homelab/traefik
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

h2c server

Browse source
This commit is contained in:
SALLEYRON Julien 2018-05-28 11:46:03 +02:00 • committed by Traefiker Bot
parent bfdd1997f6
commit e76836b948
7 changed files with 690 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

153
docs/user-guide/grpc.md
View file

@ -1,30 +1,10 @@
# gRPC example
# gRPC examples
This section explains how to use Traefik as reverse proxy for gRPC application with self-signed certificates.
## With HTTP (h2c)
!!! warning
As gRPC needs HTTP2, we need HTTPS certificates on Træfik.
For exchanges with the backend, we will use h2c (HTTP2 on HTTP without TLS)
This section explains how to use Traefik as reverse proxy for gRPC application.
<p align="center">
<img src="/img/grpc.svg" alt="gRPC architecture" title="gRPC architecture" />
</p>
## gRPC Client certificate
Generate your self-signed certificate for frontend url:
```bash
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./frontend.key -out ./frontend.cert
```
with
```
Common Name (e.g. server FQDN or YOUR name) []: frontend.local
```
## Træfik configuration
### Træfik configuration
At last, we configure our Træfik instance to use both self-signed certificates.
@ -32,14 +12,9 @@ At last, we configure our Træfik instance to use both self-signed certificates.
defaultEntryPoints = ["https"]
[entryPoints]
[entryPoints.https]
address = ":4443"
[entryPoints.https.tls]
# For secure connection on frontend.local
[[entryPoints.https.tls.certificates]]
certFile = "./frontend.cert"
keyFile = "./frontend.key"
[entryPoints.http]
address = ":80"
[entryPoints.http]
[api]
@ -62,23 +37,115 @@ defaultEntryPoints = ["https"]
!!! warning
For provider with label, you will have to specify the `traefik.protocol=h2c`
## Conclusion
### Conclusion
We don't need specific configuration to use gRPC in Træfik, we just need to be careful that exchanges between client and Træfik are HTTPS communications.
For exchanges between Træfik and backend, you need to use `h2c` protocol, or use HTTPS communications to have HTTP2.
We don't need specific configuration to use gRPC in Træfik, we just need to use `h2c` protocol, or use HTTPS communications to have HTTP2 with the backend.
## A gRPC example in go
## With HTTPS
We will use the gRPC greeter example in [grpc-go](https://github.com/grpc/grpc-go/tree/master/examples/helloworld)
This section explains how to use Traefik as reverse proxy for gRPC application with self-signed certificates.
<p align="center">
<img src="/img/grpc.svg" alt="gRPC architecture" title="gRPC architecture" />
</p>
### gRPC Server certificate
In order to secure the gRPC server, we generate a self-signed certificate for backend url:
```bash
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./backend.key -out ./backend.cert
```
That will prompt for information, the important answer is:
```
Common Name (e.g. server FQDN or YOUR name) []: backend.local
```
### gRPC Client certificate
Generate your self-signed certificate for frontend url:
```bash
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./frontend.key -out ./frontend.cert
```
with
```
Common Name (e.g. server FQDN or YOUR name) []: frontend.local
```
### Træfik configuration
At last, we configure our Træfik instance to use both self-signed certificates.
```toml
defaultEntryPoints = ["https"]
# For secure connection on backend.local
rootCAs = [ "./backend.cert" ]
[entryPoints]
[entryPoints.https]
address = ":4443"
[entryPoints.https.tls]
# For secure connection on frontend.local
[[entryPoints.https.tls.certificates]]
certFile = "./frontend.cert"
keyFile = "./frontend.key"
[api]
[file]
[backends]
[backends.backend1]
[backends.backend1.servers.server1]
# Access on backend with HTTPS
url = "https://backend.local:8080"
[frontends]
[frontends.frontend1]
backend = "backend1"
[frontends.frontend1.routes.test_1]
rule = "Host:frontend.local"
```
!!! warning
With some backends, the server URLs use the IP, so you may need to configure `insecureSkipVerify` instead of the `rootCAS` to activate HTTPS without hostname verification.
### A gRPC example in go (modify for https)
We use the gRPC greeter example in [grpc-go](https://github.com/grpc/grpc-go/tree/master/examples/helloworld)
!!! warning
In order to use this gRPC example, we need to modify it to use HTTPS
So we modify the "gRPC server example" to use our own self-signed certificate:
We can keep the Server example as is with the h2c protocol
```go
// ...
lis, err := net.Listen("tcp", port)
// Read cert and key file
BackendCert, _ := ioutil.ReadFile("./backend.cert")
BackendKey, _ := ioutil.ReadFile("./backend.key")
// Generate Certificate struct
cert, err := tls.X509KeyPair(BackendCert, BackendKey)
if err != nil {
log.Fatalf("failed to listen: %v", err)
log.Fatalf("failed to parse certificate: %v", err)
}
var s *grpc.Server = grpc.NewServer()
// Create credentials
creds := credentials.NewServerTLSFromCert(&cert)
// Use Credentials in gRPC server options
serverOption := grpc.Creds(creds)
var s *grpc.Server = grpc.NewServer(serverOption)
defer s.Stop()
pb.RegisterGreeterServer(s, &server{})
@ -87,10 +154,6 @@ err := s.Serve(lis)
// ...
```
!!! warning
In order to use this gRPC example, we need to modify it to use HTTPS
Next we will modify gRPC Client to use our Træfik self-signed certificate:
```go