Create bootstrap doc

bootstrap.docker-compose.yml

@@ -1,6 +1,7 @@
 name: Bootstrap
 
 services:
+  # TODO: Authenticate the services that can talk to docker
   docker:
     image: alpine/socat
     command: tcp-listen:2375,fork,reuseaddr unix-connect:/var/run/docker.sock
@@ -12,6 +13,7 @@ services:
     labels:
       nas-compose.boostrap: true
 
+  # TODO: Sort out authentication method for all services (SSO). Authelia?
   traefik:
     image: traefik
     ports:
@@ -20,13 +22,14 @@ services:
     networks:
       - traefik
       - docker
+    # TODO: Move to configs?
     volumes:
-      - traefik_dynamic_config:/etc/traefik/dynamic/
+      - traefik_dynamic_config:/etc/traefik/dynamic/:ro
     configs:
       - source: traefik_config
         target: /etc/traefik/traefik.yml
     secrets:
-      - traefik_password
+      - traefik_password # TODO: Replace with SSO
       - traefik_tls_cert
       - traefik_tls_key
     depends_on:

docs/bootstrap.md

@@ -0,0 +1,56 @@
+# Bootstrap
+
+### Environment variables
+- `SERVICES_DIR`: Absolute path to the `services` folder
+
+## Docker
+[`alpine/socat`](https://hub.docker.com/r/alpine/socat/) exposes the docker socket as a port.
+
+### 🌐 Ports
+- `2375 TCP`: Docker API
+
+### 📂 Volumes
+- `/var/run/docker.sock`: Socket file from host mounted as it to be exposed.
+
+### 📒 Documentation
+- [socat](https://linux.die.net/man/1/socat) manual
+
+## Traefik
+[`traefik`](https://hub.docker.com/_/traefik) is a reverse proxy for docker services.
+
+### 🌐 Ports
+- `80 TCP`: HTTP access. Should always redirect to HTTPs
+- `443 TCP`: HTTPs access
+
+### 📂 Volumes
+- `traefik_dynamic_config`: Folder containing the dynamic configuration for `File` provider. See [traefik documentation](https://doc.traefik.io/traefik/providers/file/).
+
+### 📝 Configs
+- `traefik_config`: Static configuration from `File` provider. See [traefik documentation](https://doc.traefik.io/traefik/providers/file/).
+
+### 🔒 Secrets
+- `traefik_password`: Basic Auth username/password to access Traefik. Encoded using htpasswd (or [equivalent](https://hostingcanada.org/htpasswd-generator/)), use BCrypt at least.
+- `traefik_tls_cert`: Self-signed certificate for Traefik. Particularly useful in development to avoid generating new certificates on each restart.
+- `traefik_tls_key`: Self-signed private key for Traefik. Used with `traefik_tls_cert`.
+
+### 📒 Documentation
+- [Traefik](https://doc.traefik.io/) official documentation
+
+## Portainer
+[`portainer/portainer-ce`](https://hub.docker.com/r/portainer/portainer-ce) is a docker instance manager.
+Useful to manage the stacks/docker-compose configuration for the NAS.
+
+Set up to use the port exposed via the `Docker` container. It displays information about all docker resources available on the host. \
+It excludes all resources with the tag `nas-compose.boostrap: true`.
+
+### 🌐 Ports
+- `9443 TCP`: HTTPs (self-signed) access to the web interface
+
+### 📂 Volumes
+- ⚠️ `portainer_data`: All configuration and application data related to portainer. **It contains sensitive files**
+
+### 🔒 Secrets
+- `portainer_password`: Admin default admin's password
+
+### 📒 Documentation
+- [Portainer](https://docs.portainer.io/) official documentation