I'm using a VPS with Debian 10 on it. I also have one domain name.
My goal is to self-host a few services, like FreshRSS or Nextcloud. To deploy these services, I'm using Docker and Docker Compose. I have one folder per service.
Because I would like to get a reverse proxy and assign subdomains to services (for example : cloud.domainname.com to Nextcloud), I installed Traefik yesterday. However, I cannot get the service to work. This is probably bad configuration from me, as I'm a total beginner in setting up reverse proxies. For example, I'm trying to get it to work with ArchiveBox, which runs on the port 8000. I would like Traefik to map my subdomain archive.domainname.com to the port 8000 of my VPS.
These are the steps I did yesterday:
Installed ArchiveBox on my VPS with Docker Compose and configured it. It's working successfully.
Created a new network for traefik: sudo docker network create --driver=bridge --subnet=192.168.0.0/16 traefik_lan
Installed Traefik with Docker Compose, added dynamic configuration by following tutorials.
Added the labels and the network to the Docker Compose file of ArchiveBox.
Started both. However, ArchiveBox creates a new network and does not seems to use the Traefik one. I can also still access directly ArchiveBox at domainname.com:8000.
Below are the config files.
ArchiveBox
ArchiveBox docker-compose.yml
# Usage:
# docker-compose up -d
# docker-compose run archivebox init
# echo "https://example.com" | docker-compose run archivebox archivebox add
# docker-compose run archivebox add --depth=1 https://example.com/some/feed.rss
# docker-compose run archivebox config --set PUBLIC_INDEX=True
# Documentation:
# https://github.com/ArchiveBox/ArchiveBox/wiki/Docker#docker-compose
version: '3.7'
services:
archivebox:
# build: .
image: ${DOCKER_IMAGE:-archivebox/archivebox:latest}
command: server 0.0.0.0:8000
stdin_open: true
tty: true
ports:
- 8000:8000
environment:
- USE_COLOR=True
- SHOW_PROGRESS=False
- SEARCH_BACKEND_ENGINE=sonic
- SEARCH_BACKEND_HOST_NAME=sonic
- SEARCH_BACKEND_PASSWORD=SecretPassword
volumes:
- ./data:/data
depends_on:
- sonic
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik_lan"
- "traefik.http.routers.archiveboxnotls.rule=Host(`${ARCHIVE_URL}`)"
- "traefik.http.routers.archiveboxnotls.entrypoints=webinsecure"
- "traefik.http.routers.archiveboxnotls.middlewares=tlsredir#file"
- "traefik.http.routers.archivebox.rule=Host(`${ARCHIVE_URL}`)"
- "traefik.http.routers.archivebox.entrypoints=websecure"
- "traefik.http.routers.archivebox.tls=true"
- "traefik.http.routers.archivebox.tls.certresolver=letsencrypt"
networks:
- traefik_lan
# Run sonic search backend
sonic:
image: valeriansaliou/sonic:v1.3.0
ports:
- 1491:1491
environment:
- SEARCH_BACKEND_PASSWORD=SecretPassword
volumes:
- ./etc/sonic/config.cfg:/etc/sonic.cfg
- ./data:/var/lib/sonic/store/
networks:
traefik_lan:
external: true
I'm then expected to run it like so:
sudo ARCHIVE_URL=archive.mydomain.com docker-compose up -d
Traefik
This is the structure of my /traefik folder in /home.
.
