I am trying to expose my docker services (like Heimdall, Plex, Tautulli, etc) on my host machines IP for internal purposes only, so without a domain name. I want each service to be accessible ith its own prefix like 192.168.0.100/heimdall, 192.168.0.100/tautulli, etc.
I would like to have the dashboard on a separate port, like 8080, but even after I specify an entry point for 8080 as traefik and set traefik as the entry point for the service it still goes to the port 80 named http.
Is there any issue with my config or is it an issue on traefik side?
docker-compose.yml
version: '3'
services:
traefik:
image: traefik
container_name: traefik
ports:
- "80:80"
- "8080:8080"
restart: always
volumes:
- ./traefik:/etc/traefik
- "/var/run/docker.sock:/var/run/docker.sock:ro"
traefik.yml
entryPoints:
http:
address: ":80"
traefik:
address: ":8080"
api: {}
log:
level: "DEBUG"
providers:
file:
directory: /etc/traefik/dynamic
docker:
endpoint: unix:///var/run/docker.sock
exposedByDefault: false
dashboard.yml
http:
routers:
api:
rule: PathPrefix(`/api`) || PathPrefix(`/dashboard`)
entrypoints:
- traefik
service: api#internal
According to documentation (https://docs.traefik.io/v2.2/operations/api/#insecure), this could help:
api:
insecure: true
It should implicitly use special entrypoint traefik with port 8080.
You can also check this for more info about dashboard: https://docs.traefik.io/operations/dashboard/
EDIT
I have just tried it and it works on port 8080 with this configuration:
docker-compose.yml
version: '3'
services:
traefik:
image: traefik
container_name: traefik
restart: always
ports:
- "80:80"
- "8080:8080"
volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- "./dockerfiles/traefik/traefik.yml:/etc/traefik/traefik.yml:ro"
labels:
- "traefik.enable=true"
- "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
- "traefik.http.routers.dashboard.entrypoints=traefik"
- "traefik.http.routers.dashboard.service=api#internal"
traefik.yml (I have used yours without file provider):
entryPoints:
http:
address: ":80"
traefik:
address: ":8080"
api: {}
log:
level: "DEBUG"
providers:
docker:
endpoint: unix:///var/run/docker.sock
exposedByDefault: false
Related
I run a docker host in my homelab using ubuntu. The host is reachable via docker.mydomain.com. This is managed by my pfsense firewall.
I use the following docker-compose file:
version: "3.7"
services:
traefik:
image: "traefik:v2.9"
container_name: "traefik"
hostname: "traefik"
ports:
- "80:80"
- "8008:8080"
volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- "./traefik.yml:/traefik.yml:ro"
apache:
image: httpd:latest
container_name: apache
hostname: apache
labels:
- "traefik.enable=true"
- "traefik.http.routers.apache.entrypoints=web"
- "traefik.http.routers.apache.rule=Host(`apache.docker.mydomain.com`)"
Additionally i use the following traefik.yml file
log:
level: INFO
api:
insecure: true
dashboard: true
entryPoints:
web:
address: ":80"
providers:
docker:
endpoint: "unix:///var/run/docker.sock"
exposedByDefault: false
I can reach the traefik web ui but not the apache default site using apache.docker.mydomain.com. I'm not sure if pfsense is the problem or traefik. What am i missing here?
UPDATE:
I see the apache service in the traefik ui:
It seems to be an issue with the dns forwarding on the pfsense firewall. I added a wildcard rule to address=/.docker.mydomain.com/192.168.1.10 and now the apache is reachable via apache.docker.mydomain.com
I have found many similar questions online, but I am certainly lost in this topic which is new for me and I hope somebody can guide me through my problem. In my setup, I have a docker container which runs a secure version on port 8443 and a "read-only" version on port 8080. Now I want to use Traefik as a proxy to then reroute all requests to the secure version, ignoring the read-only. While the dashboard indicates routing to the service, I am just receiving an "Unable to connect" when trying to access the webpage.
