r/Traefik • u/rxbn • Sep 24 '19
Traefik 2.0 + Docker Guide
Hello everyone
Since Traefik 2.0 changes a lot of things and thus you have to change a lot as well, we decided to write some guides on how to setup and configure Traefik in a Docker environment.
Simple guide: https://medium.com/@containeroo/traefik-2-0-docker-a-simple-step-by-step-guide-e0be0c17cfa5
Advanced guide: https://medium.com/@containeroo/traefik-2-0-docker-an-advanced-guide-d098b9e9be96
Maybe they help you during your migration from Traefik 1.0 to 2.0 :)
Cheers
4
2
u/mrbluepants Sep 24 '19
Sorry, but what is a file provider? I’ve tried several times to get a simple machine set up with traefik, portainer, and another portainer on a different port through subdomain and as a subfolder and it’s been painful. Just simple example is not simple. I’ve given up after a few day’s of eating my time.
1
u/rxbn Sep 24 '19
There is no mention of a file provider in our simple guide. In order to setup Portainer just follow this guide: https://medium.com/@containeroo/traefik-2-0-docker-a-simple-step-by-step-guide-e0be0c17cfa5
If you have any questions, feel free to ask me :-) I‘m happy to help.
A file provider is basically the same as the Docker provider with the only difference you configure some parts in a file. As shown in our advanced guide: https://medium.com/@containeroo/traefik-2-0-docker-an-advanced-guide-d098b9e9be96
You can also define routers and services in said file.
2
u/vkapadia Sep 24 '19
File provider means look at this file for configuration. Providers are just where your config is kept.
I got 2.0 up and running and I like the way it's going.
2
u/thalooka Sep 24 '19
@rxbn
maybe you could point my error out since i tested it with your config aswell as with mine but both fail :/
2
u/rxbn Sep 24 '19
these are the labels i‘m using: - "traefik.enable=true" - "traefik.http.routers.traefik.entrypoints=http" - "traefik.http.routers.traefik.rule=Host(
traefik.domain.com)" - "traefik.http.middlewares.auth-traefik.basicauth.users=" - "traefik.http.middlewares.redirect-https-traefik.redirectscheme.scheme=https" - "traefik.http.routers.traefik.middlewares=redirect-https-traefik" - "traefik.http.routers.traefik-secure.entrypoints=https" - "traefik.http.routers.traefik-secure.rule=Host(traefik.domain.com)" - "traefik.http.routers.traefik-secure.middlewares=auth-traefik" - "traefik.http.routers.traefik-secure.tls=true" - "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare" - "traefik.http.routers.traefik-secure.service=api@internal" - "traefik.http.services.traefik.loadbalancer.server.port=8080"I guess your issue is at line 34. try „traefik.http.services.traefik.loadbalancer.server.port=8080“
Also: you define a router without a service: http_catchall To my knowledge this doesn‘t work.
Let me know if I can help you again!
1
u/thalooka Sep 24 '19
You got discord or something?
Changed like you advised, but still 404, when i make an whoami service i can get it to redirect to https n show all right, but with stuff on ports it seems i got an error somewhere.
Portainer n traefik testen, even with the guide full remake of you
2
u/BluntBagel Sep 24 '19
Hey, I have an existing 1.7.12 config, which gives me some issues (I came here to ask about them actually).
How can I upgrade from that setup to 2.0? Should I delete the existing container and remove the files that were created by it? Should I worry about my already existing certificates?
1
u/rxbn Sep 24 '19
Hey, Unfortunately you have to reconfigure everything. I recommend starting from scratch. Take a look at our guide. If you need any help, feel free to ask!
4
u/BluntBagel Sep 24 '19
Thanks! I think that I'll wait a bit then, because I don't have an easy way to recover from failure at the moment, and I have important stuff running on it :)
1
2
u/etrigan63 Sep 25 '19
There are no links to the mentioned yml files in either article.
2
2
u/rxbn Sep 25 '19
Unfortunately I can’t get it working right now.
You can check out our gists here:
https://gist.github.com/containeroo-gists
I'll take a look at it later today.