├── config
│ ├── acme.json
│ ├── dynamic-conf
│ │ ├── dashboard.toml
│ │ ├── tlsredir.toml
│ │ └── tls.toml
│ └── traefik.toml
└── docker-compose.yml
docker-compose.yml
version: '3'
services:
reverse-proxy:
container_name: traefik
image: traefik:v2.4
restart: unless-stopped
ports:
- "80:80"
- "443:443"
networks:
- traefik_lan
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./config:/etc/traefik:ro
- ./config/acme.json:/acme.json
networks:
traefik_lan:
external: true
traefik.toml
[api]
dashboard = true
[providers]
[providers.docker]
exposedByDefault = false
[providers.file]
directory = "/etc/traefik/dynamic-conf"
watch = true
[entryPoints]
[entryPoints.websecure]
address = ":443"
[entryPoints.webinsecure]
address = ":80"
[entryPoints.dot]
address = ":853"
[certificatesResolvers.letsencrypt.acme]
email = "myemail#gmail.com"
caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
#caServer: "https://acme-v02.api.letsencrypt.org/directory"
storage = "acme.json"
[certificatesResolvers.letsencrypt.acme.tlsChallenge]
[accessLog]
format = "json"
[accessLog.fields]
defaultMode = "drop"
[accessLog.fields.names]
"ClientAddr" = "keep"
"RequestAddr" = "keep"
"RequestMethod" = "keep"
"RequestPath" = "keep"
"DownstreamStatus" = "keep"
dashboard.toml
[http.routers.api]
rule = "Host(`traefik.domain.tld`)"
entrypoints = ["webinsecure"]
service = "api#internal"
middlewares = ["tlsredir#file"]
[http.routers.api-secure]
rule = "Host(`traefik.domain.tld`)"
entrypoints = ["websecure"]
service = "api#internal"
middlewares = ["secured"]
[http.routers.api-secure.tls]
certResolver = "letsencrypt"
tlsredir.toml
[http.middlewares]
[http.middlewares.tlsredir.redirectScheme]
scheme = "https"
permanent = true
tls.toml
[tls]
[tls.options]
[tls.options.default]
minVersion = "VersionTLS12"
sniStrict = true
cipherSuites = [
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
]
curvePreferences = ["CurveP521","CurveP384"]
Thank you in advance for you help.
Related
I have the following docker-compose.
version: '3.9'
services:
rabbitmq:
image: rabbitmq:3.8.9-management
restart: unless-stopped
container_name: rabbitmq-sandbox-dev
networks:
- traefik_web
volumes:
- /opt/rabbitmq/sandbox/var/lib:/var/lib/rabbitmq
- /opt/rabbitmq/sandbox/config/logs.conf:/etc/rabbitmq/rabbitmq.conf
Directory structure.
(venv) toto#euler:.../rabbitmq/sandbox# tree
.
├── config
│ └── logs.conf
├── docker-compose.yml
└── var
logs.conf
default_user = admin
default_pass = rabbitmq
default_user_tags.administrator = true
default_permissions.configure = .*
default_permissions.read = .*
default_permissions.write = .*
log.console = true
log.console.level = info
log.console.formatter = json
log.file = false
However everytime I try to docker-compose up the container crash with the following error
- Conf file attempted to set unknown variable: log.console.formatter
Even if this arguments is clearly described in the rabbitmq configuration https://www.rabbitmq.com/logging.html#json. Does anyone have an idea. Am I missing something?
Thanks in advance,
Using a log formatter plugin, you can save RabbitMQ logs in JSON format. It is possible to format logs in JSON using the rabbitmq_json_logger plugin in RabbitMQ.
RabbitMQ does not enable the rabbitmq_json_logger plugin by default. In the RabbitMQ Docker container, run the following command to enable it:
rabbitmq-plugins enable rabbitmq_json_logger
I inherited a project that is using Traefik with Docker but I have no experience with Traefik so seeking some assistance.
Say I have domain https://xxx.testsite.com I have been asked to redirect any traffic from https to http.
I've tried configuring a middleware to redirect but it didn't work.
Currently, if I visit http://xxx.testsite.com my website does load.
If I visit https://xxx.testsite.com I get a 404 page not found.
How can I can configure my files to accomplish this?
