Merge branch v2.11 into v3.0
This commit is contained in:
mmatur
commit
a69c1ba3b7
112 changed files with 1133 additions and 238 deletions
|
|
@ -4,7 +4,7 @@ This page is maintained and updated periodically to reflect our roadmap and any
|
|||
|
||||
| Feature | Deprecated | End of Support | Removal |
|
||||
|----------------------------------------------------------------------------------------------------------------------|------------|----------------|---------|
|
||||
| [Kubernetes CRDs API Version `traefik.io/v1alpha1`](#kubernetes-crds-api-version-traefikiov1alpha1) | N/A | N/A | 3.0 |
|
||||
| [Kubernetes CRDs API Version `traefik.io/v1alpha1`](#kubernetes-crds-api-version-traefikiov1alpha1) | 3.0 | N/A | 4.0 |
|
||||
| [Kubernetes Ingress API Version `networking.k8s.io/v1beta1`](#kubernetes-ingress-api-version-networkingk8siov1beta1) | N/A | N/A | 3.0 |
|
||||
| [CRD API Version `apiextensions.k8s.io/v1beta1`](#kubernetes-ingress-api-version-networkingk8siov1beta1) | N/A | N/A | 3.0 |
|
||||
|
||||
|
|
@ -12,7 +12,7 @@ This page is maintained and updated periodically to reflect our roadmap and any
|
|||
|
||||
### Kubernetes CRDs API Version `traefik.io/v1alpha1`
|
||||
|
||||
The newly introduced Kubernetes CRD API Version `traefik.io/v1alpha1` will subsequently be removed in Traefik v3. The following version will be `traefik.io/v1`.
|
||||
The Kubernetes CRD provider API Version `traefik.io/v1alpha1` will subsequently be deprecated in Traefik v3. The next version will be `traefik.io/v1`.
|
||||
|
||||
### Kubernetes Ingress API Version `networking.k8s.io/v1beta1`
|
||||
|
||||
|
|
|
|||
|
|
@ -82,11 +82,11 @@ docker run traefik[:version] --help
|
|||
# ex: docker run traefik:v3.0 --help
|
||||
```
|
||||
|
||||
All available arguments can also be found [here](../reference/static-configuration/cli.md).
|
||||
Check the [CLI reference](../reference/static-configuration/cli.md "Link to CLI reference overview") for an overview about all available arguments.
|
||||
|
||||
### Environment Variables
|
||||
|
||||
All available environment variables can be found [here](../reference/static-configuration/env.md)
|
||||
All available environment variables can be found in the [static configuration environment overview](../reference/static-configuration/env.md).
|
||||
|
||||
## Available Configuration Options
|
||||
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ Not to mention that dynamic configuration changes potentially make that kind of
|
|||
Therefore, in this dynamic context,
|
||||
the static configuration of an `entryPoint` does not give any hint whatsoever about how the traffic going through that `entryPoint` is going to be routed.
|
||||
Or whether it's even going to be routed at all,
|
||||
i.e. whether there is a Router matching the kind of traffic going through it.
|
||||
that is whether there is a Router matching the kind of traffic going through it.
|
||||
|
||||
### `404 Not found`
|
||||
|
||||
|
|
@ -71,7 +71,7 @@ Traefik returns a `502` response code when an error happens while contacting the
|
|||
|
||||
### `503 Service Unavailable`
|
||||
|
||||
Traefik returns a `503` response code when a Router has been matched
|
||||
Traefik returns a `503` response code when a Router has been matched,
|
||||
but there are no servers ready to handle the request.
|
||||
|
||||
This situation is encountered when a service has been explicitly configured without servers,
|
||||
|
|
@ -84,7 +84,7 @@ Sometimes, the `404` response code doesn't play well with other parties or servi
|
|||
In these situations, you may want Traefik to always reply with a `503` response code,
|
||||
instead of a `404` response code.
|
||||
|
||||
To achieve this behavior, a simple catchall router,
|
||||
To achieve this behavior, a catchall router,
|
||||
with the lowest possible priority and routing to a service without servers,
|
||||
can handle all the requests when no other router has been matched.
|
||||
|
||||
|
|
@ -130,7 +130,7 @@ http:
|
|||
the principle of the above example above (a catchall router) still stands,
|
||||
but the `unavailable` service should be adapted to fit such a need.
|
||||
|
||||
## Why Is My TLS Certificate Not Reloaded When Its Contents Change?
|
||||
## Why Is My TLS Certificate Not Reloaded When Its Contents Change?
|
||||
|
||||
With the file provider,
|
||||
a configuration update is only triggered when one of the [watched](../providers/file.md#provider-configuration) configuration files is modified.
|
||||
|
|
@ -216,7 +216,7 @@ error: field not found, node: -badField-
|
|||
|
||||
The "field not found" error occurs, when an unknown property is encountered in the dynamic or static configuration.
|
||||
|
||||
One easy way to check whether a configuration file is well-formed, is to validate it with:
|
||||
One way to check whether a configuration file is well-formed, is to validate it with:
|
||||
|
||||
- [JSON Schema of the static configuration](https://json.schemastore.org/traefik-v2.json)
|
||||
- [JSON Schema of the dynamic configuration](https://json.schemastore.org/traefik-v2-file-provider.json)
|
||||
|
|
@ -226,11 +226,11 @@ One easy way to check whether a configuration file is well-formed, is to validat
|
|||
As a common tip, if a resource is dropped/not created by Traefik after the dynamic configuration was evaluated,
|
||||
one should look for an error in the logs.
|
||||
|
||||
If found, the error obviously confirms that something went wrong while creating the resource,
|
||||
If found, the error confirms that something went wrong while creating the resource,
|
||||
and the message should help in figuring out the mistake(s) in the configuration, and how to fix it.
|
||||
|
||||
When using the file provider,
|
||||
one easy way to check if the dynamic configuration is well-formed is to validate it with the [JSON Schema of the dynamic configuration](https://json.schemastore.org/traefik-v2-file-provider.json).
|
||||
one way to check if the dynamic configuration is well-formed is to validate it with the [JSON Schema of the dynamic configuration](https://json.schemastore.org/traefik-v2-file-provider.json).
|
||||
|
||||
## Why does Let's Encrypt wildcard certificate renewal/generation with DNS challenge fail?
|
||||
|
||||
|
|
@ -248,6 +248,6 @@ then it could be due to `CNAME` support.