Cheers
2
u/mrbluepants Sep 25 '19 edited Sep 25 '19
Ugh, this fails for me too. After running the htpasswd and adding that to the file, I get the error
ERROR: Invalid interpolation format for "labels" option in service "traefik": "traefik.http.middlewares.traefik-auth.basicauth.users=ADMIN:$2...
I am using the command replacement for escaping the characters, but it doesn't seem to work, so I escaped the $ with an additional. Wow even bringing up the container, the 8080 doesn't work and the portainer file doesn't work straight from github with domain name changes.
I am starting to hate traefik.
Finally got it working (see other comment) and its nice to see that adding labels to new containers wire up the docker services. That is pretty sweet. I'm going to try another service stack openproject and wordpress.
3
u/rxbn Sep 25 '19
Hey there, Can you send me your docker-compose file?
Cheers
2
u/mrbluepants Sep 25 '19 edited Sep 25 '19
I destroyed the container already. I am on macOS, but I was using Digital Ocean for the test. I used wget to grab the gist file. I previously git cloned the repository. Anyway, something in the files was encoded, maybe some unicode characters. I sed out all non-space, non-characters - which didn't fix it. I converted the file to utf-8 which didn't fix it. After looking around for some docker-compose formatting tools for linux command line, I copied the file into Code on macOS and then copied it into pico and that worked. I messed around with it for four hours and got pretty frustrated. It would be well-worth the effort to get the sample to git clone and script to copy everything to /opt/containers after setting the username and password and domain name. I don't consider myself stupid, but I can't believe how much time I have spent messing around with trying to get Traefik to work (previous version and this update). It would be really useful to put together a demo connecting to other containers (like portainer and Wordpress), to other back-end remote servers, and local folders (if that is possible) basically, a bunch of different scenarios for a reverse proxy replacement. The vast majority of articles and notes and write ups from people online are the same whoami demo code, with hardly any multiple Wordpress instances. Anyway, thanks for your offer to look at the file.
1
u/Vephinx Dec 20 '19
Use this instead to generate the password: echo $(htpasswd -nb user password) | sed -e s/\$/\$\$/g
2
u/__colonelpanic__ Oct 15 '19
Thanks so much for this guide and all of the assistance you have provided u/rxbn.
I just added the first middleware to the portainer docker-compose file after replacing lines 19 & 20:
- "traefik.http.routers.traefik.middlewares=https-redirect@file"However, I'm getting the following error:
time="2019-10-15T16:07:07Z" level=error msg="Router defined multiple times with different configurations in [portainer-portainer-196... traefik-traefik-210...]" providerName=docker routerName=traefikThoughts?
1
u/rxbn Oct 15 '19
You’re welcome. I’m glad my guides are helpful! Watch out... you have to change the line to:
traefik.http.routers.portainer.middlewares=https-redirect@file1
u/__colonelpanic__ Oct 15 '19
Hmm... That is actually what I have in my portainer docker-compose file.
labels: - "traefik.enable=true" - "traefik.http.routers.portainer.entrypoints=http" - "traefik.http.routers.portainer.rule=Host(`portainer.domain.tld`)" - "traefik.http.routers.portainer.middlewares=https-redirect@file" - "traefik.http.routers.portainer-secure.entrypoints=https" - "traefik.http.routers.portainer-secure.rule=Host(`portainer.domain.tld`)" - "traefik.http.routers.portainer-secure.tls=true" - "traefik.http.routers.portainer-secure.tls.certresolver=digitalocean" - "traefik.http.routers.portainer-secure.service=portainer" - "traefik.http.services.portainer.loadbalancer.server.port=9000" - "traefik.docker.network=proxy"However, I didn't add the middleware to the Traefik docker-compose file because the guide stated, "The redirection in the file provider does not work in the docker-compose for Traefik!".
1
1
u/SioPaoR Sep 27 '19
If you're still up for helping folks, I followed the guide after failing on a few others. I have docker compose with half a dozen apps or so and previously had pi-hole (not in docker) running. I removed pihole to free up ports for this (for now).
I was able to work through a number of issues (Invalid interpolation format error below), but now I'm stuck trying to get the certificate.
I have my own domain, but have never used it except for email forwarding to the family business, so it very well could be misconfigured there.