My project directory structure is
my_project/
├─ testsite/
│ ├─ docker-compose.yml
│ ├─ docker-compose-https.yml
│ ├─ web
│ │ ├─index.html
├─ traefik.yml
├─ traefik.toml
├─ acme.json
my_project/traefik.toml
[web]
logLevel = "DEBUG"
defaultEntryPoints = ["https","http"]
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.dashboard]
address = ":8088"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[retry]
[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "jltxxxx.com"
watch = true
exposedByDefault = false
network = "jh"
[acme]
email = "xxxxxx#gmail.com"
storage = "acme.json"
entryPoint = "https"
onHostRule = true
[acme.httpChallenge]
entryPoint = "http"
my_project/traefik.yml
version: '2'
services:
traefik:
image: traefik:v1.7
restart: unless-stopped
networks:
- testsite
ports:
- '8100:80'
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./traefik.toml:/traefik.toml
- ./acme.json:/acme.json
logging:
options:
max-size: 100m
networks:
testsite:
external:
name: testsite_default
my_project/testsite/docker-compose.yml
version: '2'
services:
web:
image: 'flipbox/php:72-apache'
restart: unless-stopped
volumes:
- '.:/var/www/html/'
labels:
- 'traefik.enable=true'
- 'traefik.backend=testsite_web_1'
- 'traefik.docker.network=testsite'
- 'traefik.frontend.rule=Host:xxx.testsite.com, www.xxx.testsite.com'
logging:
options:
max-size: 500m
my_project/testsite/docker-compose-https.yml
version: '2'
services:
web:
image: 'flipbox/php:72-apache'
restart: unless-stopped
volumes:
- '.:/var/www/html/'
labels:
- 'traefik.enable=true'
- 'traefik.port=80'
- 'traefik.frontend.entryPoints=https'
- 'traefik.backend=testsite_web_1'
- 'traefik.docker.network=testsite'
- 'traefik.frontend.rule=Host:xxx.testsite.com, www.xxx.testsite.com'
logging:
options:
max-size: 500m
I'm not familiar with the Traefik v1 syntax, but I hope this code for Traefik v2 might give an idea how to do this in v1. And also to answer the question for other people using Traefik v2.
First of all, there are many things in this configuration that doesn't seem right. To name an example, the ports specified in the static config and the ports you expose in the Traefik container do not match.
But to come back to the redirect part, there are two options:
Either you can redirect ALL incoming traffic to HTTPS by adding the following to the static configuration of the Traefik container:
command:
- "--entrypoints.websecure.address=:443"
- "--entrypoints.web.address=:80"
- "--entrypoints.web.http.redirections.entryPoint.to=websecure"
- "--entrypoints.web.http.redirections.entryPoint.scheme=https"
- "--entrypoints.web.http.redirections.entrypoint.permanent=true"
Or you can redirect traffic to HTTPS for a single container by adding the following to the dynamic configuration of the application container:
labels:
- "traefik.enable=true"
- "traefik.http.middlewares.myapp-redirect.redirectscheme.scheme=https"
- "traefik.http.middlewares.myapp-redirect.redirectscheme.permanent=true"
- "traefik.http.routers.myapp.middlewares=myapp-redirect"
- "traefik.http.routers.myapp.rule=Host(`myapp.localhost`)"
- "traefik.http.routers.myapp.entrypoints=web"
- "traefik.http.routers.myapp-secure.rule=Host(`myapp.localhost`)"
- "traefik.http.routers.myapp-secure.entrypoints=websecure"
- "traefik.http.routers.myapp-secure.tls=true"
- "traefik.http.routers.myapp-secure.tls.certresolver=le"
Assume my current public IP is 101.15.14.71, I have a domain called example.com which I configured using cloudflare and I created multiple DNS entry pointing to my public ip.
Eg:
1) new1.example.com - 101.15.14.71
2) new2.example.com - 101.15.14.71
3) new3.example.com - 101.15.14.71
Now, Here's my example project structure,
├── myapp
│ ├── app
│ │ └── main.py
│ ├── docker-compose.yml
│ └── Dockerfile
├── myapp1
│ ├── app
│ │ └── main.py
│ ├── docker-compose.yml
│ └── Dockerfile
└── traefik
├── acme.json
├── docker-compose.yml
├── traefik_dynamic.toml
└── traefik.toml
Here I have two fastAPIs (i.e., myapp, myapp1)
Here's the example code I have in main.py in both myapp and myapp1, Its exactly same but return staement is different that's all
from fastapi import FastAPI
app = FastAPI()
#app.get("/")
def read_main():
return {"message": "Hello world for my project myapp"}
Here's my Dockerfile for myapp and myapp1, here too both are exactly same but the only difference is I deploy myapp on 7777 and myapp1 on 7778 in different containers
FROM ubuntu:latest
ARG DEBIAN_FRONTEND=noninteractive
RUN apt update && apt upgrade -y
RUN apt install -y -q build-essential python3-pip python3-dev
# python dependencies
RUN pip3 install -U pip setuptools wheel
RUN pip3 install gunicorn fastapi uvloop httptools "uvicorn[standard]"
# copy required files
RUN bash -c 'mkdir -p /app'
COPY ./app /app
ENTRYPOINT /usr/local/bin/gunicorn \
-b 0.0.0.0:7777 \ # this line I use for myapp dockerfile
-b 0.0.0.0:7778 \ # this line I change for myapp1 dockerfile
-w 1 \
-k uvicorn.workers.UvicornWorker app.main:app \
--chdir /app
Here's my docker-compose.yml file for myapp and myapp1, here also I have exactly same but only difference is I change the port,
services:
myapp: # I use this line for myapp docker-compose file
myapp1: # I use this line for myapp1 docker-compose file
build: .
