I'm new to Traefik and have following basic question. Traefik should proxy NGINX. My goal is to start the stack either with http (f.e. locally) or with https (production): Therefore I've split the docker config in two yml files:
docker-compose-https.yml
version: "3.3"
services:
traefik:
image: "traefik:v2.4"
container_name: "traefik"
command:
- "--api.insecure=true"
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.http.redirections.entryPoint.to=websecure"
- "--entrypoints.web.http.redirections.entryPoint.scheme=https"
- "--entrypoints.web.http.redirections.entrypoint.permanent=true"
- "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.myresolver.acme.tlschallenge=true"
- "--certificatesresolvers.myresolver.acme.email=my#email.com"
- "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
ports:
- "443:443"
- "8080:8080"
volumes:
- "./letsencrypt:/letsencrypt"
- "/var/run/docker.sock:/var/run/docker.sock:ro"
docker-compose.yml
nginx:
image: nginx:alpine
ports:
- 80:80
labels:
- "traefik.enable=true"
- "traefik.http.routers.nginx.rule=Host('test.example.com')"
- "traefik.http.routers.nginx.entrypoints=websecure"
- "traefik.http.routers.nginx.tls.certresolver=myresolver"
This works so far. If I run docker-compose up -d with -f docker-compose-ssl.yml trafik jumps in for https and issues a cert. Without using it I can still start nginx over http. Unfortuantely what is not working is, as soon as Traefik is up it does not redirect http to https as my config should ask for. What do I oversee?
You need to use the RedirectScheme for the redirection from http to https and the middleware to the router as mentioned in https://doc.traefik.io/traefik/middlewares/overview/#configuration-example
So, your docker-compose.yml should look like this
nginx:
image: nginx:alpine
ports:
- 80:80
labels:
- "traefik.enable=true"
- "traefik.http.routers.nginx.entrypoints=web"
- "traefik.http.routers.nginx.rule=Host(`test.example.com`)"
- "traefik.http.middlewares.nginx-redirectscheme.redirectscheme.scheme=https"
- "traefik.http.routers.nginx.middlewares=nginx-redirectscheme"
- "traefik.http.routers.nginx-secured.entrypoints=websecure"
- "traefik.http.routers.nginx-secured.rule=Host(`test.example.com`)"
- "traefik.http.routers.nginx-secured.tls=true"
- "traefik.http.routers.nginx-secured.tls.certresolver=myresolver"
Related
I have the following instances of containers and all routing through Traefik as expected;
version: '3.3'
services:
website:
container_name: my-next-js-website
build:
context: .
dockerfile: Dockerfile.dev
ports:
- '3000:3000'
volumes:
- .:/srv
labels:
- traefik.http.routers.website.rule=Host(`domain.local`)
- traefik.enable=true
- traefik.port=3000
traefik:
image: traefik:v2.3
command:
- --entrypoints.web.address=:80
- --providers.docker
- --api
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
labels:
- traefik.http.routers.traefik.rule=Host(`traefik.domain.local`)
- traefik.http.routers.traefik.service=api#internal
- traefik.http.routers.traefik.middlewares=auth
- traefik.http.middlewares.auth.basicauth.usersfile=/path/to/userList
ports:
- '80:80'
Up until this point, it's all good.
My question is when I add $PWD/traefik.yml:/etc/traefik/traefik.yml as a volume and move the labels into this traefik.yml config, why does it not work in the same way (as in the basic auth is missing)?
What I'm trying to add is basic auth to Traefik so it's inaccessible but I can only do so via docker labels and not via traefik.yml - please, I would like to understand what I am doing incorrect or if I am missing something?
I've looked through the Traefik documentation with no luck and spent about 6 hours playing around with it... Do Docker labels and commands work better than the config file to set basic auth around Traefik's API and dashboard?
For the company I work at, I setup a docker environment using docker-composer and multiple containers so we can all benefit from having the same environment. I created a subdomain DNS record (dev.company.com) pointing to 127.0.0.1. This works fine for reaching projects from within the browser to the appropriate Apache vhosts. The problem however is that we cannot resolve this domain within the PHP container because the DNS points towards 127.0.0.1 how can I add a custom entry to the docker php container to resolve *.dev.company.com to the Apache container?
Also adding this to /etc/hosts is not really an option because we run like 50+ projects.
I found some solutions online which just said to add php to the same container, but this kinda defeats the purpose of having separate containers per service. Added docker-composer file as reference.