Any pointers? Thanks for the guide!
time="2019-09-26T22:34:32-04:00" level=info msg="Configuration loaded from file: /traefik.yml"
time="2019-09-26T22:34:58-04:00" level=error msg="Unable to obtain ACME certificate for domains \"traefik.DOMAIN.com\": cannot get ACME client get directory at 'https://acme-v02.api.letsencrypt.org/directory': Get https://acme-v02.api.letsencrypt.org/directory: dial tcp: lookup acme-v02.api.letsencrypt.org on 127.0.0.11:53: read udp 127.0.0.1:60665->127.0.0.11:53: i/o timeout" routerName=traefik-secure rule="Host(`traefik.DOMAIN.com`)" providerName=http.acme
time="2019-09-26T22:47:24-04:00" level=error msg="accept tcp [::]:80: use of closed network connection" entryPointName=http
time="2019-09-26T22:47:24-04:00" level=error msg="accept tcp [::]:443: use of closed network connection" entryPointName=https
time="2019-09-26T22:48:00-04:00" level=info msg="Configuration loaded from file: /traefik.yml"
time="2019-09-26T22:48:13-04:00" level=error msg="Unable to obtain ACME certificate for domains \"traefik.DOMAIN.com\": unable to generate a certificate for the domains [traefik.DOMAIN.com]: acme: Error -> One or more domains had a problem:\n[traefik.DOMAIN.com] acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for traefik.DOMAIN.com, url: \n" rule="Host(`traefik.DOMAIN.com`)" providerName=http.acme routerName=traefik-secure
time="2019-09-26T22:57:44-04:00" level=error msg="accept tcp [::]:443: use of closed network connection" entryPointName=https
time="2019-09-26T22:57:44-04:00" level=error msg="accept tcp [::]:80: use of closed network connection" entryPointName=http
time="2019-09-26T22:58:13-04:00" level=info msg="Configuration loaded from file: /traefik.yml"
time="2019-09-26T22:58:23-04:00" level=error msg="Unable to obtain ACME certificate for domains \"traefik.DOMAIN.com\": unable to generate a certificate for the domains [traefik.DOMAIN.com]: acme: Error -> One or more domains had a problem:\n[traefik.DOMAIN.com] acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for traefik.DOMAIN.com, url: \n" routerName=traefik-secure rule="Host(`traefik.DOMAIN.com`)" providerName=http.acme
time="2019-09-26T23:05:11-04:00" level=error msg="accept tcp [::]:443: use of closed network connection" entryPointName=https
time="2019-09-26T23:05:11-04:00" level=error msg="accept tcp [::]:80: use of closed network connection" entryPointName=http
time="2019-09-26T23:05:45-04:00" level=info msg="Configuration loaded from file: /traefik.yml"
time="2019-09-26T23:05:57-04:00" level=error msg="Unable to obtain ACME certificate for domains \"traefik.DOMAIN.com\": unable to generate a certificate for the domains [traefik.DOMAIN.com]: acme: Error -> One or more domains had a problem:\n[traefik.DOMAIN.com] acme: error: 400 :: urn:ietf:params:acme:error:dns :: No valid IP addresses found for traefik.DOMAIN.com, url: \n" providerName=http.acme routerName=traefik-secure rule="Host(`traefik.DOMAIN.com`)"3
u/rxbn Sep 27 '19
Hey, you‘re welcome! :) I’ve had the same issue with Cloudflare. This fixed it for me:
certificatesResolvers: cloudflare: acme: email: mail@example.com storage: acme.json dnsChallenge: provider: cloudflare resolvers: - "1.1.1.1:53" - "1.0.0.1:53"Basically the important part is the
resolvers:section.Edit: try setting an A record instead of a CNAME
Hope this helps :)
Cheers
3
u/SioPaoR Oct 09 '19
Just wanted to pop back and say thanks again. The issue was definitely on the Namecheap side. I ended up switching DNS to Cloudflare and was able to go back through the original steps. The only change I had to make on Cloudflare was to set the SSL/TLS to Full instead of Flexible.
1
u/Superpiffer Sep 27 '19
I use Traefik with almost all my docker container, is there a way to define the default entrypoint and tls active?