restart: always
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik_public"
- "traefik.backend=myapp" # I use this line for myapp docker-compose file
- "traefik.backend=myapp1" # I use this line for myapp1 docker-compose file
- "traefik.frontend.rule=Host:new2.example.com" # I use this for myapp compose file
- "traefik.frontend.rule=Host:new3.example.com" # I use this for myapp1 compose file
- "traefik.port=7777" # I use this line for myapp docker-compose file
- "traefik.port=7778" # I use this line for myapp1 docker-compose file
networks:
- traefik_public
networks:
traefik_public:
external: true
Now coming to traefik folder,
acme.json # I created it using nano acme.json command with nothing in it,
but did chmod 600 acme.json for proper permissions.
traefik_dynamic.toml
[http]
[http.routers]
[http.routers.route0]
entryPoints = ["web"]
middlewares = ["my-basic-auth"]
service = "api#internal"
rule = "Host(`new1.example.com`)"
[http.routers.route0.tls]
certResolver = "myresolver"
[http.middlewares.test-auth.basicAuth]
users = [
["admin:your_encrypted_password"]
]
traefik.toml
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.http]
[entryPoints.web.http.redirections]
[entryPoints.web.http.redirections.entryPoint]
to = "websecure"
scheme = "https"
[entryPoints.websecure]
address = ":443"
[api]
dashboard = true
[certificatesResolvers.myresolver.acme]
email = "reallygoodtraefik#gmail.com"
storage= "acme.json"
[certificatesResolvers.myresolver.acme.httpChallenge]
entryPoint = "web"
[providers]
[providers.docker]
watch = true
network = "web"
[providers.file]
filename = "traefik_dynamic.toml"
docker-compose.yml
services:
traefik:
image: traefik:latest
ports:
- 80:80
- 443:443
- 8080:8080
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./traefik.toml:/traefik.toml
- ./acme.json:/acme.json
- ./traefik_dynamic.toml:/traefik_dynamic.toml
networks:
- web
networks:
web:
These are the details about my files, what I am trying to achieve here is,
I want to setup traefik and traefik dashboard with basic authentication, and I deploy two of my fastapi services,
myapp 7777, I need to access this app via new2.example.com
myapp1 7778, I need to access this app via new3.example.com
traefik dashboard, I need to access this via new1.example.com
All of these should be https and also has certification autorenew enabled.
I got all these from online articles for latest version of traefik. But the problem is this is not working. I used docker-compose to build and deploy the traefik and I open the api dashboard. It is asking for password and user (basic auth I setup) I entered my user details I setup in traefik_dynamic.toml but its not working.
Where did I do wrong? Please help me correcting mistakes in my configuration. I am really interested to learn more about this.