|
|||
In which case, you should make sure your infrastructure is properly set up for a
|
||||
`DNS` challenge that does not rely on `CNAME`, and you should try disabling `CNAME` support with:
|
||||
|
||||
```bash
|
||||
```shell
|
||||
LEGO_DISABLE_CNAME_SUPPORT=true
|
||||
```
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ Choose one of the [official Docker images](https://hub.docker.com/_/traefik) and
|
|||
* [YAML](https://raw.githubusercontent.com/traefik/traefik/v3.0/traefik.sample.yml)
|
||||
* [TOML](https://raw.githubusercontent.com/traefik/traefik/v3.0/traefik.sample.toml)
|
||||
|
||||
```bash
|
||||
```shell
|
||||
docker run -d -p 8080:8080 -p 80:80 \
|
||||
-v $PWD/traefik.yml:/etc/traefik/traefik.yml traefik:v3.0
|
||||
```
|
||||
|
|
@ -59,7 +59,7 @@ You can update the chart repository by running:
|
|||
helm repo update
|
||||
```
|
||||
|
||||
And install it with the `helm` command line:
|
||||
And install it with the Helm command line:
|
||||
|
||||
```bash
|
||||
helm install traefik traefik/traefik
|
||||
|
|
@ -69,7 +69,7 @@ helm install traefik traefik/traefik
|
|||
|
||||
All [Helm features](https://helm.sh/docs/intro/using_helm/) are supported.
|
||||
|
||||
Examples are provided [here](https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md).
|
||||
Examples are provided [here](https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md).
|
||||
|
||||
For instance, installing the chart in a dedicated namespace:
|
||||
|
||||
|
|
@ -106,7 +106,7 @@ helm install traefik traefik/traefik
|
|||
|
||||
### Exposing the Traefik dashboard
|
||||
|
||||
This HelmChart does not expose the Traefik dashboard by default, for security concerns.
|
||||
This Helm chart does not expose the Traefik dashboard by default, for security concerns.
|
||||
Thus, there are multiple ways to expose the dashboard.
|
||||
For instance, the dashboard access could be achieved through a port-forward:
|
||||
|
||||
|
|
|
|||
|
|
@ -1,23 +1,23 @@
|
|||
---
|
||||
title: "Traefik Getting Started With Kubernetes"
|
||||
description: "Looking to get started with Traefik Proxy? Read the technical documentation to learn a simple use case that leverages Kubernetes."
|
||||
description: "Get started with Traefik Proxy and Kubernetes."
|
||||
---
|
||||
|
||||
# Quick Start
|
||||
|
||||
A Simple Use Case of Traefik Proxy and Kubernetes
|
||||
A Use Case of Traefik Proxy and Kubernetes
|
||||
{: .subtitle }
|
||||
|
||||
This guide is an introduction to using Traefik Proxy in a Kubernetes environment.
|
||||
The objective is to learn how to run an application behind a Traefik reverse proxy in Kubernetes.
|
||||
This guide is an introduction to using Traefik Proxy in a Kubernetes environment.
|
||||
The objective is to learn how to run an application behind a Traefik reverse proxy in Kubernetes.
|
||||
It presents and explains the basic blocks required to start with Traefik such as Ingress Controller, Ingresses, Deployments, static, and dynamic configuration.
|
||||
|
||||
## Permissions and Accesses
|
||||
|
||||
Traefik uses the Kubernetes API to discover running services.
|
||||
|
||||
In order to use the Kubernetes API, Traefik needs some permissions.
|
||||
This [permission mechanism](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) is based on roles defined by the cluster administrator.
|
||||
To use the Kubernetes API, Traefik needs some permissions.
|
||||
This [permission mechanism](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) is based on roles defined by the cluster administrator.
|
||||
The role is then bound to an account used by an application, in this case, Traefik Proxy.
|
||||
|
||||
The first step is to create the role.
|
||||
|
|
@ -88,7 +88,7 @@ roleRef:
|
|||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: traefik-account
|
||||
namespace: default # Using "default" because we did not specify a namespace when creating the ClusterAccount.
|
||||
namespace: default # This tutorial uses the "default" K8s namespace.
|
||||
```
|
||||
|
||||
!!! info "`roleRef` is the Kubernetes reference to the role created in `00-role.yml`."
|
||||
|
|
@ -102,7 +102,7 @@ subjects:
|
|||
!!! info "This section can be managed with the help of the [Traefik Helm chart](../install-traefik/#use-the-helm-chart)."
|
||||
|
||||
The [ingress controller](https://traefik.io/glossary/kubernetes-ingress-and-ingress-controller-101/#what-is-a-kubernetes-ingress-controller)
|
||||
is a software that runs in the same way as any other application on a cluster.
|
||||
is a software that runs in the same way as any other application on a cluster.
|
||||
To start Traefik on the Kubernetes cluster,
|
||||
a [`Deployment`](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/deployment-v1/) resource must exist to describe how to configure
|
||||
and scale containers horizontally to support larger workloads.
|
||||
|
|
@ -141,12 +141,12 @@ spec:
|
|||
containerPort: 8080
|
||||
```
|
||||
|
||||
The deployment contains an important attribute for customizing Traefik: `args`.
|
||||
These arguments are the static configuration for Traefik.
|
||||
The deployment contains an important attribute for customizing Traefik: `args`.
|
||||
These arguments are the static configuration for Traefik.
|
||||
From here, it is possible to enable the dashboard,
|
||||
configure entry points,
|
||||
select dynamic configuration providers,
|
||||
and [more](../reference/static-configuration/cli.md)...
|
||||
and [more](../reference/static-configuration/cli.md).
|
||||
|
||||
In this deployment,
|
||||
the static configuration enables the Traefik dashboard,
|
||||
|
|
@ -159,10 +159,10 @@ and uses Kubernetes native Ingress resources as router definitions to route inco
|
|||
!!! info "When enabling the [`api.insecure`](../../operations/api/#insecure) mode, Traefik exposes the dashboard on the port `8080`."
|
||||
|
||||
A deployment manages scaling and then can create lots of containers, called [Pods](https://kubernetes.io/docs/concepts/workloads/pods/).
|
||||
Each Pod is configured following the `spec` field in the deployment.
|
||||
Each Pod is configured following the `spec` field in the deployment.
|
||||
Given that, a Deployment can run multiple Traefik Proxy Pods,
|
||||
a piece is required to forward the traffic to any of the instance:
|
||||
namely a [`Service`](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#Service).
|
||||
namely a [`Service`](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#Service).
|
||||
Create a file called `02-traefik-services.yml` and insert the two `Service` resources:
|
||||
|
||||
```yaml tab="02-traefik-services.yml"
|
||||
|
|
@ -195,7 +195,7 @@ spec:
|
|||
|
||||
!!! warning "It is possible to expose a service in different ways."
|
||||
|
||||
Depending on your working environment and use case, the `spec.type` might change.
|
||||
Depending on your working environment and use case, the `spec.type` might change.