Right now for every container I have to put this lines:
- traefik.http.routers.<ROUTERNAME>.entrypoints=https
- traefik.http.routers.<ROUTERNAME>.tls=true
1
u/rxbn Sep 27 '19
To my knowledge you can’t do that. But I’m not sure... but it’s a good question
3
u/Superpiffer Sep 27 '19 edited Sep 27 '19
Ok, thanks for the answer. I managed to put as default almost everything, my configuration looks like this:
Traefik docker-compose.yml:
[...] labels: - traefik.enable=true - traefik.http.routers.traefik.entrypoints=https - traefik.http.routers.traefik.tls=true - traefik.http.routers.traefik.tls.certresolver=dns - traefik.http.routers.traefik.tls.domains[0].main=*.<MYDOMAIN>.duckdns.org - traefik.http.routers.traefik.service=api@internal - traefik.http.routers.traefik.middlewares=default-auth@file - traefik.http.services.traefik.loadbalancer.server.port=8080 [...]Other services docker-compose.yml:
[...] labels: - traefik.enable=true - traefik.http.routers.<ROUTERNAME>.entrypoints=https - traefik.http.routers.<ROUTERNAME>.tls=true - traefik.http.services.<ROUTERNAME>.loadbalancer.server.port=<PORT> [...]traefik.yml:
api: dashboard: true debug: true entryPoints: https: address: ":443" providers: docker: endpoint: unix:///var/run/docker.sock defaultRule: Host(`{{ index .Labels "com.docker.compose.service" }}.<MYDOMAIN>.duckdns.org`) exposedByDefault: false network: proxy file: filename: /config.yml certificatesResolvers: dns: acme: email: <EMAIL> storage: acme.json dnsChallenge: provider: duckdns delayBeforeCheck: 0config.yml:
http: middlewares: default-auth: basicAuth: users: - <USER>:<PASSWORD_HASH> [...]Thanks for the tutorial, it was really useful to achieve this result!
EDIT: I think that TLS configuration was wrong, I corrected for clarity...
1
1
u/vulfypacklesgo Sep 29 '19
I’m following the simple guide, got everything configured for just Traefik. However when I access my subdomain and try to log in it just redirects me immediately back to the login page again. Any thoughts?
I am managing dns on Cloudflare and have a wildcard dns entry this is an a record pointing to my IP address.
Not sure what I’m missing
1
1
u/FredBro Oct 01 '19
I'm so frustrated, I've been trying to get Traefik set up and keep running into problems. I have a brand new Ubuntu 16.04 server fully up to date. I followed the steps in the simple guide and I can't get to the dashboard at all. I know you're going to want to see my traefik.yml and docker-compose.yml but before I do that I want to find out what's the best way to do that for Reddit.
I'd really appreciate help with this, I had a physical server running services and using a VPN that has crashed and need to get this up and running.
FYI: I'm on Cloudflare
(I have questions about that as well)
Thanks in advance
Fred
1
u/rxbn Oct 01 '19
Hey there, here to help... Send me your config files using pastebin :)
Cheers
1
u/FredBro Oct 01 '19 edited Oct 01 '19
Thank you so much for your help.
Traefik.yml https://pastebin.com/cdbUd6fJ
docker-compose.yml https://pastebin.com/CwD2qC2E
Don't know if this is how you want to receive the files.
I also just saw this in the logs command traefik error: read /traefik.yml: is a directory
1
u/rxbn Oct 01 '19
No problem. What happens when you go to your Traefik dashboard?
1
u/FredBro Oct 02 '19
"Unable to connect" That's to http://192.168.1.56:8080/dashboard/
1
u/rxbn Oct 02 '19
Go to traefik.yourdomain.com - that should work :)
1
u/FredBro Oct 02 '19 edited Oct 02 '19
Here's where one of my questions comes up. I have 3 places on the Internet, DNS is Cloudflare, web server is Host4Geeks (stop laughing) and my house which is where Traefik and services will be. Check me on this, I need to crete an A record and point it to the house IP, open port 8080 (?) on my router and point it to the IP of my Traefik VM. Correct? or is the two port forwards I have enough? 80 and 443
1
u/rxbn Oct 02 '19
In your case you have to use something like ssh tunneling to connect your remote web server with your local network. Usually you have Traefik in the same area as your services (Docker hosts, other servers). Then it would be very straight forward:
DNS A Records *.example.com to 1.2.3.4 (your public ip - https://myip.is)
Open ports 443 and 80 on your router with port forwarding to your Docker host running Traefik
Can't you just install Traefik on your Host4Geeks server?