Error Update:
traefik_1 | time="2021-06-16T01:51:16Z" level=error msg="Unable to obtain ACME certificate for domains \"new1.example.com\": unable to generate a certificate for the domains [new1.example.com]: error: one or more domains had a problem:\n[new1.example.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from http://new1.example.com/.well-known/acme-challenge/mu85LkYEjlvnbDI-wM2xMaRFO1QsPDNjepTDb47dWF0 [2606:4700:3032::6815:55c4]: 404\n" rule="Host(`new1.example.com`)" routerName=api#docker providerName=myresolver.acme
traefik_1 | time="2021-06-16T01:51:19Z" level=error msg="Unable to obtain ACME certificate for domains \"new2.example.com\": unable to generate a certificate for the domains [new2.example.com]: error: one or more domains had a problem:\n[new2.example.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from http://new2.example.com/.well-known/acme-challenge/ykiCAEpJeQ1qgVdeFtSRo3q-ATTwgKdRdGHUs2kgIsY [2606:4700:3031::ac43:d1e9]: 404\n" providerName=myresolver.acme routerName=myapp1#docker rule="Host(`new2.example.com`)"
traefik_1 | time="2021-06-16T01:51:20Z" level=error msg="Unable to obtain ACME certificate for domains \"new3.example.com\": unable to generate a certificate for the domains [new3.example.com]: error: one or more domains had a problem:\n[new3.example.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from http://new3.example.com/.well-known/acme-challenge/BUZWuWdNd2XAXwXCwkeqe5-PHb8cGV8V6UtzeLaKryE [2606:4700:3031::ac43:d1e9]: 404\n" providerName=myresolver.acme routerName=myapp#docker rule="Host(`new3.example.com`)"
You only need one docker-compose file for all the services, and there is no need to define one for each container.
The project structure you should be using should be something like:
├── docker-compose.yml
├── myapp
│ ├── .dockerignore
│ ├── Dockerfile
│ └── app
│ └── main.py
├── myapp1
│ ├── .dockerignore
│ ├── Dockerfile
│ └── app
│ └── main.py
└── traefik
├── acme.json
└── traefik.yml
When creating containers, unless they are to be used for development purposes, it is recommended to not use a full-blown image, like ubuntu. Specifically for your purposes I would recommend a python image, such as python:3.7-slim.
Not sure if you are using this for development or production purposes, but you could also use volumes to mount the app directories inside the containers (especially useful if you are using this for development), and only use one Dockerfile for both myapp and myapp1, customizing it via environment variables.
Since you are already using traefik's dynamic configuration, I will do most of the setup for the container configuration via docker labels in the docker-compose.yml file.
Your dockerfile for myapp and myapp1 will be very similar at this point, but I've kept them as seperate ones, since you may need to make changes to them depending on the requirements of your apps in the future. I've used an environment variable for the port, which can allow you to change the port from your docker-compose.yml file.
You can use the following Dockerfile (./myapp/Dockerfile and ./myapp1/Dockerfile):
FROM python:3.7-slim
ARG DEBIAN_FRONTEND=noninteractive
ENV PYTHONUNBUFFERED=1
RUN pip3 install -U pip setuptools wheel && \
pip3 install gunicorn fastapi uvloop httptools "uvicorn[standard]"
COPY . /app
ENV PORT=7777 # and 7778 for myapp1
ENTRYPOINT /usr/local/bin/gunicorn -b 0.0.0.0:$PORT -w 1 -k uvicorn.workers.UvicornWorker app.main:app --chdir /app
Note: you should really be using something like poetry or a requirements.txt file for your app dependencies.
The .dockerignore file (./myapp/.dockerignore and ./myapp1/.dockerignore) should contain:
Dockerfile
Since the whole directory is being copied inside the container and you don't need the Dockerfile to be in there.
Your main traefik config (./traefik/traefik.yml) can be something like:
providers:
docker:
exposedByDefault: false
global:
checkNewVersion: false
sendAnonymousUsage: false
api: {}
accessLog: {}
entryPoints:
web:
address: ":80"
http:
redirections:
entryPoint:
to: "websecure"
scheme: "https"
websecure:
address: ":443"
ping:
entryPoint: "websecure"
certificatesResolvers:
myresolver:
acme:
caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
email: "example#example.com"
storage: "/etc/traefik/acme.json"
httpChallenge:
entryPoint: "web"
Note: The above acme config will use the stage letsencrypt server. Make sure all the details are correct, and remove caServer after you've tested that everything works, in order to communicate with the letsencrypt production server.
