<\/a>Step 1: Traefik Reverse Proxy Example for Docker<\/h3>\nIn this section, we'll explore an example of a Traefik reverse proxy with Docker compose.<\/p>\n
First, let\u2019s create a docker-compose.yml<\/code> file, in which we will define services for Traefik and the other two microservices\u2014Apache and Nginx, just like before.<\/p>\n$ nano docker-compose.yml\r\n<\/code><\/pre>\nAdd the following:<\/p>\n
version: '3'\r\nservices:\r\n reverse-proxy:\r\n image: traefik:latest\r\n command: --configFile=\/etc\/traefik\/traefik.yml\r\n ports:\r\n - \"80:80\" # HTTP\r\n - \"443:443\" # HTTPS\r\n - \"8080:8080\" # Traefik dashboard\r\n volumes:\r\n - \/var\/run\/docker.sock:\/var\/run\/docker.sock\r\n - .\/traefik.yml:\/etc\/traefik\/traefik.yml\r\n - .\/acme.json:\/acme.json\r\n networks:\r\n - traefik\r\n\r\n apache:\r\n image: httpd:latest\r\n labels:\r\n - \"traefik.enable=true\"\r\n - \"traefik.http.routers.apache.rule=Host(`apache.example.com`)\"\r\n - \"traefik.http.routers.apache.entrypoints=web,websecure\"\r\n - \"traefik.http.routers.apache.tls.certresolver=myresolver\"\r\n - \"traefik.http.services.apache.loadbalancer.server.port=80\"\r\n networks:\r\n - traefik\r\n\r\n nginx:\r\n image: nginx:latest\r\n labels:\r\n - \"traefik.enable=true\"\r\n - \"traefik.http.routers.nginx.rule=Host(`nginx.example.com`)\"\r\n - \"traefik.http.routers.nginx.entrypoints=web,websecure\"\r\n - \"traefik.http.routers.nginx.tls.certresolver=myresolver\"\r\n - \"traefik.http.services.nginx.loadbalancer.server.port=80\"\r\n networks:\r\n - traefik\r\n\r\nnetworks:\r\n traefik:\r\n external: true\r\n<\/code><\/pre>\n<\/p>\n
Three services have been defined in the above docker-compose.yml<\/code> file, and they are reverse-proxy<\/code>, apache<\/code> and nginx<\/code>.<\/p>\nIn the port section, 8080<\/code> is the port used by Traefik for its web interface and port 80<\/code>is used for all default HTTP requests. In the volume section, the Docker socket is accessed by Traefik to route requests to the right container.<\/p>\nWe need to knit all the three services together so that they can communicate with each other, which is why we created the traefik<\/code> network at the end of the file.<\/p>\nAs for the services, we have the following:<\/p>\n
\n- reverse-proxy service<\/strong>: This is the Traefik service acting as a reverse proxy, with ports for HTTP, HTTPS, and the Traefik dashboard.<\/li>\n
- Apache and Nginx services<\/strong>: Both have labels that define routing rules for Traefik:\n
\ntraefik.http.routers.[service].rule<\/code>: Routes traffic based on the Host<\/code>.<\/li>\ntraefik.http.routers.[service].entrypoints<\/code>: Defines which entry points to use (web<\/code> for HTTP, websecure<\/code> for HTTPS).<\/li>\ntraefik.http.routers.[service].tls.certresolver<\/code>: Configures TLS with the myresolver<\/code> certificate resolver, which we\u2019ll define in the traefik.yml<\/code> file next section.<\/li>\ntraefik.http.services.[service].loadbalancer.server.port<\/code>: Defines the internal port for each service.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\nStep 2: Run Traefik using Docker<\/h3>\n
First, create a new traefik.yml<\/code> file. This is the configuration file referenced inside docker-compose.yml<\/code> in the previous section. This Traefik configuration file defines the entry points, certificate resolver, and sets the provider as Docker:<\/p>\nlog:\r\n level: \"DEBUG\" # Set log level to DEBUG for detailed logs\r\n\r\nentryPoints:\r\n web:\r\n address: \":80\"\r\n websecure:\r\n address: \":443\"\r\n traefik:\r\n address: \":8080\" # Dashboard entry point\r\n\r\ncertificatesResolvers:\r\n myresolver:\r\n acme:\r\n email: your_email@example.com\r\n storage: acme.json\r\n httpChallenge:\r\n entryPoint: web\r\n\r\nproviders:\r\n docker:\r\n exposedByDefault: false\r\n#api:\r\n# dashboard: true # Enable the Traefik dashboard\r\n# insecure: true # Allow access to the dashboard without authentication (for development)\r\n<\/code><\/pre>\nHere, you have the following:<\/p>\n
\n- EntryPoints<\/strong>: Defines the ports that Traefik will listen to for HTTP (
:80<\/code>) and HTTPS (:443<\/code>) traffic.<\/li>\n- certificatesResolvers<\/strong>: This uses the ACME protocol<\/strong> to automatically generate SSL certificates for the domains (replace
your-email@example.com<\/code> with your real email). The great thing about Traefik is that these certificates are dynamic, meaning that if you add a new domain or subdomain to docker-compose.yml<\/code>, Traefik will automatically fetch the key\/certificate and store them in acme.json<\/code>.\n\n- The
httpChallenge<\/code> is configured to solve TLS challenges over HTTP (port 80).<\/li>\n<\/ul>\n<\/li>\n- providers.docker<\/strong>: Enables Docker as the provider for dynamic routing, but
exposedByDefault: false<\/code> ensures that only services explicitly enabled via labels will be exposed by Traefik.<\/li>\n<\/ul>\nMake sure Traefik has access<\/strong> to your acme.json<\/code> file, which stores certificate information:<\/p>\n$ touch acme.json\r\n$ chmod 600 acme.json\r\n<\/code><\/pre>\nCreate the traefik<\/code> network:<\/p>\n$ docker network create traefik\r\n<\/code><\/pre>\nStart the services with Docker Compose:<\/p>\n
$ docker compose up -d\r\n<\/code><\/pre>\nYou should see the following output:<\/p>\n
[+] Running 19\/19\r\n \u2714 reverse-proxy Pulled 19.4s\r\n \u2714 43c4264eed91 Pull complete 3.0s\r\n \u2714 eee3b43fedbd Pull complete 3.5s\r\n \u2714 e951b536ebf8 Pull complete 5.9s\r\n \u2714 188dd7af1135 Pull complete 3.9s\r\n \u2714 apache Pulled 16.2s\r\n \u2714 62dd86107c65 Pull complete 1.3s\r\n \u2714 4f4fb700ef54 Pull complete 3.8s\r\n \u2714 509789394c2a Pull complete 3.8s\r\n \u2714 nginx Pulled 18.7s\r\n \u2714 a2318d6c47ec Pull complete 0.8s\r\n \u2714 095d327c79ae Pull complete 1.5s\r\n \u2714 24b3fdc4d1e3 Pull complete 2.8s\r\n \u2714 3122471704d5 Pull complete 3.2s\r\n<\/code><\/pre>\nWith this, you\u2019ll have two HTTPS-enabled applications served by Traefik at https:\/\/apache.your_domain.com\/<\/code> and https:\/\/nginx.your_domain.com\/<\/code><\/p>\nStep 3: Enable the Traefik Dashboard<\/h3>\n
If you want to access the Traefik dashboard, uncomment the last two lines in the traefik.yml<\/code> file:<\/p>\nlog:\r\n level: \"DEBUG\"\r\n\r\nentryPoints:\r\n web:\r\n address: \":80\"\r\n websecure:\r\n address: \":443\"\r\n traefik:\r\n address: \":8080\" # Dashboard entry point\r\n\r\ncertificatesResolvers:\r\n myresolver:\r\n acme:\r\n email: your-email@example.com\r\n storage: acme.json\r\n httpChallenge:\r\n entryPoint: web\r\n\r\nproviders:\r\n docker:\r\n exposedByDefault: false\r\n\r\napi:\r\n dashboard: true # Enable the Traefik dashboard\r\n insecure: true # Allow access to the dashboard without authentication (for development)<\/mark>\r\n<\/code><\/pre>\nNote:<\/strong> Allowing access to the Traefik dashboard without authentication poses a security risk, as it can expose sensitive configuration details to unauthorized users. Remember to only use this insecure<\/code> option in testing environments.<\/p>\nYou can then access the Traefik dashboard on port 8080<\/code> :<\/p>\nhttp:\/\/your_domain.com:8080\/dashboard\r\n<\/code><\/pre>\n
![\"Traefik](\"https:\/\/www.ssdnodes.com\/wp-content\/uploads\/2020\/03\/Traefik-Post.jpg\")
<\/p>\n