cloudflared on Docker Compose (20240730)

Recommended pre-reads

• Dockge, where we describe installing Dockge onto a system and adding “stacks” (Docker compose services) to it

• VPS: Cloudflare Zero Trust access to Web Applications in which we discuss exposing web applications on a VPS with no ports exposed (save for SSH on an alternate port) and making those available as HTTPS URLs. In particular, in this post, we discuss the initial setup of the domain and the steps needed to create a Zero Trust tunnel and add applications to it.

Preamble

# www/compose.yaml
services:
  web:
    image: nginx
# directory "www": networks are created based on directory names where "compose.yaml" is located
# "docker compose up" will create a www_defaults network

# actions/compose.yaml
services:
  api:
    image: notexisting/apihandler
    network:
      - www_defaults
networks:
  www_defaults:
    external: true

cloudflared setup using Docker Compose

services:
  cloudflared:
    image: cloudflare/cloudflared
    container_name: cloudflare-tunnel
    restart: unless-stopped
    command: tunnel --no-autoupdate run
    environment:
      - TUNNEL_TOKEN=${TUNNEL_TOKEN}
    volumes:
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

    networks:
      - cloudflared_default
networks:
  cloudflared_default:
    external: true

Example setup: Two cloudflared protected OpenAI WebUI

1. the first one is available publicly but protected by a WebUI password (using Streamlit’s secrets.toml). Those end users get access to gpt-4o-mini in the WebUI.

2. the second one is only accessible by users authorized by a One-time PIN sent to their email. Those users get access to more GPTs and the DallE component of the WebUI.

oaiwui_gptonly

services:
  oaiwui_gptonly:
    image: infotrend/openai_webui:latest
    container_name: oaiwui_gptonly_container
    restart: unless-stopped
    volumes:
      - ./savedir:/iti
      - ./secrets.toml:/app/.streamlit/secrets.toml:ro
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 18501:8501
    environment:
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - OAIWUI_SAVEDIR=/iti
      - OAIWUI_GPT_ONLY=True
      - OAIWUI_GPT_MODELS=gpt-4o-mini
      - OAIWUI_GPT_VISION=False
      - OAIWUI_DALLE_MODELS=dall-e-3
    networks:
      - cloudflared_default
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

networks:
  cloudflared_default:
    external: true

# you might require sudo permission for those commands
cd /opt/stacks/oaiwui_gptonly
mkdir savedir
nano secrets.toml
# add a line with: password = "SET_YOUR_PASSWORD_HERE"

oaiwui_full

services:
  oaiwui_full:
    image: infotrend/openai_webui:latest
    container_name: oaiwui_full_container
    restart: unless-stopped
    volumes:
      - ./savedir:/iti
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 28501:8501
    environment:
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - OAIWUI_SAVEDIR=/iti
      - OAIWUI_GPT_ONLY=False
      - OAIWUI_GPT_MODELS=gpt-4o-mini,gpt-4o
      - OAIWUI_GPT_VISION=True
      - OAIWUI_DALLE_MODELS=dall-e-3
    networks:
      - cloudflared_default
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

networks:
  cloudflared_default:
    external: true

Revision History

• 20240730-0: Passed timezone and watchtower label to docker compose

• 20240727-0: initial release