Your ./docker-compose.yml file should be something like:
version: "3.9"
services:
myapp:
build:
context: ./myapp
dockerfile: ./Dockerfile
image: myapp
depends_on:
- traefik
expose:
- 7777
labels:
- "traefik.enable=true"
- "traefik.http.routers.myapp.tls=true"
- "traefik.http.routers.myapp.tls.certResolver=myresolver"
- "traefik.http.routers.myapp.entrypoints=websecure"
- "traefik.http.routers.myapp.rule=Host(`new2.example.com`)"
- "traefik.http.services.myapp.loadbalancer.server.port=7777"
myapp1:
build:
context: ./myapp1
dockerfile: ./Dockerfile
image: myapp1
depends_on:
- traefik
expose:
- 7778
labels:
- "traefik.enable=true"
- "traefik.http.routers.myapp1.tls=true"
- "traefik.http.routers.myapp1.tls.certResolver=myresolver"
- "traefik.http.routers.myapp1.entrypoints=websecure"
- "traefik.http.routers.myapp1.rule=Host(`new3.example.com`)"
- "traefik.http.services.myapp1.loadbalancer.server.port=7778"
traefik:
image: traefik:v2.4
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./traefik/traefik.yml:/etc/traefik/traefik.yml
- ./traefik/acme.json:/etc/traefik/acme.json
ports:
- 80:80
- 443:443
labels:
- "traefik.enable=true"
- "traefik.http.routers.api.tls=true"
- "traefik.http.routers.api.tls.certResolver=myresolver"
- "traefik.http.routers.api.entrypoints=websecure"
- "traefik.http.routers.api.rule=Host(`new1.example.com`)"
- "traefik.http.routers.api.service=api#internal"
- "traefik.http.routers.api.middlewares=myAuth"
- "traefik.http.middlewares.myAuth.basicAuth.users=admin:$$apr1$$4zjvsq3w$$fLCqJddLvrIZA.CCoGE2E." # generate with htpasswd. replace $ with $$
You can generate the password by using the command:
htpasswd -n admin | sed 's/\$/\$\$/g'
Note: If you need a literal dollar sign in the docker-compose file you need to use $$ as documented here.
Issuing docker-compose up in the directory should bring all the services up, and working as expected.
The above should work for you based on the details you have provided, but can be further improved at multiple points, depending on your needs.
Moreover, having the credentials for the traefik dashboard in the docker-compose.yml file is probably not the best, and you may want to use docker secrets for it. You can also add healthchecks and consider placing myapp and myapp1 into a seperate internal network.
If you want to get further into it, I propose that you start with Get started with Docker Compose and also read: Dockerfile reference and Compose file version 3 reference
I'm trying to use traefik with my docker containers for routing.
File structure is:
docker
├── docker-compose.yml
├── shared
│ └── .htpasswd
└── traefik
├── acme
│ └── acme.json
├── rules.toml
└── traefik.toml
Here is traefik.toml:
logLevel = "ERROR"
InsecureSkipVerify = true
defaultEntryPoints = ["https", "http"]
[web]
address = ":8080"
[web.auth.basic]
usersFile = "/shared/.htpasswd"
# Force HTTPS
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[retry]
[file]
watch = true
filename = "/etc/traefik/rules.toml"
[acme]
email = "test#test.com"
storage="/etc/traefik/acme/acme.json"
entryPoint = "https"
acmeLogging=true
onDemand = false #create certificate when container is created
[acme.dnsChallenge]
provider = "digitalocean"
delayBeforeCheck = 0
[[acme.domains]]
main = "test.com"
[[acme.domains]]
main = "*.test.com"
[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "test.com"
watch = true
exposedbydefault = false
docker-compose.yml:
version: "3.5"
services:
traefik:
hostname: traefik
image: traefik:latest
container_name: traefik
restart: always
domainname: ${DOMAINNAME}
networks:
- default
- traefik_proxy
ports:
- "80:80"
- "443:443"
#- "8080:8080"
environment:
#- digitalocean=${DO_AUTH_TOKEN}
- DO_AUTH_TOKEN=${DO_AUTH_TOKEN}
labels:
- "traefik.enable=true"
- "traefik.backend=traefik"
- "traefik.frontend.rule=Host:traefik.${DOMAINNAME}"
# - "traefik.frontend.rule=Host:${DOMAINNAME}; PathPrefixStrip: /traefik"
- "traefik.port=8080"
- "traefik.docker.network=traefik_proxy"
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ${USERDIR}/docker/traefik:/etc/traefik
- ${USERDIR}/docker/shared:/shared
networks:
traefik_proxy:
external:
name: traefik_proxy
default:
driver: bridge
After running traefik container I'm trying to create another one from the repository:
docker run -d \
-v /var/run/docker.sock:/var/run/docker.sock \
--label traefik.backend=hello-hapi \
--label traefik.frontend.rule=Host:hello-hapi.test.com \
--label traefik.docker.network=traefik_proxy \
--label traefik.port=80 \
--name hello_hapi \
gitlab.test.com:5555/myuser/hello_hapi:latest
The problem is that I can not access the container through the browser. It prints: hello-hapi.test.com’s server IP address could not be found (ERR_NAME_NOT_RESOLVED).