|
||||
It is strongly recommended to understand the available [service types](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) before proceeding to the next step.
|
||||
|
||||
It is now time to apply those files on your cluster to start Traefik.
|
||||
|
|
@ -210,11 +210,11 @@ kubectl apply -f 00-role.yml \
|
|||
|
||||
## Proxying applications
|
||||
|
||||
The only part still missing is the business application behind the reverse proxy.
|
||||
The only part still missing is the business application behind the reverse proxy.
|
||||
For this guide, we use the example application [traefik/whoami](https://github.com/traefik/whoami),
|
||||
but the principles are applicable to any other application.
|
||||
|
||||
The `whoami` application is a simple HTTP server running on port 80 which answers host-related information to the incoming requests.
|
||||
The `whoami` application is an HTTP server running on port 80 which answers host-related information to the incoming requests.
|
||||
As usual, start by creating a file called `03-whoami.yml` and paste the following `Deployment` resource:
|
||||
|
||||
```yaml tab="03-whoami.yml"
|
||||
|
|
@ -262,8 +262,8 @@ spec:
|
|||
```
|
||||
|
||||
Thanks to the Kubernetes API,
|
||||
Traefik is notified when an Ingress resource is created, updated, or deleted.
|
||||
This makes the process dynamic.
|
||||
Traefik is notified when an Ingress resource is created, updated, or deleted.
|
||||
This makes the process dynamic.
|
||||
The ingresses are, in a way, the [dynamic configuration](../../providers/kubernetes-ingress/) for Traefik.
|
||||
|
||||
!!! tip
|
||||
|
|
|
|||
|
|
@ -1,11 +1,11 @@
|
|||
---
|
||||
title: "Traefik Getting Started Quickly"
|
||||
description: "Looking to get started with Traefik Proxy quickly? Read the technical documentation to see a basic use case that leverages Docker."
|
||||
description: "Get started with Traefik Proxy and Docker."
|
||||
---
|
||||
|
||||
# Quick Start
|
||||
|
||||
A Basic Use Case Using Docker
|
||||
A Use Case Using Docker
|
||||
{: .subtitle }
|
||||
|
||||
|
||||
|
|
@ -19,9 +19,9 @@ version: '3'
|
|||
|
||||
services:
|
||||
reverse-proxy:
|
||||
# The official v3 Traefik Docker image
|
||||
# The official v2 Traefik docker image
|
||||
image: traefik:v3.0
|
||||
# Enables the web UI and tells Traefik to listen to Docker
|
||||
# Enables the web UI and tells Traefik to listen to docker
|
||||
command: --api.insecure=true --providers.docker
|
||||
ports:
|
||||
# The HTTP port
|
||||
|
|
@ -41,11 +41,11 @@ Start your `reverse-proxy` with the following command:
|
|||
docker-compose up -d reverse-proxy
|
||||
```
|
||||
|
||||
You can open a browser and go to `http://localhost:8080/api/rawdata` to see Traefik's API rawdata (we'll go back there once we have launched a service in step 2).
|
||||
You can open a browser and go to `http://localhost:8080/api/rawdata` to see Traefik's API rawdata (you'll go back there once you have launched a service in step 2).
|
||||
|
||||
## Traefik Detects New Services and Creates the Route for You
|
||||
|
||||
Now that we have a Traefik instance up and running, we will deploy new services.
|
||||
Now that you have a Traefik instance up and running, you will deploy new services.
|
||||
|
||||
Edit your `docker-compose.yml` file and add the following at the end of your file.
|
||||
|
||||
|
|
@ -63,7 +63,7 @@ services:
|
|||
- "traefik.http.routers.whoami.rule=Host(`whoami.docker.localhost`)"
|
||||
```
|
||||
|
||||
The above defines [`whoami`](https://github.com/traefik/whoami "Link to whoami app on GitHub"), a web service that outputs information about the machine it is deployed on (its IP address, host, etc.).
|
||||
The above defines `whoami`: a web service that outputs information about the machine it is deployed on (its IP address, host, and others).
|
||||
|
||||
Start the `whoami` service with the following command:
|
||||
|
||||
|
|
@ -73,7 +73,7 @@ docker-compose up -d whoami
|
|||
|
||||
Browse `http://localhost:8080/api/rawdata` and see that Traefik has automatically detected the new container and updated its own configuration.
|
||||
|
||||
When Traefik detects new services, it creates the corresponding routes, so you can call them ... _let's see!_ (Here, we're using curl)
|
||||
When Traefik detects new services, it creates the corresponding routes, so you can call them ... _let's see!_ (Here, you're using curl)
|
||||
|
||||
```shell
|
||||
curl -H Host:whoami.docker.localhost http://127.0.0.1
|
||||
|
|
@ -103,7 +103,7 @@ Finally, see that Traefik load-balances between the two instances of your servic
|
|||
curl -H Host:whoami.docker.localhost http://127.0.0.1
|
||||
```
|
||||
|
||||
The output will show alternatively one of the followings:
|
||||
The output will show alternatively one of the following:
|
||||
|
||||
```yaml
|
||||
Hostname: a656c8ddca6c
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ Traefik is natively compliant with every major cluster technology, such as Kuber
|
|||
With Traefik, there is no need to maintain and synchronize a separate configuration file: everything happens automatically, in real time (no restarts, no connection interruptions).
|
||||
With Traefik, you spend time developing and deploying new features to your system, not on configuring and maintaining its working state.
|
||||
|
||||
Developing Traefik, our main goal is to make it simple to use, and we're sure you'll enjoy it.
|
||||
Developing Traefik, our main goal is to make it effortless to use, and we're sure you'll enjoy it.
|
||||
|
||||
-- The Traefik Maintainer Team
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,21 @@ description: "Learn how to use IPAllowList in HTTP middleware for limiting clien
|
|||
Limiting Clients to Specific IPs
|
||||
{: .subtitle }
|
||||
|
||||
<<<<<<<< HEAD:docs/content/middlewares/http/ipallowlist.md
|
||||
IPAllowList accepts / refuses requests based on the client IP.
|
||||
|||||||| dae0491b6:docs/content/middlewares/http/ipwhitelist.md
|
||||
|
||||
|
||||
IPWhitelist accepts / refuses requests based on the client IP.
|
||||
========
|
||||
|
||||
|
||||
IPWhiteList accepts / refuses requests based on the client IP.
|
||||
|
||||
!!! warning
|
||||
|
||||
This middleware is deprecated, please use the [IPAllowList](./ipallowlist.md) middleware instead.
|
||||
>>>>>>>> upstream/v2.11:docs/content/middlewares/http/ipwhitelist.md
|
||||
|
||||
## Configuration Examples
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ description: "Learn how to use IPAllowList in TCP middleware for limiting client
|
|||
Limiting Clients to Specific IPs
|
||||
{: .subtitle }
|
||||
|
||||
IPAllowList accepts / refuses connections based on the client IP.