Note: I'm the only one using Linux in the office other colleagues are using Docker on Windows or Mac, so a Linux only solution won't cut it :)
version: "3.7"
services:
php:
build: php
env_file:
- ./conf/php.config.env
volumes:
- ./htdocs:/htdocs
expose:
- "9000"
links:
- mysql
- mssql
- mail
restart: always
init: true
apache:
build: apache
volumes:
- ./htdocs:/htdocs:ro
ports:
- "80:80"
- "443:443"
links:
- php
restart: always
init: true
mysql:
build: mysql
env_file:
- ./conf/mysql.config.env
volumes:
- ./mysql/data:/var/lib/mysql
ports:
- "3306:3306"
restart: always
mssql:
image: microsoft/mssql-server-linux
env_file:
- ./conf/mssql.config.env
volumes:
- ./mssql/data:/var/opt/mssql/data
ports:
- "1433:1433"
restart: always
mail:
image: schickling/mailcatcher
ports:
- "1080:1080"
restart: always
init: true
redis:
image: redis
expose:
- "6379"
links:
- php
restart: always
init: true
I want use traefik2.0 publish port 80 and 7000, the port 7000 is for frp(TCP). Now i am testing locally with 2.0 doc, i am using example on quick start but not running.
This is my docker compose file.
version: '3'
services:
reverse-proxy:
image: traefik:v2.0 # The official v2.0 Traefik docker image
command:
- "--api"
- "--entrypoints='Name:http Address::80'"
- "--providers.docker" # Enables the web UI and tells Traefik to listen to docker
- "--providers.docker.swarmmode=true"
- "--providers.docker.watch=true"
ports:
- "80:80" # The HTTP port
- "8080:8080" # The Web UI (enabled by --api)
networks:
- traefik-net
deploy:
replicas: 1
placement:
constraints:
- node.role == manager
labels:
- traefik.enable=false
volumes:
- /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
whoami:
image: containous/whoami # A container that exposes an API to show its IP address
networks:
- traefik-net
deploy:
labels:
- "traefik.http.routers.whoami.tls=true"
- "traefik.http.routers.whoami.entrypoints=https"
- "traefik.http.routers.whoami.rule=Host(`whoami.domain.com`)"
- "traefik.http.middlewares.whoami.redirectscheme.scheme=https"
networks:
traefik-net:
external: true
i expect which labels used on traefik2.0 can work
You're almost there!
Replace
- "--entrypoints='Name:http Address::80'"
with
- "--entryPoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
Enable the dashboard in a non-production environment. You'll also need to replace
- "--api" with
- "--api.insecure=true"
One of the labels of whoami has a mistake. There is no https entrypoint, it's now called websecure. So change
- "traefik.http.routers.whoami.entrypoints=https"
with
- "traefik.http.routers.whoami.entrypoints=websecure"
And finally expose the internal port that the whoami app is running on.
By adding this to the label of whoami
- traefik.http.services.whoami-service.loadbalancer.server.port=80
You should be able to verify it using the traefik dashboard on localhost:8080
I asked a question here and got part of my problem solved, but I was advised to create another question because it started to get a bit lengthy in the comments.
I'm trying to use docker to run multiple PHP,MySQL & Apache based apps on my Mac, all of which would use different docker-compose.yml files (more details in the post I linked). I have quite a few repositories, some of which communicate with one another, and not all of them are the same PHP version. Because of this, I don't think it's wise for me to cram 20+ separate repositories into one single docker-compose.yml file. I'd like to have separate docker-compose.yml files for each repository and I want to be able to use an /etc/hosts entry for each app so that I don't have to specify the port. Ex: I would access 2 different repositories such as http://dockertest.com and http://dockertest2.com (using /etc/hosts entries), rather than having to specify the port like http://dockertest.com:8080 and http://dockertest.com:8081.
Using the accepted answer from my other post I was able to get one app running at a time (one docker-compose.yml file), but if I try to launch another with docker-compose up -d it results in an error because port 80 is already taken. How can I runn multiple docker apps at the same time, each with their own docker-compose.yml files and without having to specify the port in the url?