But the image can be seen in the traefik dashboard and
docker run -it -p 3000:3000 --rm gitlab.test.com:5555/myuser/hello_hapi:latest
runs as expected on test.com:3000
What could be the problem?
Your browser is checking the DNS zone for "test.com" and then in that zone there is no "hello-hapi.test.com" entry.
You need to own the domain in order to add DNS entries for it. If that wasn't the case, I could have my domain as "neekoy.google.com", which Google wouldn't be particularly happy about.
If you want to access it in a browser, you can add a local DNS entry on your computer and point "test.com" to localhost(127.0.0.1). If you don't know how, you can Google "hosts file" for your operating system and add the following line in it:
127.0.0.1 hello-hapi.test.com test.com www.test.com
I want to host a private Gitlab server on my Debian VPS. I figured using Docker would be a good setup.
I tried running Gitlab with the following code:
version: '3'
services:
gitlab:
image: 'gitlab/gitlab-ce'
restart: always
hostname: 'gitlab.MYDOMAIN.com'
links:
- postgresql:postgresql
- redis:redis
environment:
GITLAB_OMNIBUS_CONFIG: |
postgresql['enable'] = false
gitlab_rails['db_username'] = "gitlab"
gitlab_rails['db_password'] = "gitlab"
gitlab_rails['db_host'] = "postgresql"
gitlab_rails['db_port'] = "5432"
gitlab_rails['db_database'] = "gitlabhq_production"
gitlab_rails['db_adapter'] = 'postgresql'
gitlab_rails['db_encoding'] = 'utf8'
redis['enable'] = false
gitlab_rails['redis_host'] = 'redis'
gitlab_rails['redis_port'] = '6379'
external_url 'http://gitlab.MYDOMAIN.com:30080'
gitlab_rails['gitlab_shell_ssh_port'] = 30022
ports:
# both ports must match the port from external_url above
- "30080:30080"
# the mapped port must match ssh_port specified above.
- "30022:22"
# the following are hints on what volumes to mount if you want to persist data
# volumes:
# - data/gitlab/config:/etc/gitlab:rw
# - data/gitlab/logs:/var/log/gitlab:rw
# - data/gitlab/data:/var/opt/gitlab:rw
postgresql:
restart: always
image: postgres:9.6.2-alpine
environment:
- POSTGRES_USER=gitlab
- POSTGRES_PASSWORD=gitlab
- POSTGRES_DB=gitlabhq_production
# the following are hints on what volumes to mount if you want to persist data
# volumes:
# - data/postgresql:/var/lib/postgresql:rw
redis:
restart: always
image: redis:3.0.7-alpine
Running this (docker-compose run -d) allows me to reach Gitlab on MYDOMAIN.com:30080, but not on gitlab.MYDOMAIN.com:30080.
Have I made an error in the configuration? Or do I need to use reverse proxies (NGINX or Traefik)?
I'm pretty sure the hostname: gitlab.MYDOMAIN.rocks needs to match the external_url 'http://gitlab.MYDOMAIN.com:30080' until the port exactly
So for example:
hostname: gitlab.MYDOMAIN.com
. . . more configuration . . .
external_url 'http://gitlab.MYDOMAIN.com:30080'
Did you check that the subdomain gitlab in dns is pointing to the right ip? Looks like an infrastructure problem more than a docker configuration one.
Regards
I managed to fix it myself!
I totally forgot to add an A-record, setting gitlab.mydomain.com to point to the same IP address as #.
I added the following block to the nginx configuration:
upstream gitlab.mydomain.com {
server 1.2.3.4:30080; # IP address of Docker container
}
server {
server_name gitlab.mydomain.com;
location / {
proxy_pass http://gitlab.mydomain.com;
}
}
I use upstream because otherwise the url set in new Gitlab projects is set to the IP address, as mentioned here.