|
||||
IPWhitelist accepts / refuses connections based on the client IP.
|
||||
|
||||
## Configuration Examples
|
||||
|
||||
|
|
|
|||
|
|
@ -526,3 +526,13 @@ kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v2.10/docs/co
|
|||
### Traefik Hub
|
||||
|
||||
In `v2.10`, Traefik Hub configuration has been removed because Traefik Hub v2 doesn't require this configuration.
|
||||
|
||||
## v2.11
|
||||
|
||||
### IPWhiteList (HTTP)
|
||||
|
||||
In `v2.11`, the `IPWhiteList` middleware is deprecated, please use the [IPAllowList](../middlewares/http/ipallowlist.md) middleware instead.
|
||||
|
||||
### IPWhiteList (TCP)
|
||||
|
||||
In `v2.11`, the `IPWhiteList` middleware is deprecated, please use the [IPAllowList](../middlewares/tcp/ipallowlist.md) middleware instead.
|
||||
|
|
|
|||
|
|
@ -71,11 +71,11 @@ with a router attached to the service `api@internal` in the
|
|||
to allow defining:
|
||||
|
||||
- One or more security features through [middlewares](../middlewares/overview.md)
|
||||
like authentication ([basicAuth](../middlewares/http/basicauth.md) , [digestAuth](../middlewares/http/digestauth.md),
|
||||
like authentication ([basicAuth](../middlewares/http/basicauth.md), [digestAuth](../middlewares/http/digestauth.md),
|
||||
[forwardAuth](../middlewares/http/forwardauth.md)) or [allowlisting](../middlewares/http/ipallowlist.md).
|
||||
|
||||
- A [router rule](#dashboard-router-rule) for accessing the dashboard,
|
||||
through Traefik itself (sometimes referred as "Traefik-ception").
|
||||
through Traefik itself (sometimes referred to as "Traefik-ception").
|
||||
|
||||
### Dashboard Router Rule
|
||||
|
||||
|
|
@ -83,7 +83,7 @@ As underlined in the [documentation for the `api.dashboard` option](./api.md#das
|
|||
the [router rule](../routing/routers/index.md#rule) defined for Traefik must match
|
||||
the path prefixes `/api` and `/dashboard`.
|
||||
|
||||
We recommend to use a "Host Based rule" as ```Host(`traefik.example.com`)``` to match everything on the host domain,
|
||||
We recommend using a "Host Based rule" as ```Host(`traefik.example.com`)``` to match everything on the host domain,
|
||||
or to make sure that the defined rule captures both prefixes:
|
||||
|
||||
```bash tab="Host Rule"
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@ whose default value is `traefik` (port `8080`).
|
|||
|
||||
| Path | Method | Description |
|
||||
|---------|---------------|-----------------------------------------------------------------------------------------------------|
|
||||
| `/ping` | `GET`, `HEAD` | A simple endpoint to check for Traefik process liveness. Return a code `200` with the content: `OK` |
|
||||
| `/ping` | `GET`, `HEAD` | An endpoint to check for Traefik process liveness. Return a code `200` with the content: `OK` |
|
||||
|
||||
!!! note
|
||||
The `cli` comes with a [`healthcheck`](./cli.md#healthcheck) command which can be used for calling this endpoint.
|
||||
|
|
@ -92,10 +92,11 @@ ping:
|
|||
_Optional, Default=503_
|
||||
|
||||
During the period in which Traefik is gracefully shutting down, the ping handler
|
||||
returns a 503 status code by default. If Traefik is behind e.g. a load-balancer
|
||||
returns a `503` status code by default.
|
||||
If Traefik is behind, for example a load-balancer
|
||||
doing health checks (such as the Kubernetes LivenessProbe), another code might
|
||||
be expected as the signal for graceful termination. In which case, the
|
||||
terminatingStatusCode can be used to set the code returned by the ping
|
||||
be expected as the signal for graceful termination.
|
||||
In that case, the terminatingStatusCode can be used to set the code returned by the ping
|
||||
handler during termination.
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
|
|
|
|||
|
|
@ -163,7 +163,7 @@ See the [Docker API Access](#docker-api-access) section for more information.
|
|||
|
||||
services:
|
||||
traefik:
|
||||
image: traefik:v3.0 # The official v2 Traefik docker image
|
||||
image: traefik:v3.0 # The official v3 Traefik docker image
|
||||
ports:
|
||||
- "80:80"
|
||||
volumes:
|
||||
|
|
|
|||
|
|
@ -229,3 +229,166 @@ providers:
|
|||
```bash tab="CLI"
|
||||
--providers.redis.tls.insecureSkipVerify=true
|
||||
```
|
||||
|
||||
### `sentinel`
|
||||
|
||||
_Optional_
|
||||
|
||||
Defines the Sentinel configuration used to interact with Redis Sentinel.
|
||||
|
||||
#### `masterName`
|
||||
|
||||
_Required_
|
||||
|
||||
`masterName` is the name of the Sentinel master.
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
providers:
|
||||
redis:
|
||||
sentinel:
|
||||
masterName: my-master
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[providers.redis.sentinel]
|
||||
masterName = "my-master"
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
--providers.redis.sentinel.masterName=my-master
|
||||
```
|
||||
|
||||
#### `username`
|
||||
|
||||
_Optional_
|
||||
|
||||
`username` is the username for Sentinel authentication.
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
providers:
|
||||
redis:
|
||||
sentinel:
|
||||
username: user
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[providers.redis.sentinel]
|
||||
username = "user"
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
--providers.redis.sentinel.username=user
|
||||
```
|
||||
|
||||
#### `password`
|
||||
|
||||
_Optional_
|
||||
|
||||
`password` is the password for Sentinel authentication.
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
providers:
|
||||
redis:
|
||||
sentinel:
|
||||
password: password
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[providers.redis.sentinel]
|
||||
password = "password"
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
--providers.redis.sentinel.password=password
|
||||
```
|
||||
|
||||
#### `latencyStrategy`
|
||||
|
||||
_Optional, Default=false_
|
||||
|
||||
`latencyStrategy` defines whether to route commands to the closest master or replica nodes
|
||||
(mutually exclusive with RandomStrategy and ReplicaStrategy).
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
providers:
|
||||
redis:
|
||||
sentinel:
|
||||
latencyStrategy: true
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[providers.redis.sentinel]
|
||||
latencyStrategy = true
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
--providers.redis.sentinel.latencyStrategy=true
|
||||
```
|
||||
|
||||
#### `randomStrategy`
|
||||
|
||||
_Optional, Default=false_
|
||||
|
||||
`randomStrategy` defines whether to route commands randomly to master or replica nodes
|
||||
(mutually exclusive with LatencyStrategy and ReplicaStrategy).
