Traefik Proxy (20240908)

Preamble

• Automatic Service Discovery for Docker services and routes traffic to them without requiring manual configuration (when enabled)

• Load Balancing for HTTP, TCP, and UDP traffic.

• It supports SSL/TLS termination and automatically generates certificates using ACME providers like Let's Encrypt.

• Dynamic Configuration: It continuously updates its configuration in real time, eliminating the need for restarts or manual updates when services are added or removed.

• It includes various middleware options for tasks such as authentication or rate limiting.

Traefik is based on the concept of EntryPoints, Routers, Middlewares and Services.

The main features include dynamic configuration, automatic service discovery, and support for multiple backends and protocols.

1. EntryPoints: EntryPoints are the network entry points into Traefik. They define the port which will receive the packets, and whether to listen for TCP or UDP.

2. Routers: A router is in charge of connecting incoming requests to the services that can handle them.

3. Middlewares: Attached to the routers, middlewares can modify the requests or responses before they are sent to your service

4. Services: Services are responsible for configuring how to reach the actual services that will eventually handle the incoming requests.

Acknowledgments

• Traefik’s official documentation

• Benjamin Rancourt’s “A Complete Traffic Configuration”

• Ibracorp’s Traefik Primer

• Christian Lempa’s HomeLab Github repo

How to use this guide

• example.com is our domain (zone), and its DNS provider is Cloudflare.

• 192.168.222.11 is the static IP of the host running the Traefik service (among others).

• [email protected] is the email we will use to register with LE.

Requirement: Cloudflare DNS Challenge Token

• An A record for *.example.com (wildcard) setup at Cloudflare pointing to the private IP on the host that will host Traefik: 192.168.22.11

• A custom Cloudflare Token:
• From the Cloudflare Dashboard, on the “Overview” section, look for “Get your API token” (on the left side), then “Create Token → Create Custom Token”



• Give it a name, for example traefik (example.com)
• For “Permissions”, select:
• “Zone - Zone Settings - Read” and “Zone - Zone - Read” to allow the token to Read DNS Zones
• “Zone - DNS - Edit” to allow the token to edit DNS records (required for the DNS-01 challenge)
• For “Zone Resources”, select:
• “Include - Specific Zone” select the example.com zone.
• After the token is created, make sure to store it in a safe place, it will not be displayed again.

Docker compose setup

# Create the configuration base directory (config)
# and the dynamic configuration directory (conf)
mkdir -p config/conf
# Create an empty acme.json file to store our Certificates details
touch config/acme.json
# Change the file permission. An error will occur if this is not done
chmod 600 config/acme.json

traefik.yaml

• adapt the [email protected] value,

• replace the example.com entries (3 of those), and

• select a resolver.

• the global: section checks for updates and disables usage reporting

• the api: section enables the dashboard (we will specify its url on the command line)

• the entrypoints: section sets the http and https ”entrypoints” which will be used by our “routers” configuration.
• The http settings always redirects entries to the https.
• The https settings specify the certResolver name we will use as well as the domains used, including our *.example.com wildcard certificate.
• the middlewares section specifies some @file rules; those will be defined in the config/conf directory.

• the providers: section sets
• the file ”providers” as the content of the conf directory
• the docker ”provider” for
• containers that are on the traefik_default network (this network will be created by Dockge when the stack is started)
• container are not exposed by default: a traefik.enable label must be set to true for the container to be seen by Traefik (see the whoami example in the compose.yaml file)
• will automatically name the resulting URL as the container’s name (ex: dozzle.example.com). In case of potential service collisions, renaming each container is an option or a rule label can be used: traefik.http.routers.my-container.rule=Host(`container-url.example.com`)

• the certificatesResolvers: section is where the ACME exchange with Let’s Encrypt using Cloudflare for the DNS Challenge is performed.
• the resolvers: section will verify that the _acme TXT entry was added to the Zone (example.com)’s DNS. The recommended entry for Cloudflare is 1.1.1.1. If you have a system that performs DNS over HTTPs upgrades, you will want to point that resolver directly to the IP of that system.

