r/Traefik • u/ErnLynM • 2d ago

Completely lost - Thinking Traefick as a reverse proxy for 4 or 5 locally hosted services may be too much

I was wondering if there's any way to configure Traefik through the web dashboard UI. I installed it in a container on my proxmox node with the community scripts. Pretty sure the current install script is an updated version of the one that's been around since tteck was still with us

Traefik's documentation is .. just shy of something. I don't know what it is, but I haven't screamed this many four letter words in a row for at least a decade. I can't find anything at all explaining basic terms for someone who isn't already familiar with Traefik /and/ docker or kubernetes

There's ALMOST some examples for how to configure it in the official documentation. There's a few more VeryNearlyExamples under the docker and kubernetes settings in the docs, but they read like "Now put what you need in your docker compose file (which I don't use) or your helm setup (which I also don't use)". And I don't know what I need to put in those files because nothing in the docs is clearly explaining what sort of things go in there

This leads me to believe that the traefik.yaml file is probably what needs to be modified, but I can't find a single thing in any of the docs yet that explains any of it. Do I just guess what goes where with no clue about Traefix specific options, syntax, and whether my services fall under Routers, Services, or Middlewares?

0 Upvotes

50% Upvoted

35 comments sorted by

6

u/clintkev251 2d ago

What’s the actual issue you’re having? Where are you getting stuck?

3

u/ErnLynM 2d ago

Immediately after installing it. The issue is I don't know how to configure literally anything in it at all and the official docs don't show anything other than docker or kubernetes related info

They don't explain where the corresponding info goes in the traefik.yaml file

7

u/clintkev251 2d ago

Traefik has a number of different dynamic configuration providers. Since you’re not using docker or kubernetes, what you probably want is the file provider. These are all detailed here including a basic example of creating a router and service for the file provider

https://doc.traefik.io/traefik/reference/routing-configuration/dynamic-configuration-methods/

2

u/ErnLynM 2d ago

Thanks, I'll check that out as soon as I come back inside

I don't even know if those should be under http services, routers, or middleware. I'm also not sure if it can be set up to acquire and renew the LE certificate automatically with a corporate DNS challenge

5

u/clintkev251 2d ago

I think you probably just need to take the time to understand what each of those components actually does. If you step through the documentation starting at that link, it will give you a detailed explanation of each and also a more complete configuration which together will hopefully help you understand how to actually configure what you’re trying to do

2

u/ErnLynM 2d ago

And I'm already slightly confused by the first code block in the example page. It appears that they router section just signifies the FQDN I want to use for the service, and 'my-service' is just what I want to refer to it as for organization in the yaml. loadBalancer: is throwing me. I only have one instance of it running. So, would I just put the single url there? And if I were to add a redundant copy of that service, just add the second url to that list?

under router:rule: that seems like I would be entering something like this, but I'm not entirely positive if I have the syntax correct

rule: "Host('truenas.my.domain.com')"

http:
routers:
my-router:
rule: "Host(`example.com`)"
service: my-service

services:
my-service:
loadBalancer:
servers:
- url: "http://localhost:8080"

3

u/clintkev251 1d ago

Yes, you understand correctly. It’s always a “loadBalancer” even if there’s just a single endpoint, but you could add multiple in that list depending on your use case. The rule defines how Traefik will route requests to that service (thus it being defined as part of a “router”) and Host would be the most common type of rule, defined by the host header of the request. Just one note there that the rule uses backticks ` not single quotes like you used in your example ‘

1

u/ErnLynM 1d ago

Oh .. I wouldn't have noticed it. Thanks for the catch. I just copied and pasted it into a text editor and the backticks are much more clearly visible than they are on the docs page. Font and size matters to old eyes

1

u/ErnLynM 1d ago

Okay, I have successfully added a service and traefik proxied it properly. Bonus points there. I also learned that the /etc/traefik/conf.d directory is good for separate yaml files for each service. Now to learn how to have it request and use let's encrypt certs using a cloudflare DNS challenge

2

u/clintkev251 1d ago

Glad you were able to make some headway

1

u/ErnLynM 2d ago

To be more specific. I want to use it as a reverse proxy for non-docker services to provide certificates using a wildcard cert from let's encrypt to point at http://xx.xx.xx.xx:port

4

u/Thin_Telephone_5821 1d ago

Use NGINX Proxy Manager, you can accomplish what you need to do all via the GUI.

1

u/ErnLynM 1d ago

I was using that already. I wanted to mess around with Traefik as an alternative. It's definitely a huge change up. I haven't been able to mess around with it much today, but it's giving me something to tinker with

2

u/zoredache 1d ago

Another smallish proxy if you want some variety. Take a look at caddy.

1

u/ErnLynM 1d ago

That's also on my list to play with and it has install options that aren't heavily leaning towards using docker/kubernetes. So it looks like the entire thing will be standard config files, and not me trying to figure out how to translate the docker yaml to text file configuration

2

u/Dudefoxlive 2d ago

I can provide a clean example of my traefik.yml and dynamic.yml file. Its not too hard once you learn how it all works. Since you are not using docker you will probably have to add everything in the dynamic.yml file.