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
providers:
|
||||
redis:
|
||||
sentinel:
|
||||
randomStrategy: true
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[providers.redis.sentinel]
|
||||
randomStrategy = true
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
--providers.redis.sentinel.randomStrategy=true
|
||||
```
|
||||
|
||||
#### `replicaStrategy`
|
||||
|
||||
_Optional, Default=false_
|
||||
|
||||
`replicaStrategy` Defines whether to route all commands to replica nodes
|
||||
(mutually exclusive with LatencyStrategy and RandomStrategy).
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
providers:
|
||||
redis:
|
||||
sentinel:
|
||||
replicaStrategy: true
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[providers.redis.sentinel]
|
||||
replicaStrategy = true
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
--providers.redis.sentinel.replicaStrategy=true
|
||||
```
|
||||
|
||||
#### `useDisconnectedReplicas`
|
||||
|
||||
_Optional, Default=false_
|
||||
|
||||
`useDisconnectedReplicas` defines whether to use replicas disconnected with master when cannot get connected replicas.
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
providers:
|
||||
redis:
|
||||
sentinel:
|
||||
useDisconnectedReplicas: true
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[providers.redis.sentinel]
|
||||
useDisconnectedReplicas = true
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
--providers.redis.sentinel.useDisconnectedReplicas=true
|
||||
```
|
||||
|
|
|
|||
|
|
@ -163,6 +163,7 @@
|
|||
- "traefik.http.services.service01.loadbalancer.server.scheme=foobar"
|
||||
- "traefik.tcp.middlewares.tcpmiddleware00.ipallowlist.sourcerange=foobar, foobar"
|
||||
- "traefik.tcp.middlewares.tcpmiddleware01.inflightconn.amount=42"
|
||||
- "traefik.tcp.middlewares.tcpmiddleware02.ipallowlist.sourcerange=foobar, foobar"
|
||||
- "traefik.tcp.routers.tcprouter0.entrypoints=foobar, foobar"
|
||||
- "traefik.tcp.routers.tcprouter0.middlewares=foobar, foobar"
|
||||
- "traefik.tcp.routers.tcprouter0.rule=foobar"
|
||||
|
|
|
|||
|
|
@ -450,6 +450,11 @@ tcp:
|
|||
TCPMiddleware01:
|
||||
inFlightConn:
|
||||
amount: 42
|
||||
TCPMiddleware02:
|
||||
ipAllowList:
|
||||
sourceRange:
|
||||
- foobar
|
||||
- foobar
|
||||
serversTransports:
|
||||
TCPServersTransport0:
|
||||
dialTimeout: 42s
|
||||
|
|
|
|||
|
|
@ -177,6 +177,12 @@ Trust all. (Default: ```false```)
|
|||
`--entrypoints.<name>.proxyprotocol.trustedips`:
|
||||
Trust only selected IPs.
|
||||
|
||||
`--entrypoints.<name>.transport.keepalivemaxrequests`:
|
||||
Maximum number of requests before closing a keep-alive connection. (Default: ```0```)
|
||||
|
||||
`--entrypoints.<name>.transport.keepalivemaxtime`:
|
||||
Maximum duration before closing a keep-alive connection. (Default: ```0```)
|
||||
|
||||
`--entrypoints.<name>.transport.lifecycle.gracetimeout`:
|
||||
Duration to give active requests a chance to finish before Traefik stops. (Default: ```10```)
|
||||
|
||||
|
|
@ -217,7 +223,7 @@ plugin's version.
|
|||
Periodically check if a new version has been released. (Default: ```true```)
|
||||
|
||||
`--global.sendanonymoususage`:
|
||||
Periodically send anonymous usage statistics. If the option is not specified, it will be enabled by default. (Default: ```false```)
|
||||
Periodically send anonymous usage statistics. If the option is not specified, it will be disabled by default. (Default: ```false```)
|
||||
|
||||
`--hostresolver`:
|
||||
Enable CNAME Flattening. (Default: ```false```)
|
||||
|
|
@ -822,6 +828,27 @@ Password for authentication.
|
|||
`--providers.redis.rootkey`:
|
||||
Root key used for KV store. (Default: ```traefik```)
|
||||
|
||||
`--providers.redis.sentinel.latencystrategy`:
|
||||
Defines whether to route commands to the closest master or replica nodes (mutually exclusive with RandomStrategy and ReplicaStrategy). (Default: ```false```)
|
||||
|
||||
`--providers.redis.sentinel.mastername`:
|
||||
Name of the master.
|
||||
|
||||
`--providers.redis.sentinel.password`:
|
||||
Password for Sentinel authentication.
|
||||
|
||||
`--providers.redis.sentinel.randomstrategy`:
|
||||
Defines whether to route commands randomly to master or replica nodes (mutually exclusive with LatencyStrategy and ReplicaStrategy). (Default: ```false```)
|
||||
|
||||
`--providers.redis.sentinel.replicastrategy`:
|
||||
Defines whether to route all commands to replica nodes (mutually exclusive with LatencyStrategy and RandomStrategy). (Default: ```false```)
|
||||
|
||||
`--providers.redis.sentinel.usedisconnectedreplicas`:
|
||||
Use replicas disconnected with master when cannot get connected replicas. (Default: ```false```)
|
||||
|
||||
`--providers.redis.sentinel.username`:
|
||||
Username for Sentinel authentication.
|
||||
|
||||
`--providers.redis.tls.ca`:
|
||||
TLS CA
|
||||
|
||||
|
|
|
|||
|
|
@ -177,6 +177,12 @@ Trust all. (Default: ```false```)
|
|||
`TRAEFIK_ENTRYPOINTS_<NAME>_PROXYPROTOCOL_TRUSTEDIPS`:
|
||||
Trust only selected IPs.
|
||||
|
||||
`TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_KEEPALIVEMAXREQUESTS`:
|
||||
Maximum number of requests before closing a keep-alive connection. (Default: ```0```)
|
||||
|
||||
`TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_KEEPALIVEMAXTIME`:
|
||||
Maximum duration before closing a keep-alive connection. (Default: ```0```)
|
||||
|
||||
`TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_LIFECYCLE_GRACETIMEOUT`:
|
||||
Duration to give active requests a chance to finish before Traefik stops. (Default: ```10```)
|
||||
|
||||
|
|
@ -217,7 +223,7 @@ plugin's version.