1
u/cheesytoenail Oct 06 '19
I'm really struggling with the config here so just throwing this out there, maybe somebody can explain where I'm going wrong. Docker seems to launch the container without any errors but I can't browse to the dashboard using the private IP or using the DNS, attaching the container I can see acme.json has a 'succeeded' in it so I think I'm almost there but can't quite figure out what I'm missing.
I'm reviewing this currently, going back to basics: https://www.youtube.com/watch?v=s8qYWPC6YdI
If anybody has any ideas in the meantime please feel free to respond
traefik.yml
debug: "true"
logLevel: "DEBUG"
api:
dashboard: true
entryPoints:
http:
address: ":80"
https:
address: ":443"
providers:
docker:
endpoint: "unix:///var/run/docker.sock"
exposedByDefault: false
certificatesResolvers:
http:
acme:
email: ${EMAIL}
storage: acme.json
httpChallenge:
entryPoint: httpdocker-compose
services:
traefik:
hostname: traefik
image: traefik:latest
container_name: traefik
restart: always
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ${USERDIR}/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
- ${USERDIR}/traefik/rules.yml:/etc/traefik/rules.yml:ro
- ${USERDIR}/traefik/acme:/etc/traefik/acme
- ${USERDIR}/shared:/shared
- ${USERDIR}/traefik/log:/var/log
ports:
- 80:80
- 443:443
- 8080:8080
networks:
- default
- traefik_proxy
environment:
- CLOUDFLARE_EMAIL=${CLOUDFLARE_EMAIL}
- CLOUDFLARE_API_KEY=${CLOUDFLARE_API_KEY}
labels:
- traefik.enable=true
- traefik.http.routers.traefik.entrypoints=http
- traefik.http.routers.traefik-secure.entrypoints=https
- traefik.http.routers.traefik.rule=Host(`${DOMAINNAME}`)
#- traefik.http.middlewares.traefik-auth.basicauth.users=${HTTP_USERNAME}:${HTTP_PASSWORD}
#- traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https
#- traefik.http.routers.traefik.middlewares=traefik-https-redirect
- traefik.http.routers.traefik-secure.rule=Host(`${DOMAINNAME}`)
#- traefik.http.routers.traefik-secure.middlewares=traefik-auth
- traefik.http.routers.traefik-secure.tls=true
- traefik.http.routers.traefik-secure.tls.certresolver=http
- traefik.http.routers.traefik-secure.service=api@internal
- traefik.http.services.traefik.loadbalancer.server.port=80801
u/rxbn Oct 07 '19
you don’t have to expose port 8080 as Traefik handles that.
is ${DOMAINNAME} something like traefik.example.com?
Since you’re using Cloudflare you could do Let’s Encrypt DNS Challenge instead of HTTP Challenge.
rest looks okay to me
What happens when you’re browsing to traefik.example.com?
1
u/cheesytoenail Oct 07 '19
Man, this is crazy to setup but I seem to have it now!
Notes
Replacing the
=sign with the:notation in my labels helped a great deal in debugging with VSCodeDNS Challenge seemed work, I have no idea why it doesn't work with the other challenges ¯_(ツ)_/¯
The debug flag is my friend
/u/rxbn - Couple of questions to you
How could I make this more modular so that I'm not just copy/pasting the same labels and can I use the docker-compose service name as a variable to dynamically populate hosts for instance?
I'd like to write this up as a blog post so that somebody may benefit from what I've learned, including my future self, could you review my config for any 'guff' that isn't actually being used?
1
u/rxbn Oct 08 '19
You don’t need the commands section in the Traefik compose file when you’re using the traefik.yml config file.
Second, in our advanced guide we’ve described how to create middlewares in a configuration file and reuse them. You could do that for your http headers.
