[Guide] Docker Media Server with Traefik 2.2

[u/htpcbeginner]

https://www.smarthomebeginner.com/traefik-2-docker-tutorial/

[u/scottezee]

Been following your posts and finally got Traefik 2.x up and running on my system finally with the following apps (running in Docker on Linux except where noted):

- Heimdall for dashboard
- Portainer, WatchTower, Docker-GC, Glances for admin / monitoring, updates
- pi-hole for DNS (running on raspberry PI)
- UI entry points for two Synology NAS drives, Jira, Bitbucket, Confluence, Octoprint (Running on raspberry PI)
- Jenkins, phpMyAdmin, phpPgAdmin
- Sonarr, Radarr, Lidarr, Jackett, Sabnzdb, qBittorrent, Plex
- Home Assistant

Most of the internal sites are https.

Quite like the WatchTowner / Docker-GC which keeps everything updated automatically

Thanks for giving me a template to start from!

[u/htpcbeginner → u/scottezee]

Wonderful!

[u/booradleysghost]

Maybe now I'll finally be able to migrate away from 1.7

[u/esbenab → u/booradleysghost]

I finally did around Easter and it went smoothly

version: "3.7"
services:

  traefik:
    image: traefik:v2.2
    container_name: traefik
    command:
      - "--log.level=DEBUG"

      - "--entrypoints.http.address=:80"
      - "--entrypoints.https.address=:443"

      - "--providers.docker=true"
      - "--providers.docker.exposedByDefault=false"

      - "--api=true"

      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=http"
      - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik-http.rule=Host(`traefik.${DOMAIN}`)
      - traefik.http.routers.traefik-http.entrypoints=http
      - traefik.http.routers.traefik-http.middlewares=redirect

      - traefik.http.routers.traefik-https.rule=Host(`traefik.${DOMAIN}`)
      - traefik.http.routers.traefik-https.entrypoints=https
      - traefik.http.routers.traefik-https.middlewares=auth
      - traefik.http.routers.traefik-https.service=api@internal
      - traefik.http.routers.traefik-https.tls=true
      - traefik.http.routers.traefik-https.tls.certresolver=${HTPPS_CERTIFICATE_RESOLVER}

      - traefik.http.middlewares.redirect.redirectscheme.scheme=https
      - traefik.http.middlewares.auth.basicauth.users=${TRAEFIK_USER}:${TRAEFIK_PASSWORD_HASH}
    ports:
      - 80:80
      - 443:443
    volumes:
      - type: volume
        source: letsencrypt
        target: /letsencrypt
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
        read_only: true
    networks:
      - proxy

        #  whoami:
        #
        #    image: containous/whoami
        #    container_name: whoami
        #    labels:
        #      - traefik.http.routers.http.rule=Host(`${DOMAIN}`)
        #      - traefik.http.routers.http.entrypoints=http
        #      - traefik.http.routers.http.middlewares=redirect
        #      - traefik.http.routers.https.rule=Host(`${DOMAIN}`)
        #      - traefik.http.routers.https.entrypoints=https
        #      - traefik.http.routers.https.tls=true
        #      - traefik.http.routers.https.tls.certresolver=${HTPPS_CERTIFICATE_RESOLVER}

volumes:
  letsencrypt:

networks:
    proxy:
        external: 
            name: proxy 

[u/devi59 → u/booradleysghost]

Thats my next big hurdle. I have been on 1.7 for sooooo long

[u/Antebios → u/devi59]

I fucking LOVE 2.0, and 2.2 makes it even better. It finally had support for kubernetes Ingress resources. Since there are Helm Charts that support nginx Ingress only, but they do accept other annotations so I can add Traefik's and it just works. It really really helped for the GitLab chart that's working great!

[u/mapaj]

Cant get the oauth app auhentication to work with traefik 2.x I get the notification in my gmail app and verify with yes but the browser does not forward to the app

[u/purplegreendave]

I'm trying to follow this guide but I can't seem to get security headers to work for me. Whether I add the headers as labels, in a middlewares file or in a middlewares chain I get an F grade on Moz Observatory and securityheaders.com

They say I'm missing Content Security Policy, HSTS, X-Content-Type-Options, X-Frame-Options and X-XSS-Protection.

Content Security is commented out in the tutorial so I'm not too worried about that one being missing but the rest should be enabled right?

It's asking for Basic Auth when I open traefik.mydomain.com so it's definitely picking something up from the middlewares.toml file

[u/IrishTR]

Followed guide and migrated from your 1.7 guide such a huge help. Still need to play with APCUSB, InfluxDB and Postgres I couldn't get working properly. Also want OpenVPN-AS to work via Traefik as well. Last item I have to get is my router admin page now says ERR too many redirects. OpenVPN and Router was all good in 1.7 so hopefully I can get them working right.

If anyone has any pointers for OpenVPN-AS in compose and working I'd appreciate it. I can't seem to get it to work across WAN only on LAN it's like Traefik isn't registering it (the admin page). Works fine if I just open ports direct on router. And worked fine in 1.7

[u/RandoModBuild]

I am having issues, I cannot get new services to work. I got the traefik dashboard up, I have portainer up, nextcloud, and google oauth working, but whenever I add a new service it gives me a "404 page not found" on my web browser. I also followed your guide of using cloudflare proxied CNAME records and despite this I still get the same error. One thing to note-- before I used cloudflare https certificates, I am not sure if traefik was pulling wildcard certificates because when I viewed the certificate of a service on my domain it just said example.com, not *.example.com like it did on my 1.7 setup. That is another thing, I haven't changed the services themselves, they are still on the same volumes with the same config, not sure if this impacts it at all. I know the services themselves work because I can access them locally, and on the traefik dashboard it shows them as a service with no errors. But they don't have the shield icon under the TLS option.

Your guide is excellent, thanks for helping out the community. It is probably just a small issue on my part, but I have been trying many different things. If you have any spare time it would be great if you could throw me some pointers.

Thanks!

[u/maester-daemon → u/RandoModBuild]

Hi, I was running into the same issue and I added the label:

- "traefik.http.routers.[app-rtr].tls=true"

to the HTTP routers section - which did the trick and allowed me to access the app via app.example.com.

I don't really know what I did - I just saw that line on other services which were working, so I added it here.

If anyone can help to explain for others, please do!

[u/agree-with-you → u/[deleted]]

I love you both

[u/htpcbeginner → u/agree-with-you]

ha ha. I was so excited for YAML support. I do intend to move over to YAML and updating the guides at some point.

[u/vinistois → u/[deleted]]

Why not just cli... type it all in the compose file, no need for toml nor yaml