|
|||
Periodically check if a new version has been released. (Default: ```true```)
|
||||
|
||||
`TRAEFIK_GLOBAL_SENDANONYMOUSUSAGE`:
|
||||
Periodically send anonymous usage statistics. If the option is not specified, it will be enabled by default. (Default: ```false```)
|
||||
Periodically send anonymous usage statistics. If the option is not specified, it will be disabled by default. (Default: ```false```)
|
||||
|
||||
`TRAEFIK_HOSTRESOLVER`:
|
||||
Enable CNAME Flattening. (Default: ```false```)
|
||||
|
|
@ -822,6 +828,27 @@ Password for authentication.
|
|||
`TRAEFIK_PROVIDERS_REDIS_ROOTKEY`:
|
||||
Root key used for KV store. (Default: ```traefik```)
|
||||
|
||||
`TRAEFIK_PROVIDERS_REDIS_SENTINEL_LATENCYSTRATEGY`:
|
||||
Defines whether to route commands to the closest master or replica nodes (mutually exclusive with RandomStrategy and ReplicaStrategy). (Default: ```false```)
|
||||
|
||||
`TRAEFIK_PROVIDERS_REDIS_SENTINEL_MASTERNAME`:
|
||||
Name of the master.
|
||||
|
||||
`TRAEFIK_PROVIDERS_REDIS_SENTINEL_PASSWORD`:
|
||||
Password for Sentinel authentication.
|
||||
|
||||
`TRAEFIK_PROVIDERS_REDIS_SENTINEL_RANDOMSTRATEGY`:
|
||||
Defines whether to route commands randomly to master or replica nodes (mutually exclusive with LatencyStrategy and ReplicaStrategy). (Default: ```false```)
|
||||
|
||||
`TRAEFIK_PROVIDERS_REDIS_SENTINEL_REPLICASTRATEGY`:
|
||||
Defines whether to route all commands to replica nodes (mutually exclusive with LatencyStrategy and RandomStrategy). (Default: ```false```)
|
||||
|
||||
`TRAEFIK_PROVIDERS_REDIS_SENTINEL_USEDISCONNECTEDREPLICAS`:
|
||||
Use replicas disconnected with master when cannot get connected replicas. (Default: ```false```)
|
||||
|
||||
`TRAEFIK_PROVIDERS_REDIS_SENTINEL_USERNAME`:
|
||||
Username for Sentinel authentication.
|
||||
|
||||
`TRAEFIK_PROVIDERS_REDIS_TLS_CA`:
|
||||
TLS CA
|
||||
|
||||
|
|
|
|||
|
|
@ -35,6 +35,8 @@
|
|||
address = "foobar"
|
||||
asDefault = true
|
||||
[entryPoints.EntryPoint0.transport]
|
||||
keepAliveMaxRequests = 42
|
||||
keepAliveMaxTime = "42s"
|
||||
[entryPoints.EntryPoint0.transport.lifeCycle]
|
||||
requestAcceptGraceTimeout = "42s"
|
||||
graceTimeOut = "42s"
|
||||
|
|
@ -242,6 +244,14 @@
|
|||
cert = "foobar"
|
||||
key = "foobar"
|
||||
insecureSkipVerify = true
|
||||
[providers.redis.sentinel]
|
||||
masterName = "foobar"
|
||||
username = "foobar"
|
||||
password = "foobar"
|
||||
latencyStrategy = true
|
||||
randomStrategy = true
|
||||
replicaStrategy = true
|
||||
useDisconnectedReplicas = true
|
||||
[providers.http]
|
||||
endpoint = "foobar"
|
||||
pollInterval = "42s"
|
||||
|
|
|
|||
|
|
@ -36,6 +36,8 @@ entryPoints:
|
|||
address: foobar
|
||||
asDefault: true
|
||||
transport:
|
||||
keepAliveMaxRequests: 42
|
||||
keepAliveMaxTime: 42s
|
||||
lifeCycle:
|
||||
requestAcceptGraceTimeout: 42s
|
||||
graceTimeOut: 42s
|
||||
|
|
@ -271,6 +273,14 @@ providers:
|
|||
cert: foobar
|
||||
key: foobar
|
||||
insecureSkipVerify: true
|
||||
sentinel:
|
||||
masterName: foobar
|
||||
username: foobar
|
||||
password: foobar
|
||||
latencyStrategy: true
|
||||
randomStrategy: true
|
||||
replicaStrategy: true
|
||||
useDisconnectedReplicas: true
|
||||
http:
|
||||
endpoint: foobar
|
||||
pollInterval: 42s
|
||||
|
|
|
|||
|
|
@ -623,17 +623,77 @@ Controls the behavior of Traefik during the shutdown phase.
|
|||
--entryPoints.name.transport.lifeCycle.graceTimeOut=42
|
||||
```
|
||||
|
||||
#### `keepAliveMaxRequests`
|
||||
|
||||
_Optional, Default=0_
|
||||
|
||||
The maximum number of requests Traefik can handle before sending a `Connection: Close` header to the client (for HTTP2, Traefik sends a GOAWAY). Zero means no limit.
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## Static configuration
|
||||
entryPoints:
|
||||
name:
|
||||
address: ":8888"
|
||||
transport:
|
||||
keepAliveMaxRequests: 42
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
## Static configuration
|
||||
[entryPoints]
|
||||
[entryPoints.name]
|
||||
address = ":8888"
|
||||
[entryPoints.name.transport]
|
||||
keepAliveMaxRequests = 42
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
## Static configuration
|
||||
--entryPoints.name.address=:8888
|
||||
--entryPoints.name.transport.keepAliveRequests=42
|
||||
```
|
||||
|
||||
#### `keepAliveMaxTime`
|
||||
|
||||
_Optional, Default=0s_
|
||||
|
||||
The maximum duration Traefik can handle requests before sending a `Connection: Close` header to the client (for HTTP2, Traefik sends a GOAWAY). Zero means no limit.
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## Static configuration
|
||||
entryPoints:
|
||||
name:
|
||||
address: ":8888"
|
||||
transport:
|
||||
keepAliveMaxTime: 42s
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
## Static configuration
|
||||
[entryPoints]
|
||||
[entryPoints.name]
|
||||
address = ":8888"
|
||||
[entryPoints.name.transport]
|
||||
keepAliveMaxTime = 42s
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
## Static configuration
|
||||
--entryPoints.name.address=:8888
|
||||
--entryPoints.name.transport.keepAliveTime=42s
|
||||
```
|
||||
|
||||
### ProxyProtocol
|
||||
|
||||
Traefik supports [ProxyProtocol](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt) version 1 and 2.
|
||||
Traefik supports [PROXY protocol](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt) version 1 and 2.
|
||||
|
||||
If Proxy Protocol header parsing is enabled for the entry point, this entry point can accept connections with or without Proxy Protocol headers.
|
||||
If PROXY protocol header parsing is enabled for the entry point, this entry point can accept connections with or without PROXY protocol headers.
|
||||
|
||||
If the Proxy Protocol header is passed, then the version is determined automatically.
|
||||
If the PROXY protocol header is passed, then the version is determined automatically.
|
||||
|
||||
??? info "`proxyProtocol.trustedIPs`"
|
||||
|
||||
Enabling Proxy Protocol with Trusted IPs.
|
||||
Enabling PROXY protocol with Trusted IPs.
