Unity + Mirror over WebSockets using traefik as a reverse proxy

.dockerignore

*
!/Builds/
!nginx.conf

docker-compose.yml

version: "3.9"

services:
  traefik:
    image: traefik:2.6
    restart: always
    container_name: "traefik"
    hostname: "traefik.$YOUR_DOMAIN"
    ports:
      - "80:80"
      - "443:443"
      - "80:80/udp"
      - "443:443/udp"
    command:
      - --api=true
      - --api.dashboard=true
      - --log.level=INFO
      - --accesslog
      - --experimental.http3=true

      # Entrypoints
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http3=true

      # Use let's encrypt to generate certificates
      - --certificatesresolvers.le.acme.storage=/traefik/letsencrypt/le.json
      - --certificatesresolvers.le.acme.tlschallenge=true
      - --certificatesresolvers.le.acme.email=$YOUR_EMAIL

      # Docker
      - --providers.docker=true
      - --providers.docker.network=proxy
      - --providers.docker.exposedByDefault=false
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt:/traefik/letsencrypt
    labels:
      - "traefik.enable=true"

      - "traefik.http.routers.traefik.rule=Host(`traefik.$YOUR_DOMAIN`)"
      - "traefik.http.routers.traefik.tls.certresolver=le"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.service=api@internal"

  server:
    restart: always
    build:
      dockerfile: Dockerfile.Server
      context: .
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.mirror-test-server.rule=Host(`server.$YOUR_DOMAIN`)"
      - "traefik.http.routers.mirror-test-server.tls.certresolver=le"
      - "traefik.http.routers.mirror-test-server.entrypoints=websecure"
      - "traefik.http.services.mirror-test-server.loadbalancer.server.port=443"

  webgl:
    restart: always
    build:
      dockerfile: Dockerfile.WebGL
      context: .
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.mirror-test-webgl.rule=Host(`client.$YOUR_DOMAIN`)"
      - "traefik.http.routers.mirror-test-webgl.tls.certresolver=le"
      - "traefik.http.routers.mirror-test-webgl.entrypoints=websecure"
      - "traefik.http.services.mirror-test-webgl.loadbalancer.server.port=80"

volumes:
  letsencrypt:

networks:
  default:
    name: "proxy"
    external: true

Dockerfile.Server

FROM ubuntu

WORKDIR /var/game

COPY ./Builds/Linux /var/game

CMD [ "./build.x86_64" ]

Dockerfile.WebGL

FROM nginx:alpine

COPY nginx.conf /etc/nginx/conf.d/default.conf
COPY ./Builds/WebGL /usr/share/nginx/html

nginx.conf

# https://docs.unity3d.com/Manual/webgl-server-configuration-code-samples.html
server {
    listen 80;
    root /usr/share/nginx/html;
    index index.html;
    server_tokens off;

    location = /index.html {
        add_header Cache-Control 'no-store';
    }

    # On-disk Brotli-precompressed data files should be served with compression enabled:
    location ~ .+\.(data|symbols\.json)\.br$ {
        # Because this file is already pre-compressed on disk, disable the on-demand compression on it.
        # Otherwise nginx would attempt double compression.
        gzip off;
        add_header Content-Encoding br;
        default_type application/octet-stream;
    }

    # On-disk Brotli-precompressed JavaScript code files:
    location ~ .+\.js\.br$ {
        gzip off; # Do not attempt dynamic gzip compression on an already compressed file
        add_header Content-Encoding br;
        default_type application/javascript;
    }

    # On-disk Brotli-precompressed WebAssembly files:
    location ~ .+\.wasm\.br$ {
        gzip off; # Do not attempt dynamic gzip compression on an already compressed file
        add_header Content-Encoding br;
        # Enable streaming WebAssembly compilation by specifying the correct MIME type for
        # Wasm files.
        default_type application/wasm;
    }

    # On-disk gzip-precompressed data files should be served with compression enabled:
    location ~ .+\.(data|symbols\.json)\.gz$ {
        gzip off; # Do not attempt dynamic gzip compression on an already compressed file
        add_header Content-Encoding gzip;
        default_type application/octet-stream;
    }

    # On-disk gzip-precompressed JavaScript code files:
    location ~ .+\.js\.gz$ {
        gzip off; # Do not attempt dynamic gzip compression on an already compressed file
        add_header Content-Encoding gzip;
        default_type application/javascript;
    }

    # On-disk gzip-precompressed WebAssembly files:
    location ~ .+\.wasm\.gz$ {
        gzip off; # Do not attempt dynamic gzip compression on an already compressed file
        add_header Content-Encoding gzip;
        # Enable streaming WebAssembly compilation by specifying the correct MIME type for
        # Wasm files.
        default_type application/wasm;
    }
}