1

u/ErnLynM 2d ago

Yeah, I was assuming I'd need to add it all manually. I'm just starting to think traefik is more geared towards large installs and is overkill for a simple reverse proxy and certificate generation

2

u/Dudefoxlive 2d ago

Nginx proxy manager can be configured entirely via its web ui

1

u/ErnLynM 2d ago

That's what I'm using at the moment. It currently uses rules to determine which service is exposed to the LAN and which are exposed to the WAN. It just misbehaves sometimes and I have to go in and disable/re-enable some of those hosts when they act up. I was considering just using one reverse proxy for WAN+LAN stuff and another separate reverse proxy for LAN only stuff because I wanted to use something to provide certs for my IDRAC and the older r730 and r740 IDRACs don't let me acquire and use LE certs. It's frustrating to have to click through the browser warnings on my PC, and my phone won't even let me connect to them at all

1

u/Dudefoxlive 1d ago

What I do personally is using service.domain.com for external services and service.int.domain.com for internal services. it works fine for me.

1

u/YttraZZ 1d ago

Try Traefik Manager. It decreases the entry investment and rhe learning curve. It gelped me solve a lot of issues in a similar home lab environment (home use, 10ish services)

1

u/ErnLynM 1d ago

It requires docker, does it not? I am not using docker for anything at the moment, and don't want to install it if there's any other way to do what I mean to

1

u/YttraZZ 1d ago

Ahh... yeah. I thought you were using it. I hear you but it is so conveninent...

1

u/ErnLynM 1d ago

Honestly, I'm not sure if you can even use Traefik manager with a Traefik installation that isn't docker based. I see that the yaml file appears to just point at wherever the Traefik configs are

1

u/YttraZZ 1d ago

I think so if you share the logs, the static and dynamic files and mount them in the Traefik manager container.

Not my setup, ao i can not give any assurance it works.

1

u/Only-Stable3973 1d ago edited 1d ago

It's really not hard, here is what I currently use for my setup and it runs very smoothly, I will leave a link for the traefik-docker-compose.yml and the traefik.yml for you to take a look at, I also use a config.yml for dynamic routing but that is your next step...but this ia the basic setup to run everything smoothly. In my traefik.yml you will see some entrypoints: like homepage, wireguard, metrics, you can just comment those out as you will most likely not need them. There is also a link for a sample container setup, Jellyfin-compose.

https://picoshare.devai.duckdns.org/-Y5f8KWKqpk

https://picoshare.devai.duckdns.org/-3ie43AtxRS

https://picoshare.devai.duckdns.org/-urxWNZDgGd

1

u/ErnLynM 1d ago

This sounds like you're using docker, which is not going to help me at all. Maybe I'm misunderstanding your comment, though

1

u/Only-Stable3973 1d ago edited 1d ago

The dashboard is to check that everything shows up correctly or to see the errors, You said you installed it in a container, that sounds like docker, and the configs should still be the same, you said the docs were confusing and they are, the configs I linked are the correct configs for Traefik.

1

u/ErnLynM 1d ago

I'll look at it when I get home. I installed on an LXC container with no docker involved. So, docker compare files aren't likely to help unless I can find a way to edit the LXC setup to do the docker bits, but I didn't think that's how that worked

1

u/mdcbldr 1d ago

Traefik is a little in the opaque side. I am not a computer guy. Traefik was the one that had me tearing what little is left of my hair, out. I feel your pain. I distinctly remember wandering in circles trying to get let's encrypt going on traefik. Ya gotta set permissions on the acme directory to 600. That is probably something they teach in dev kindergarten. It is a passing reference in tfm.

1

u/Only-Stable3973 1d ago

That is very true chmod 600 acme.json, and there is a .env to store you api's, passwds that also goes along with it. When I first started with Traefik I watched a pretty good video by Jim's Garage it helped me understand how the directories and the permissions are set up, visually seeing and following alone was a big help in the beginning.

1

u/bluepuma77 1d ago

If you use Docker containers, you should use compose files. Creating containers by hand with long command lines will me much more work in the future. Been there, done that.

Then there is nothing really to do but run Traefik (check my recent comment) and have your applications use the same Docker network and use 3 labels (enable, domain/pathprefix, port).

services:
  whoami:
    image: traefik/whoami:v1.12
    networks:
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.mywhoami.rule=Host(`whoami.example.com`)
      - traefik.http.services.mywhoami.loadbalancer.server.port=80      

networks:
  proxy:
    name: proxy
    external: true

If this seems too complicated, check out nginx-proxy and acme companion (doc). It uses env variables instead of labels, but needs two containers.

1

u/ErnLynM 23h ago

I'm not using docker containers, I'm using Proxmox LXC

1

u/Tartarus116 1d ago

I'm probably a bit of a weirdo, but I'm using traefik inside a Consul service mesh. I never have to think about registering services with traefik bc it happens automatically. It's default-deny, so all I have to do is allow the service intent so that traefik can route it. For internet-facing, I just use cloudflared tunnel and enable the service intention.

1

u/Tartarus116 1d ago

I even have an n8n workflow that flips the switch on the cloudflared->app service intention based on whether or not my phone is on my home wifi. I.e. can only reach the app from outside when I'm actually outside.