As a compose file:
version: "3.7"
services:
traefik:
image: traefik:2.5
container_name: traefik
restart: always
ports:
- "80:80"
- "433:433"
command: --api.insecure=false --providers.docker
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /home/cloud/traefik.yml:/etc/traefik/traefik.yml
networks:
- traefik-network
my-service:
image: my-image
env_file: variables.env
container_name: my-image
restart: always
ports:
- "8080:8080"
- "8443:8443"
networks:
- traefik-network
labels:
- "traefik.enable=true"
- "traefik.http.routers.my-service.entryPoints=websecure"
- "traefik.http.routers.my-service.rule=Host(`domain.com`)"
- "traefik.http.services.my-service.loadbalancer.server.port=8443"
networks:
traefik-network:
name: traefik-network
And the traefik.yml:
################################################################
# Provider configuration
################################################################
providers:
docker:
endpoint: "unix:///var/run/docker.sock" # default
exposedByDefault: true # default
network: traefik-network
################################################################
# Entrypoint
################################################################
entryPoints:
web:
address: ":80"
http:
redirections:
entryPoint:
to: websecure
scheme: https
websecure:
address: ":443"
Maybe somebody has an idea where I went in the wrong direction.
Best
I am new in Traefik and I am using that to make the reverse proxy for my docker images, and I want to use my local computer like a server that could be accessed externally.
Here is what I did:
I create a DDNS pointing to my external ip in No-Ip:
Host-name: myhost.ddns.net
Target/ip: my-external-ip
Type: A
I want to use Traefik, so I want to expose the http default port (80) and https default port (443), so I made the port-forward in my router:
Doing that, I expect that http or https requests is being redirect to my internal host, that is the one which is the server of my application
Create the docker-compose.yml and traefik.yml files:
docker-compose.yml:
version: '3.7'
services:
traefik:
image: traefik:v2.0.1
container_name: traefik
restart: unless-stopped
security_opt:
- no-new-privileges:true
networks:
- external
ports:
- 80:80
- 443:443
volumes:
- /etc/localtime:/etc/localtime:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./traefik.yml:/traefik.yml:ro
- ./acme.json:/acme.json
labels:
- "traefik.enable=true"
- "traefik.http.routers.traefik.entrypoints=http"
- "traefik.http.routers.traefik.rule=Host(`traefik.myhost.ddns.net`)"
- "traefik.http.middlewares.traefik-auth.basicauth.users=*user:password*
- "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
- "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
- "traefik.http.routers.traefik-secure.entrypoints=https"
- "traefik.http.routers.traefik-secure.rule=Host(`traefik.myhost.ddns.net`)"
# - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
- "traefik.http.routers.traefik-secure.tls=true"
- "traefik.http.routers.traefik-secure.tls.certresolver=http"
- "traefik.http.routers.traefik-secure.service=api#internal"
- "traefik.http.services.traefik.loadbalancer.server.port=8080"
*another-services-configs...*
networks:
external:
external: true
traefik.yml:
api:
dashboard: true
# Writing Logs to a File, in JSON
log:
level: DEBUG
filePath: "log-file.log"
format: json
# Configuring a buffer of 100 lines
accessLog:
filePath: "log-access.log"
bufferingSize: 100
entryPoints:
http:
address: ":80"
https:
address: ":443"
providers:
docker:
endpoint: "unix:///var/run/docker.sock"
exposedByDefault: false
certificatesResolvers:
http:
acme:
email: my-email#hotmail.com
storage: acme.json
httpChallenge:
entryPoint: http
Finally, when I run docker-compose up -d , the application goes on, but I can not acess the traefik dashboard when I try to access traefik.myhost.ddns.net in the browser. The error message is that could not be found any web site with that host.
But, if I change the Host-name in the label to - traefik.http.routers.traefik.rule=Host('traefik.localhost')" , I can access the traefik dashboard typing traefik.localhost in the browser.
The question is, how can I use my ddns in the Host label to be able to access my traefik server externally?
I try to set up Traefik in version 2 but I only get "404 Page not found" or DNS_PROBE_FINISHED_NXDOMAIN errors in my browser.
When I check the API endpoints for routers I can see that my two containers are enabled in Traefik and that the rules are correct.
curl http://localhost:8080/api/http/routers
[{"entryPoints":["web","secure"],"service":"gotify-gotify","rule":"Host(`sub2.example.org`)","tls":{"certResolver":"letsencrypt"},"status":"enabled","using":["secure","web"],"name":"gotify#docker","provider":"docker"},{"entryPoints":["web","secure"],"service":"nextcloud-cloud","rule":"Host(`sub.example.org`)","tls":{"certResolver":"letsencrypt"},"status":"enabled","using":["secure","web"],"name":"nextcloud#docker","provider":"docker"}]
But on "sub2" I get no website at all and on "sub" I get "404 page not found". I have set a DNS entry for "*" so all subdomains go to the same server.
I have set the following labels for the docker containers
labels:
traefik.enable: true
traefik.http.routers.nextcloud.rule: "Host(`sub.example.org`)"
traefik.http.routers.nextcloud.entrypoints: "web, secure"
traefik.http.routers.nextcloud.tls.certresolver: "letsencrypt"
And this is my Traefik configuration traefik.toml
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.secure]
address = ":443"
[providers.docker]
exposedByDefault = false
network = "traefik"
[certificatesResolvers.letsencrypt.acme]
email = "me#example.org"
storage = "acme.json"
[certificatesResolvers.letsencrypt.acme.httpChallenge]
entryPoint = "web"
[api]
insecure = true
debug = true
dashboard = false
Traefik itself is running as a docker container.
version: "3.7"
services:
traefik:
image: traefik:v2.0
container_name: traefik
restart: unless-stopped
volumes:
- "./traefik.toml:/etc/traefik/traefik.toml"
- "./acme:/etc/traefik/acme"
- "/var/run/docker.sock:/var/run/docker.sock"
ports:
- "80:80"
- "127.0.0.1:8080:8080"
- "443:443"
networks:
- traefik
networks:
traefik:
driver: bridge
name: traefik
I use ufw to manage firewall rules and opened port 22, 80 and 443
Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
80/tcp ALLOW Anywhere
443/tcp ALLOW Anywhere
22/tcp (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
443/tcp (v6) ALLOW Anywhere (v6)
You can find a working example for traefik 2.2.1. Also, you can check full setup gist: https://gist.github.com/fatihyildizhan/8f124039a9bd3801f0caf3c01c3601fb
I prefer to use traefik.yml with version 2.0. It looks simple and many people are familiar with the YAML files.
[Traefik v2.0] - docker-compose.yml with httpChallenge
version: '3.7'
services:
traefik:
image: traefik:v2.2.1
container_name: traefik
restart: unless-stopped
security_opt:
- no-new-privileges:true
networks:
- proxy
ports:
- 80:80
- 443:443
volumes:
- /etc/localtime:/etc/localtime:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./traefik.yml:/traefik.yml:ro
- ./acme.json:/acme.json
labels:
- "traefik.enable=true"
- "traefik.http.routers.traefik.entrypoints=http"
- "traefik.http.routers.traefik.rule=Host(`traefik.your-domain.com`)"
- "traefik.http.middlewares.traefik-auth.basicauth.users=username:hashed-password"
- "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
- "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
- "traefik.http.routers.traefik-secure.entrypoints=https"
- "traefik.http.routers.traefik-secure.rule=Host(`traefik.your-domain.com`)"
- "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
- "traefik.http.routers.traefik-secure.tls=true"
- "traefik.http.routers.traefik-secure.tls.certresolver=http"
- "traefik.http.routers.traefik-secure.service=api#internal"
- "traefik.http.services.traefik.loadbalancer.server.port=8080"
networks:
proxy:
external: true
[Traefik v2.0] - traefik.yml with httpChallenge
api:
dashboard: true
# Writing Logs to a File, in JSON
log:
level: DEBUG
filePath: "log-file.log"
format: json
# Configuring a buffer of 100 lines
accessLog:
filePath: "log-access.log"
bufferingSize: 100
entryPoints:
http:
address: ":80"
https:
address: ":443"
providers:
docker:
endpoint: "unix:///var/run/docker.sock"
exposedByDefault: false
certificatesResolvers:
http:
acme:
email: your-email.com
