Guia completa: Instal·lació de Traefik + WordPress + PHP + MariaDB des de zero

# Connectar al VPS
ssh root@IP_DEL_VPS

# Actualitzar
apt update && apt upgrade -y

# Instal·lar eines bàsiques
apt install -y curl wget git vim nano htop net-tools dnsutils

# Crear usuari
adduser jordi

# Afegir a sudoers
usermod -aG sudo jordi

# Canviar a aquest usuari
su - jordi

# Instal·lar dependències
sudo apt install -y apt-transport-https ca-certificates curl gnupg lsb-release

# Afegir clau GPG de Docker
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

# Afegir repositori Docker
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Instal·lar Docker
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Afegir usuari al grup docker (opcional)
sudo usermod -aG docker $USER

# Reiniciar sessió per aplicar canvis
exit
# Tornar a connectar

docker --version
docker compose version

A    popotamo.cat           → IP_DEL_VPS
A    www.popotamo.cat       → IP_DEL_VPS
A    wordpress.popotamo.cat → IP_DEL_VPS
A    jordi.popotamo.cat     → IP_DEL_VPS
A    db.popotamo.cat        → IP_DEL_VPS
A    traefik.popotamo.cat   → IP_DEL_VPS

dig +short popotamo.cat
dig +short wordpress.popotamo.cat

mkdir -p ~/traefik/config
cd ~/traefik

# Instal·lar apache2-utils
sudo apt install -y apache2-utils

# Generar hash de contrasenya
htpasswd -nb admin VostraContrasenya

# Exemple sortida:
# admin:$apr1$ruca1234$abcdefghijklmnop

docker network create proxy

cat > ~/traefik/traefik.yml << 'EOFTRAEFIK'
api:
  dashboard: true
  debug: true
  insecure: true

entryPoints:
  http:
    address: ":80"
  https:
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: proxy
  file:
    directory: /config
    watch: true

certificatesResolvers:
  letsencrypt:
    acme:
      email: el_teu_email@gmail.com
      storage: acme.json
      httpChallenge:
        entryPoint: http

log:
  level: DEBUG
EOFTRAEFIK

mkdir -p ~/traefik/config
cat > ~/traefik/config/middlewares-cors.yml << 'EOFCORS'
http:
  middlewares:
    cors-headers:
      headers:
        accessControlAllowMethods:
          - GET
          - POST
          - PUT
          - DELETE
          - OPTIONS
          - PATCH
        accessControlAllowHeaders:
          - "*"
        accessControlAllowOriginList:
          - "https://jordi.popotamo.cat"
          - "https://wordpress.popotamo.cat"
          - "https://www.popotamo.cat"
        accessControlMaxAge: 100
        addVaryHeader: true
        accessControlAllowCredentials: true

    security-headers:
      headers:
        frameDeny: true
        contentTypeNosniff: true
        browserXssFilter: true
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 31536000
EOFCORS

cat > ~/traefik/docker-compose.yml << 'EOFCOMPOSE'
services:
  traefik:
    image: traefik:v2.11
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    environment:
      - TZ=Europe/Madrid
      - DOCKER_API_VERSION=1.44
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
      - ./acme.json:/acme.json
      - ./config:/config:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik-dashboard.rule=Host(\`traefik.popotamo.cat\`)"
      - "traefik.http.routers.traefik-dashboard.entrypoints=https"
      - "traefik.http.routers.traefik-dashboard.tls=true"
      - "traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik-dashboard.service=api@internal"
      - "traefik.http.routers.traefik-dashboard.middlewares=traefik-auth"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=admin:$$apr1$$ruca1234$$abcdefghijklmnop"

networks:
  proxy:
    external: true
EOFCOMPOSE

cd ~/traefik
touch acme.json
chmod 600 acme.json
docker compose up -d
docker compose logs -f

mkdir -p ~/wordpress-popotamo/{backups,scripts}
cd ~/wordpress-popotamo