Here's a docker-compose.yml file for the app I made. In my /etc/hosts I have 127.0.0.1 dockertest.com
version: "3.3"
services:
php:
build: './php/'
networks:
- backend
volumes:
- ./public_html/:/var/www/html/
apache:
build: './apache/'
depends_on:
- php
- mysql
networks:
- frontend
- backend
volumes:
- ./public_html/:/var/www/html/
environment:
- VIRTUAL_HOST=dockertest.com
mysql:
image: mysql:5.6.40
networks:
- backend
environment:
- MYSQL_ROOT_PASSWORD=rootpassword
nginx-proxy:
image: jwilder/nginx-proxy
networks:
- backend
ports:
- 80:80
volumes:
- /var/run/docker.sock:/tmp/docker.sock:ro
networks:
frontend:
backend:
I would suggest to extract the nginx-proxy to a separate docker-compose.yml and create a repository for the "reverse proxy" configuration with the following:
A file with extra contents to add to /etc/hosts
127.0.0.1 dockertest.com
127.0.0.1 anothertest.com
127.0.0.1 third-domain.net
And a docker-compose.yml which will have only the reverse proxy
version: "3.3"
services:
nginx-proxy:
image: jwilder/nginx-proxy
ports:
- 80:80
volumes:
- /var/run/docker.sock:/tmp/docker.sock:ro
Next, as you already mentioned, create a docker-compose.yml for each of your repositories that act as web endpoints. You will need to add VIRTUAL_HOST env var to the services that serve your applications (eg. Apache).
The nginx-proxy container can run in "permanent mode", as it has a small footprint. This way whenever you start a new container with VIRTUAL_HOST env var, the configuration of nginx-proxy will be automatically updated to include the new local domain. (You will still have to update /etc/hosts with the new entry).
If you decide to use networks, your web endpoint containers will have to be in the same network as nginx-proxy, so your docker-compose files will have to be modified similar to this:
# nginx-proxy/docker-compose.yml
version: "3.3"
services:
nginx-proxy:
image: jwilder/nginx-proxy
ports:
- 80:80
networks:
- reverse-proxy
volumes:
- /var/run/docker.sock:/tmp/docker.sock:ro
networks:
reverse-proxy:
# service1/docker-compose.yml
version: "3.3"
services:
php1:
...
networks:
- backend1
apache1:
...
networks:
- nginx-proxy_reverse-proxy
- backend1
environment:
- VIRTUAL_HOST=dockertest.com
mysql1:
...
networks:
- backend1
networks:
backend1:
nginx-proxy_reverse-proxy:
external: true
# service2/docker-compose.yml
version: "3.3"
services:
php2:
...
networks:
- backend2
apache2:
...
networks:
- nginx-proxy_reverse-proxy
- backend2
environment:
- VIRTUAL_HOST=anothertest.com
mysql2:
...
networks:
- backend2
networks:
backend2:
nginx-proxy_reverse-proxy:
external: true
The reverse-proxy network that is created in nginx-proxy/docker-compose.yml is referred as nginx-proxy_reverse-proxy in the other docker-compose files because whenever you define a network - its final name will be {{folder name}}_{{network name}}
If you want to have a look at a solution that relies on browser proxy extension instead of /etc/hosts, check out mitm-proxy-nginx-companion
Using Traefix version 1.2.3 from the docker container I've set up the following file.
traefik:
image: traefik
command: --web --docker --docker.domain=docker.localhost --logLevel=DEBUG
ports:
- "80:80"
- "8080:8080"
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /dev/null:/traefik.toml
services:
image: opencoredata/ocdservices:0.2
labels:
- "traefik.backend=services"
- "traefik.frontend.rule=Host:opencore.dev"
- "traefik.frontend.rule=PathPrefix:/api"
# web:
# image: opencoredata/ocdweb:0.3
# labels:
# - "traefik.backend=web"
# - "traefik.frontend.rule=Host:opencore.dev"
If I remove the comments around the "web" section all traffic will go to that container ignoring the Path or PathPrefix or any other attempt to get URLs with the beginning /api/ to go to the services container.
Commenting out the "web" container like above and the traffic goes to the services container. Which is expected since there is no other container of course.
I simply can not find how to get Traefik to work with Path, PathPrefix, PathPrefixStrip or any other combination. Examples here and in the docs seem to indicate I should get the behavior I want, but I can not realize it.
I think that this part
- "traefik.frontend.rule=Host:opencore.dev"
- "traefik.frontend.rule=PathPrefix:/api"
is wrong because second line overwrite the first one, try this :
- "traefik.frontend.rule=Host:opencore.dev;PathPrefix:/api"
I think it will combine stuff the way you want.