Raja's Exocortex

Traefik

Traefik is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy. Traefik integrates with your existing infrastructure components (Docker, Swarm mode, Kubernetes, Marathon, Consul, Etcd, Rancher, Amazon ECS, ...) and configures itself automatically and dynamically.

File: docker-compose.yaml

name: traefik-localhost

services:
  traefik:
    image: traefik:3
    container_name: traefik.localhost
    restart: always

    mem_limit: 256M

    volumes:
      - ./:/opt/traefik
      - ./:/etc/traefik

    network_mode: host

    labels:
      - com.centurylinklabs.watchtower.enable=true

File: traefik.yaml

# Traefik v3.x main configuration file
# Filename: /opt/traefik/traefik.yaml

# Listen on http, https ports. Forward all http to https using middleware.
entryPoints:
  https:
    address: ':443'

  http:
    address: ':80'
    http:
      redirections:
        entryPoint:
          to: https
          scheme: https

  name:
    http3: {}

  ssh:
    address: ':2222'

  monitoring:
    address: ':9100'


# Use lets-encrypt CA to auto create SSL certificates on demand
certificatesResolvers:
  lets-encrypt:
    acme:
      email: noreply@example.com
      storage: /opt/traefik/acme/acme.json
      httpChallenge:
        entryPoint: http

# Publish API dashboard, see conf.d/10-api.example.com.yaml
#api:
#  dashboard: true

# Health check endpoint to test this traefik service
#ping:
#  entryPoint: monitoring


# Export prometheus metrics
metrics:
  prometheus:
    addServicesLabels: true
    addEntryPointsLabels: true
    entryPoint: monitoring

# Web access log location. See /etc/logrotate.d/traefik.
accessLog:
  filePath: /dev/stdout

# Serve applications configured file and docker
# Docker provider uses labels in docker-compose for auto discovery
providers:
  file:
    directory: /opt/traefik/conf.d
    watch: true

  docker:
    exposedByDefault: false
    endpoint: "tcp://localhost:2375"
    watch: true

File: Config Fragment

# Common dynamic config options for traefik
# Filename: /opt/traefik/conf.d/00-common.yaml

# Set minimum TLS 1.2 with secure ciphers
tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

#TODO