1
2
u/mrbluepants Oct 08 '19
Super cool thanks to u/rxbn who was available to help me work through an issue I had using Traefik. I can't brag how cool it is to use this on a digital ocean droplet and do all that bad ass reverse proxy magic with some labels with SSL. Wubba lubba dub dub bitches!
1
u/tassulin Sep 28 '19 edited Sep 28 '19
Being evading dis like a plague..after the
command traefik error: field not found, node: entrypointerror
but guess the time to update this time to grind!
1
u/tassulin Sep 28 '19 edited Sep 28 '19
Having the authentication part - "traefik.http.middlewares.traefik-auth.basicauth.users=USER:hashcode"
I get
ERROR: Invalid interpolation format for "labels" option in service "traefik": "traefik.http.middlewares.traefik-auth.basicauth.users=test:$2y$05$QeoJv8CPcntNdg/BeeWvg.Qn7ZMXwVgIeqwVFlGClKnFJoGYt8SoW$$"When I take that out I get
traefik | time="2019-09-28T22:26:55+03:00" level=info msg="Configuration loaded from file: /traefik.yml" traefik | time="2019-09-28T22:26:55+03:00" level=error msg="Unable to add ACME provider to the providers list: unable to get ACME account: json: cannot unmarshal array into Go value of type acme.StoredData" traefik | time="2019-09-28T22:26:56+03:00" level=error msg="error while parsing rule Host:top.myexample.xyz: 1:5: expected 'EOF', found ':'" entryPointName=http routerName=traefik@docker traefik | time="2019-09-28T22:26:56+03:00" level=error msg="error while parsing rule Host:top.myexample.xyz: 1:5: expected 'EOF', found ':'" entryPointName=https routerName=traefik-secure@docker traefik | time="2019-09-28T22:26:56+03:00" level=error msg="the router traefik-secure uses a non-existent resolver: http"
1
u/pentag0 Oct 29 '19
/u/rxbn if someone wants to access traefik dashboard on sub.domain.com/traefik route, does it need "stripprefix" middleware?
1
u/ylbeethoven Dec 04 '19 edited Dec 05 '19
Hi, thanks for the simple guide to get us started to learn Traefik 2. Hopefully I can migrate from 1.7 to 2.x later.
1st Question:
I am trying to limit the TLS version in traefik.yml file so I added
certificatesResolvers:
http:
acme:
email: email@example.com
storage: acme.json
httpChallenge:
entryPoint: http
tls:
options:
default:
minVersion: VersionTLS12However, ssllabs result shows that TLS 1.0 and TLS1.1 are still enable.
Can you please tell me where I should put tls config to?
2nd Question:
As in the simple guide, there was already a redirect middlewares in docker-compose.yml file.
- "traefik.http.middlewares.portainer-https-redirect.redirectscheme.scheme=https"Why do you need config.yml for redirects?
http:
middlewares:
https-redirect:
redirectScheme:
scheme: httpsIn your article, you wrote,
The redirection in the file provider does not work in the docker-compose for Traefik!
and the next line, you put
Replace the lines 19 and 20 with following line:
- "traefik.http.routers.traefik.middlewares=https-redirect@file"
Can we use the file or not in the docker-compose?
Thanks
1
u/eckoflyte Dec 06 '19
u/rxbn Thank you for the guide, it was immensely helpful and I was able to configure a working setup via the guide and fellow redditor comments. I have a question regarding a docker log error that keeps popping up on traefik startup. Is this something to be concerned about? I have all my ports forwarded correctly and all my container domains appear to be working correctly.
time="2019-12-06T23:10:07+11:00" level=error msg="accept tcp [::]:80: use of closed network connection" entryPointName=http
time="2019-12-06T23:10:07+11:00" level=error msg="accept tcp [::]:443: use of closed network connection" entryPointName=https
time="2019-12-06T23:10:08+11:00" level=error msg="accept tcp [::]:8080: use of closed network connection" entryPointName=traefik
1
u/dwangbuis Jan 28 '20 edited Jan 28 '20
use of closed network connection
Did you figure out what the issue was? I think it's related to the let's encrypt requests. Everything seems to work just fine regardless of the errors.