Dynamic Configurations (config/conf destination)

tls.yaml

middlewares-securityHeaders_light.yaml

middlewares-securityHeaders.yaml

middlewares-gzip.yaml

middlewares-dashboardauth.yaml

middlewares-localonly.yaml

compose.yaml

Adding services

Dockge containers

services:
  dozzle:
    container_name: dozzle
    image: amir20/dozzle:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./data:/data
    ports:
      - 8008:8080
    environment:
      DOZZLE_AUTH_PROVIDER: simple
      DOZZLE_ENABLE_ACTIONS: true
    labels:
      com.centurylinklabs.watchtower.enable: true

• Make the service use the traefik_default network

    networks:
      - traefik_default

networks:
  traefik_default:
    external: true

• Add labels for the container to be seen by Traefik, specify its url (rule) and specifying the https entrypoint (as defined in our traefik.yaml's entryPoints: section):

    labels:
      - traefik.enable=true
      - traefik.http.routers.dozzle.rule=Host(`dozzle.example.com`)
      - traefik.http.routers.dozzle.entrypoints=https

services:
  dozzle:
    container_name: dozzle
    image: amir20/dozzle:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./data:/data
    ports:
      - 8008:8080
    environment:
      DOZZLE_AUTH_PROVIDER: simple
      DOZZLE_ENABLE_ACTIONS: true
    networks:
      - traefik_default
    labels:
      - traefik.enable=true
      - traefik.http.routers.dozzle.rule=Host(`dozzle.example.com`)
      - traefik.http.routers.dozzle.entrypoints=https
      - com.centurylinklabs.watchtower.enable=true
networks:
  traefik_default:
    external: true

Adding an external service

http:
  # Routers and Services -- https://doc.traefik.io/traefik/routing/overview/
  routers:
    ollama: # name
      entryPoints:
        - https # use the "https" entrypoint
      rule: 'Host(`ollama.example.com`)' # Destination URL to resolve
      service: ollama # name for services matching entry
#      middlewares: # specify middleware(s) if any
#        - "securityHeaders@file" # the default "https" entrypoint follows the "light" security headers version, uncomment this section to enble the more restrictive version
  services:
    ollama:
      loadBalancer:
        servers:
          - url: http://192.168.22.12:11434/

Docker labels

Generic labels

    labels:
      - traefik.enable=true
      - traefik.http.routers.SLUG.entrypoints=https
      - traefik.http.routers.SLUG.rule=Host(`SLUG.example.com`)

• replace example.com with your domain (1x replacement)

• update SLUG to reflect the base URL of the service you are exposing (3x replacements)

Unraid labels

  <Config Name="traefik.enable=true" Target="traefik.enable" Default="" Mode="" Description="" Type="Label" Display="always" Required="false" Mask="false">true</Config>
  <Config Name="traefik.http.routers.SLUG.entrypoints=https" Target="traefik.http.routers.SLUG.entrypoints" Default="" Mode="" Description="" Type="Label" Display="always" Required="false" Mask="false">https</Config>
  <Config Name="traefik.http.routers.SLUG.rule=Host(`SLUG.example.com`)" Target="traefik.http.routers.SLUG.rule" Default="" Mode="" Description="" Type="Label" Display="always" Required="false" Mask="false">Host(`SLUG.example.com`)</Config>

• example.com with your domain (2x replacements)

• SLUG with the base URL of the service whose port you are exposing — this will replace the values in .routers. and Host( (6x replacements)

Further Reading

• Traefik documentation:
• Docker: routing configuration (details on how to expose a specific port, Docker API access, …)
• Traefik Plugins and the Plugin Catalog
• FAQ

• Using Traefik with Cloudflare tunnels

Revision History

• 20240908-0: Added Unraid use-case and copy→adapt→paste content

• 20240903-0: Added a “light” security headers file as an option for private network.

• 20240901-0: Added direct links to each file + additional link in Further Reading section

• 20240831-0: Initial release