besoin de certificats wildcard, vous pouvez utiliser le challenge ALPN-01 à la place (HTTP-01 fonctionne aussi, mais je recommande toujours ALPN-01 puisqu’il fonctionne de manière si transparente avec Traefik).

Création du mot de passe haché d’authentification basique

Ici, vous devez remplacer les informations d’authentification basique par votre propre mot de passe ! C’est un mot de passe global pour toute l’instance Owntracks.

Exécutez

create_htpasswd.sh

htpasswd -c /dev/stdout owntracks

htpasswd -c /dev/stdout owntracks

Saisissez le mot de passe deux fois, il affichera ce qui suit

htpasswd_output.txt

New password:
Re-type new password:
Adding password for user owntracks
owntracks:$apr1$WE6pu5/y$90pvQQXZrTlFRpQGAKb15.

New password:
Re-type new password:
Adding password for user owntracks
owntracks:$apr1$WE6pu5/y$90pvQQXZrTlFRpQGAKb15.

Vous devez remplacer chaque $ par $$ ! N’oubliez pas cette étape !

Initialisation de Mosquitto

Mosquitto a également besoin d’un mot de passe aléatoire, qui sera sauvegardé dans .env. Cependant dans cette configuration, nous n’exposons pas Mosquitto.

Créez init.sh qui initialise principalement Mosquitto.

init.sh

#!/bin/sh
# Init script for Owntracks with Docker setup
mkdir -p mosquitto_config
cat << 'EOF' > mosquitto_config/mosquitto.conf
persistence true
persistence_location /mosquitto/data/
log_dest file /mosquitto/logs/mosquitto.log

listener 1883
## Authentication ##
# allow_anonymous false
password_file /mosquitto/config/mosquitto.passwd
EOF

# Generate random MQTT password
echo "MOSQUITTO_OTRECODER_PASSWORD=$(pwgen 30 1)" > .env

# Initialize Mosquitto password file
source .env
echo "${MOSQUITTO_OTRECODER_PASSWORD}"
docker-compose run mosquitto mosquitto_passwd -b -c /mosquitto/config/mosquitto.passwd otrecorder ${MOSQUITTO_OTRECODER_PASSWORD}
docker-compose run mosquitto chown root:root /mosquitto/config/mosquitto.passwd /mosquitto/config/mosquitto.conf
docker-compose run mosquitto chmod 0700 /mosquitto/config/mosquitto.conf
mkdir -p mosquitto_config
cat << 'EOF' > mosquitto_config/mosquitto.conf
persistence true
persistence_location /mosquitto/data/
log_dest file /mosquitto/logs/mosquitto.log

listener 1883
## Authentication ##
# allow_anonymous false
password_file /mosquitto/config/mosquitto.passwd
EOF

# Generate random MQTT password
echo "MOSQUITTO_OTRECODER_PASSWORD=$(pwgen 30 1)" > .env

# Initialize Mosquitto password file
source .env
echo "${MOSQUITTO_OTRECODER_PASSWORD}"
docker-compose run mosquitto mosquitto_passwd -b -c /mosquitto/config/mosquitto.passwd otrecorder ${MOSQUITTO_OTRECODER_PASSWORD}
docker-compose run mosquitto chown root:root /mosquitto/config/mosquitto.passwd /mosquitto/config/mosquitto.conf
docker-compose run mosquitto chmod 0700 /mosquitto/config/mosquitto.conf

#!/bin/sh
# Init script for Owntracks with Docker setup
mkdir -p mosquitto_config
cat << 'EOF' > mosquitto_config/mosquitto.conf
persistence true
persistence_location /mosquitto/data/
log_dest file /mosquitto/logs/mosquitto.log

listener 1883
## Authentication ##
# allow_anonymous false
password_file /mosquitto/config/mosquitto.passwd
EOF

# Generate random MQTT password
echo "MOSQUITTO_OTRECODER_PASSWORD=$(pwgen 30 1)" > .env

# Initialize Mosquitto password file
source .env
echo "${MOSQUITTO_OTRECODER_PASSWORD}"
docker-compose run mosquitto mosquitto_passwd -b -c /mosquitto/config/mosquitto.passwd otrecorder ${MOSQUITTO_OTRECODER_PASSWORD}
docker-compose run mosquitto chown root:root /mosquitto/config/mosquitto.passwd /mosquitto/config/mosquitto.conf
docker-compose run mosquitto chmod 0700 /mosquitto/config/mosquitto.conf
mkdir -p mosquitto_config
cat << 'EOF' > mosquitto_config/mosquitto.conf
persistence true
persistence_location /mosquitto/data/
log_dest file /mosquitto/logs/mosquitto.log

listener 1883
## Authentication ##
# allow_anonymous false
password_file /mosquitto/config/mosquitto.passwd
EOF

# Generate random MQTT password
echo "MOSQUITTO_OTRECODER_PASSWORD=$(pwgen 30 1)" > .env

# Initialize Mosquitto password file
source .env
echo "${MOSQUITTO_OTRECODER_PASSWORD}"
docker-compose run mosquitto mosquitto_passwd -b -c /mosquitto/config/mosquitto.passwd otrecorder ${MOSQUITTO_OTRECODER_PASSWORD}
docker-compose run mosquitto chown root:root /mosquitto/config/mosquitto.passwd /mosquitto/config/mosquitto.conf
docker-compose run mosquitto chmod 0700 /mosquitto/config/mosquitto.conf

Maintenant exécutez init.sh :

call_init.sh

bash init.sh

bash init.sh

Configuration de l’autostart

Maintenant je recommande de configurer l’autostart basé sur systemd pour votre instance. Créez un service systemd pour votre projet docker-compose en 10 secondes :

setup_systemd_service.sh

curl -fsSL https://techoverflow.net/scripts/create-docker-compose-service.sh | sudo bash /dev/stdin

curl -fsSL https://techoverflow.net/scripts/create-docker-compose-service.sh | sudo bash /dev/stdin

Cela démarrera également Owntracks immédiatement.

Configuration de l’application

Dans l’application, vous devez la configurer en mode HTTP et définir une URL telle que

owntracks_url.txt

https://owntracks.my-domain.com/pub

https://owntracks.my-domain.com/pub

N’oubliez pas le /pub à la fin !

Définissez le nom d’utilisateur et le mot de passe sur owntracks et le mot de passe que vous avez configuré en utilisant htpasswd précédemment.

Pour l’accès navigateur, vous pouvez utiliser https://owntracks.my-domain.com/ pour accéder à l’interface web. Comme utilisateur, utilisez owntracks et le mot de passe que vous avez configuré en utilisant htpasswd précédemment.