storage: acme.json
httpChallenge:
entryPoint: http
[Traefik v2.0] - your-container docker-compose.yml
version: '3.7'
services:
your-container-name:
image: docker.pkg.github.com/username/repo-name/image-name:latest
container_name: your-container-name
restart: unless-stopped
security_opt:
- no-new-privileges:true
networks:
- proxy
volumes:
- /etc/localtime:/etc/localtime:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./data:/data
labels:
- "traefik.enable=true"
- "traefik.http.routers.your-container-name.entrypoints=http"
- "traefik.http.routers.your-container-name.rule=Host(`your-container-name.your-domain.com`)"
- "traefik.http.middlewares.your-container-name-https-redirect.redirectscheme.scheme=https"
- "traefik.http.routers.your-container-name.middlewares=your-container-name-https-redirect"
- "traefik.http.routers.your-container-name-secure.entrypoints=https"
- "traefik.http.routers.your-container-name-secure.rule=Host(`your-container-name.your-domain.com`)"
- "traefik.http.routers.your-container-name-secure.tls=true"
- "traefik.http.routers.your-container-name-secure.tls.certresolver=http"
- "traefik.http.routers.your-container-name-secure.service=your-container-name"
- "traefik.http.services.your-container-name.loadbalancer.server.port=80"
- "traefik.docker.network=proxy"
networks:
proxy:
external: true
Several things could be causing this, some of which are:
You have SSL/TLS proxying enabled at your DNS level (e.g. CloudFlare) which will prevent http challenge completion.
You have a misconfigured storage path for the certificate resolver (probably not in this case but for other readers); check your Traefik container logs docker logs traefik for errors like
level=error msg="The ACME resolver \"[resolver]\" is skipped from the resolvers
list because: unable to get ACME account: open /[path_to_storage]/acme.json:
no such file or directory
level=error msg="the router [service]#docker uses a non-existent resolver:
[resolver]"
If you see these errors, make sure the storage folder exists and/or the volume is mapped correctly from your host to the Traefik docker container (you may need to create it manually, Traefik won't do it for you, at least currently).
There is a technical issue with the service behind the proxy (e.g. Nginx, Apache, etc is misconfigured). Traefik will produce a generic 404 page not found for a series of errors that do not technically correspond to a real 404 error (e.g. 500, 501, maybe others) and this can be confusing.
I'm setting up a gitlab server behind traefik proxy, but my gitlab sshd logs says traefik send http request over 22 port to gitlab, causing Internal server error.
==> /var/log/gitlab/sshd/current <==
gitlab | 2019-08-27_03:39:15.42508 Bad protocol version identification 'GET / HTTP/1.1' from 192.168.144.2 port 33462
I found there is a similar discuss here, however the answer did not work, is there any way to change gitlab backend from 22 to 80?
The following is my code and configs.
# traefik docker-compose.yaml
version: '3'
services:
traefik:
container_name: traefik
image: traefik
command: --api
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./traefik.toml:/traefik.toml
networks:
- web
ports:
- 8080:8080
- 80:80
- 443:443
networks:
web:
external: true
# traefik.toml
debug = false
logLevel = "INFO"
defaultEntryPoints = ["http","https"]
[entryPoints]
[entryPoints.http]
address = ":80"
[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "mydomain.com"
watch = true
exposedByDefault = false
# gitlab docker-compose.yaml
version: '3'
services:
# expose 22 80 443
gitlab:
container_name: gitlab
image: gitlab/gitlab-ee
volumes:
- /nsrv/gitlab/config:/etc/gitlab
- /nsrv/gitlab/logs:/var/log/gitlab
- /nsrv/gitlab/data:/var/opt/gitlab
labels:
- traefik.enable=true
- traefik.frontend.rule=Host:gitlab.mydomain.com
- traefik.prot=80
networks:
- web
restart: always
networks:
web:
external: true
Looks like you have a typo in your gitlab docker-compose.yaml file.
Replace traefik.prot by traefik.port and it should work better.