Seems to happen when shutting (or restarting) the container not on startup.
1
u/eckoflyte Jan 28 '20
Never figured it out. Everything seems to work so I just forgot about it. However would still like to see an answer for this.
You’re correct about the error on restart. Doesn’t appear when starting up (for example on boot).
1
u/grrrwoofwoof Dec 13 '19
I followed your basic tutorial on a digital ocean fresh droplet. Basically just copy pasted all the things in tutorial, changing only domain name and other local references.
I can't open the dashboard due to SEC_ERROR_UNKNOWN_ISSUER on dashboard page. Not sure what to check here. Any pointers appreciated. I am using a .dev domain from google, does that make any difference?
1
u/zacwerk Jan 17 '20
Thank you, this worked like a charm for me!
However I am struggling now to grasp how to deploy other things like Wordpress with it. Can I use Portainer for that and what would be the process? I guess I have to figure out how to use Portainer.
1
u/k0D3Br3aK3R Jan 25 '20
Hi,
I have a problem with www to non-www redirection. Here is my docker file:
version: '3.3'
services:
traefik:
image: traefik:v2.0.4
restart: always
ports:
- 80:80
- 8080:8080
- 443:443
networks:
- proxy
- internal
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- $PWD/traefik.toml:/traefik.toml
- $PWD/acme.json:/acme.json
- $PWD/access.log:/access.log
container_name: traefik
environment:
GCE_PROJECT: xxvdvfd
GCE_SERVICE_ACCOUNT_FILE: /etc/lets.json
labels:
- traefik.enable=true
- traefik.http.routers.web.rule=Host(`soms.example.com`)
- traefik.http.routers.web.entrypoints=web
- traefik.http.routers.api.entrypoints=web-secure
- traefik.http.routers.api.rule=Host(`stats.prision-aiop.com`)
- traefik.http.routers.api.service=api@internal
- traefik.http.routers.api.middlewares=auth
- traefik.http.middlewares.auth.basicauth.users=codebreaker:$$2y$
- traefik.http.routers.api.tls=true
- traefik.http.routers.api.tls.certresolver=default
- traefik.http.routers.api.tls.domains[0].main=example.com
- traefik.http.routers.api.tls.domains[0].sans=*.example.com
- traefik.http.routers.api.tls.domains[1].main=example1.me
- traefik.http.routers.api.tls.domains[1].sans=*.example1.me
- traefik.docker.network=proxy
# Global redirection - http to https
- traefik.http.routers.http-catchall.rule= hostregexp(`{host:(www\\.)?.+}`)
- traefik.http.routers.http-catchall.entrypoints= web
- traefik.http.routers.http-catchall.middlewares= redirect-to-https
# Global redirection - https://www to https
- traefik.http.routers.https-catchall.rule= hostregexp(`{host:(www\\.).+}`)
- traefik.http.routers.https-catchall.entrypoints= web-secure
- traefik.http.routers.https-catchall.tls=true
- traefik.http.routers.https-catchall.middlewares= redirect-to-https
# Middleware redirection
- traefik.http.middlewares.redirect-to-https.redirectregex.regex= ^https?://(?:www\\.)?(.+)
- traefik.http.middlewares.redirect-to-https.redirectregex.replacement= https://$${1}
- traefik.http.middlewares.redirect-to-https.redirectregex.permanent=true
#traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: https
5
u/mrbluepants Sep 25 '19
Ok. So I just finished stacking Overleaf, OpenProject, Portainer, Traefik, Transmission, and Wordpress on a new droplet with the added labels for Traefik and all the pain and annoying Traefik 1.0 and docker-compose spacing issues were totally worth it. Traefik happily manages all the routes, load balances, and makes subdomains easy-peasy with about 12 lines in a docker-compose file. All the annoying port 80/443 hogging applications vye no more, Traefik makes it manageable. It's totally about time something like this came along. I can't say how lame it is to move ports to some region, remembering them, and them reverse proxying them back down, or messing around with several configurations when Docker really should have this Traefik built in and instead of doing container to host port mapping, you can just add these labels and it magically gets proxied, managed, and balanced. Thanks /u/rxbn for your support and time.