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## Static configuration
|
||||
|
|
@ -696,7 +756,7 @@ If the Proxy Protocol header is passed, then the version is determined automatic
|
|||
|
||||
!!! warning "Queuing Traefik behind Another Load Balancer"
|
||||
|
||||
When queuing Traefik behind another load-balancer, make sure to configure Proxy Protocol on both sides.
|
||||
When queuing Traefik behind another load-balancer, make sure to configure PROXY protocol on both sides.
|
||||
Not doing so could introduce a security risk in your system (enabling request forgery).
|
||||
|
||||
## HTTP Options
|
||||
|
|
|
|||
|
|
@ -3,9 +3,9 @@ title: "Traefik Docker DNS Challenge Documentation"
|
|||
description: "Learn how to create a certificate with the Let's Encrypt DNS challenge to use HTTPS on a Service exposed with Traefik Proxy. Read the tehnical documentation."
|
||||
---
|
||||
|
||||
# Docker-compose with let's encrypt: DNS Challenge
|
||||
# Docker-compose with Let's Encrypt: DNS Challenge
|
||||
|
||||
This guide aim to demonstrate how to create a certificate with the let's encrypt DNS challenge to use https on a simple service exposed with Traefik.
|
||||
This guide aim to demonstrate how to create a certificate with the Let's Encrypt DNS challenge to use https on a simple service exposed with Traefik.
|
||||
Please also read the [basic example](../basic-example) for details on how to expose such a service.
|
||||
|
||||
## Prerequisite
|
||||
|
|
@ -52,7 +52,7 @@ For the DNS challenge, you'll need:
|
|||
!!! Note
|
||||
|
||||
If you uncommented the `acme.caserver` line, you will get an SSL error, but if you display the certificate and see it was emitted by `Fake LE Intermediate X1` then it means all is good.
|
||||
(It is the staging environment intermediate certificate used by let's encrypt).
|
||||
(It is the staging environment intermediate certificate used by Let's Encrypt).
|
||||
You can now safely comment the `acme.caserver` line, remove the `letsencrypt/acme.json` file and restart Traefik to issue a valid certificate.
|
||||
|
||||
## Explanation
|
||||
|
|
@ -69,7 +69,7 @@ ports:
|
|||
- "443:443"
|
||||
```
|
||||
|
||||
- We configure the DNS let's encrypt challenge:
|
||||
- We configure the DNS Let's Encrypt challenge:
|
||||
|
||||
```yaml
|
||||
command:
|
||||
|
|
@ -77,7 +77,7 @@ command:
|
|||
- "--certificatesresolvers.myresolver.acme.dnschallenge=true"
|
||||
# Tell which provider to use
|
||||
- "--certificatesresolvers.myresolver.acme.dnschallenge.provider=ovh"
|
||||
# The email to provide to let's encrypt
|
||||
# The email to provide to Let's Encrypt
|
||||
- "--certificatesresolvers.myresolver.acme.email=postmaster@example.com"
|
||||
```
|
||||
|
||||
|
|
@ -175,7 +175,7 @@ services:
|
|||
- "ovh_consumer_key"
|
||||
```
|
||||
|
||||
- The environment variable within our `whoami` service are suffixed by `_FILE` which allow us to point to files containing the value, instead of exposing the value itself.
|
||||
- The environment variable within our `traefik` service are suffixed by `_FILE` which allow us to point to files containing the value, instead of exposing the value itself.
|
||||
The acme client will read the content of those file to get the required configuration values.
|
||||
|
||||
```yaml
|
||||
|
|
|
|||
|
|
@ -3,9 +3,9 @@ title: "Traefik Docker HTTP Challenge Documentation"
|
|||
description: "Learn how to create a certificate with the Let's Encrypt HTTP challenge to use HTTPS on a Service exposed with Traefik Proxy. Read the technical documentation."
|
||||
---
|
||||
|
||||
# Docker-compose with let's encrypt : HTTP Challenge
|
||||
# Docker-compose with Let's Encrypt : HTTP Challenge
|
||||
|
||||
This guide aim to demonstrate how to create a certificate with the let's encrypt HTTP challenge to use https on a simple service exposed with Traefik.
|
||||
This guide aim to demonstrate how to create a certificate with the Let's Encrypt HTTP challenge to use https on a simple service exposed with Traefik.
|
||||
Please also read the [basic example](../basic-example) for details on how to expose such a service.
|
||||
|
||||
## Prerequisite
|
||||
|
|
@ -38,7 +38,7 @@ For the HTTP challenge you will need:
|
|||
!!! Note
|
||||
|
||||
If you uncommented the `acme.caserver` line, you will get an SSL error, but if you display the certificate and see it was emitted by `Fake LE Intermediate X1` then it means all is good.
|
||||
(It is the staging environment intermediate certificate used by let's encrypt).
|
||||
(It is the staging environment intermediate certificate used by Let's Encrypt).
|
||||
You can now safely comment the `acme.caserver` line, remove the `letsencrypt/acme.json` file and restart Traefik to issue a valid certificate.
|
||||
|
||||
## Explanation
|
||||
|
|
@ -55,7 +55,7 @@ ports:
|
|||
- "443:443"
|
||||
```
|
||||
|
||||
- We configure the HTTPS let's encrypt challenge:
|
||||
- We configure the HTTPS Let's Encrypt challenge:
|
||||
|
||||
```yaml
|
||||
command:
|
||||
|
|
@ -63,7 +63,7 @@ command:
|
|||
- "--certificatesresolvers.myresolver.acme.httpchallenge=true"
|
||||
# Tell it to use our predefined entrypoint named "web"
|
||||
- "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
|
||||
# The email to provide to let's encrypt
|
||||
# The email to provide to Let's Encrypt
|
||||
- "--certificatesresolvers.myresolver.acme.email=postmaster@example.com"
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -3,9 +3,9 @@ title: "Traefik Docker TLS Challenge Documentation"
|
|||
description: "Learn how to create a certificate with the Let's Encrypt TLS challenge to use HTTPS on a service exposed with Traefik Proxy. Read the technical documentation."
