traefik

ماذا يفعل

طريقة الكتابة

traefik [--configFile=FILE] [--FLAG=value]...
traefik healthcheck | version

الأجزاء الرئيسية

Concepts

entryPoints

The ports Traefik listens on (web :80, websecure :443).

routers

Rules (Host, PathPrefix) that match requests.

services

The backends that get the traffic.

middlewares

Changes on the way: redirects, auth, headers, rate limits.

providers

Where routes come from: docker, kubernetesCRD, kubernetesIngress, file.

certificatesResolvers

How TLS certificates are obtained (ACME / Let's Encrypt).

الأكثر استخدامًا

لا يوجد شيء يطابق هذا الفلتر.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1. 1Run Traefik with the Docker provider

   $docker run -d --name traefik -p 80:80 -p 443:443 -v /var/run/docker.sock:/var/run/docker.sock:ro -v ./acme:/acme traefik:v3.2 --providers.docker=true --providers.docker.exposedByDefault=false --entryPoints.web.address=:80 --entryPoints.websecure.address=:443 --certificatesResolvers.le.acme.email=admin@example.com --certificatesResolvers.le.acme.storage=/acme/acme.json --certificatesResolvers.le.acme.httpChallenge.entryPoint=web

2. 2Publish a container with labels

   $docker run -d --name shop -l traefik.enable=true -l 'traefik.http.routers.shop.rule=Host(`shop.example.com`)' -l traefik.http.routers.shop.entrypoints=websecure -l traefik.http.routers.shop.tls.certresolver=le -l traefik.http.services.shop.loadbalancer.server.port=8080 ghcr.io/s0sta/shop:1.4.0

3. 3The same with Docker Compose

   $cat compose.yaml
   services:
     shop:
       image: ghcr.io/s0sta/shop:1.4.0
       labels:
         - traefik.enable=true
         - traefik.http.routers.shop.rule=Host(`shop.example.com`)
         - traefik.http.routers.shop.tls.certresolver=le

4. 4Redirect all HTTP to HTTPS

   $cat traefik.yml
   entryPoints:
     web:
       address: ":80"
       http:
         redirections:
           entryPoint: { to: websecure, scheme: https }
     websecure:
       address: ":443"

5. 5Route in Kubernetes with an IngressRoute

   $cat ingressroute.yaml
   apiVersion: traefik.io/v1alpha1
   kind: IngressRoute
   metadata: { name: shop, namespace: shop }
   spec:
     entryPoints: [websecure]
     routes:
       - match: Host(`shop.example.com`) && PathPrefix(`/api`)
         kind: Rule
         services: [{ name: api, port: 8080 }]
     tls: { certResolver: le }
   $kubectl apply -f ingressroute.yaml

6. 6Add basic auth with a middleware

   $htpasswd -nb admin 'S3cret!'
   $docker run -d -l 'traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$...' -l traefik.http.routers.admin.middlewares=auth ...

7. 7Add security headers

   $cat dynamic/headers.yml
   http:
     middlewares:
       secure-headers:
         headers:
           stsSeconds: 31536000
           frameDeny: true
           contentTypeNosniff: true

8. 8See the dashboard (local only)

   $ssh -L 8080:localhost:8080 admin@proxy1
   $curl -s http://localhost:8080/api/http/routers | jq '.[].rule'

9. 9Check health and version

   $traefik healthcheck --ping
   $traefik version

10. 10Install as the k3s ingress (already there)

    $kubectl get pods -n kube-system -l app.kubernetes.io/name=traefik

لا يوجد شيء يطابق هذا الفلتر.

الملفات

/etc/traefik/traefik.yml

Static configuration (path can differ).

acme.json

Stored certificates and keys.

رموز الخروج