|
||||
---
|
||||
|
||||
# Docker-compose with let's encrypt: TLS Challenge
|
||||
# Docker-compose with Let's Encrypt: TLS Challenge
|
||||
|
||||
This guide aim to demonstrate how to create a certificate with the let's encrypt TLS challenge to use https on a simple service exposed with Traefik.
|
||||
This guide aim to demonstrate how to create a certificate with the Let's Encrypt TLS challenge to use https on a simple service exposed with Traefik.
|
||||
Please also read the [basic example](../basic-example) for details on how to expose such a service.
|
||||
|
||||
## Prerequisite
|
||||
|
|
@ -38,7 +38,7 @@ For the TLS challenge you will need:
|
|||
!!! Note
|
||||
|
||||
If you uncommented the `acme.caserver` line, you will get an SSL error, but if you display the certificate and see it was emitted by `Fake LE Intermediate X1` then it means all is good.
|
||||
(It is the staging environment intermediate certificate used by let's encrypt).
|
||||
(It is the staging environment intermediate certificate used by Let's Encrypt).
|
||||
You can now safely comment the `acme.caserver` line, remove the `letsencrypt/acme.json` file and restart Traefik to issue a valid certificate.
|
||||
|
||||
## Explanation
|
||||
|
|
@ -55,7 +55,7 @@ ports:
|
|||
- "443:443"
|
||||
```
|
||||
|
||||
- We configure the Https let's encrypt challenge:
|
||||
- We configure the TLS Let's Encrypt challenge:
|
||||
|
||||
```yaml
|
||||
command:
|
||||
|
|
|
|||
|
|
@ -1,16 +1,15 @@
|
|||
---
|
||||
title: "Traefik Docker Documentation"
|
||||
description: "This guide covers a Docker Compose file exposing a service using the Docker provider in Traefik Proxy. Read the technical documentation."
|
||||
description: "Learn how to use Docker Compose to expose a service with Traefik Proxy."
|
||||
---
|
||||
|
||||
# Docker Compose example
|
||||
|
||||
In this section, we quickly go over a Docker Compose file exposing a service using the Docker provider.
|
||||
This will also be used as a starting point for the other Docker Compose guides.
|
||||
In this section, you will learn how to use [Docker Compose](https://docs.docker.com/compose/ "Link to Docker Compose") to expose a service using the Docker provider.
|
||||
|
||||
## Setup
|
||||
|
||||
- Edit a `docker-compose.yml` file with the following content:
|
||||
Create a `docker-compose.yml` file with the following content:
|
||||
|
||||
```yaml
|
||||
--8<-- "content/user-guides/docker-compose/basic-example/docker-compose.yml"
|
||||
|
|
@ -45,33 +44,44 @@ This will also be used as a starting point for the other Docker Compose guides.
|
|||
|
||||
```
|
||||
|
||||
- Replace `whoami.localhost` by your **own domain** within the `traefik.http.routers.whoami.rule` label of the `whoami` service.
|
||||
- Run `docker-compose up -d` within the folder where you created the previous file.
|
||||
- Wait a bit and visit `http://your_own_domain` to confirm everything went fine.
|
||||
You should see the output of the whoami service. Something similar to:
|
||||
Replace `whoami.localhost` by your **own domain** within the `traefik.http.routers.whoami.rule` label of the `whoami` service.
|
||||
|
||||
```text
|
||||
Hostname: d7f919e54651
|
||||
IP: 127.0.0.1
|
||||
IP: 192.168.64.2
|
||||
GET / HTTP/1.1
|
||||
Host: whoami.localhost
|
||||
User-Agent: curl/7.52.1
|
||||
Accept: */*
|
||||
Accept-Encoding: gzip
|
||||
X-Forwarded-For: 192.168.64.1
|
||||
X-Forwarded-Host: whoami.localhost
|
||||
X-Forwarded-Port: 80
|
||||
X-Forwarded-Proto: http
|
||||
X-Forwarded-Server: 7f0c797dbc51
|
||||
X-Real-Ip: 192.168.64.1
|
||||
```
|
||||
Now run `docker-compose up -d` within the folder where you created the previous file.
|
||||
This will start Docker Compose in background mode.
|
||||
|
||||
!!! info "This can take a moment"
|
||||
|
||||
Docker Compose will now create and start the services declared in the `docker-compose.yml`.
|
||||
|
||||
Wait a bit and visit `http://your_own_domain` to confirm everything went fine.
|
||||
|
||||
You should see the output of the whoami service.
|
||||
It should be similar to the following example:
|
||||
|
||||
```text
|
||||
Hostname: d7f919e54651
|
||||
IP: 127.0.0.1
|
||||
IP: 192.168.64.2
|
||||
GET / HTTP/1.1
|
||||
Host: whoami.localhost
|
||||
User-Agent: curl/7.52.1
|
||||
Accept: */*
|
||||
Accept-Encoding: gzip
|
||||
X-Forwarded-For: 192.168.64.1
|
||||
X-Forwarded-Host: whoami.localhost
|
||||
X-Forwarded-Port: 80
|
||||
X-Forwarded-Proto: http
|
||||
X-Forwarded-Server: 7f0c797dbc51
|
||||
X-Real-Ip: 192.168.64.1
|
||||
```
|
||||
|
||||
## Details
|
||||
|
||||
- As an example, we use [whoami](https://github.com/traefik/whoami "Link to the GitHub repo of whoami") (a tiny Go server that prints OS information and HTTP request to output) which was used to define our `simple-service` container.
|
||||
Let's break it down and go through it, step-by-step.
|
||||
|
||||
- We define an entry point, along with the exposure of the matching port within Docker Compose, which allow us to "open and accept" HTTP traffic:
|
||||
You use [whoami](https://github.com/traefik/whoami "Link to the GitHub repo of whoami"), a tiny Go server that prints OS information and HTTP request to output as service container.
|
||||
|
||||
Second, you define an entry point, along with the exposure of the matching port within Docker Compose, which allows to "open and accept" HTTP traffic:
|
||||
|
||||
```yaml
|
||||
command:
|
||||
|
|
@ -82,7 +92,7 @@ ports:
|
|||
- "80:80"
|
||||
```
|
||||
|
||||
- We expose the Traefik API to be able to check the configuration if needed:
|
||||
Third, you expose the Traefik API to be able to check the configuration if needed:
|
||||
|
||||
```yaml
|
||||
command:
|
||||
|
|
@ -101,7 +111,7 @@ ports:
|
|||
curl -s 127.0.0.1:8080/api/rawdata | jq .
|
||||
```
|
||||
|
||||
- We allow Traefik to gather configuration from Docker:
|
||||
Fourth, you allow Traefik to gather configuration from Docker:
|
||||
|
||||
```yaml
|
||||
traefik:
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue