Skip to content

Commit 144ad01

Browse files
pascalandypascalandy
committed
Major: Traefik manage certs via ACME (squash)
1 parent e1e2fe1 commit 144ad01

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+2891
-182
lines changed

‎Dockerfile

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
###################################
55

66
ARG APP_NAME="docker-stack-this"
7-
ARG VERSION="3.1.2"
8-
ARG RELEASE="3.1.2"
7+
ARG VERSION="4.0.0"
8+
ARG RELEASE="4.0.0"
99
ARG GITHUB_USER="pascalandy"
1010

1111
###################################

‎traefik_stack5/stack-proxy.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ services:
5757
# and capture client IP's
5858
traefik:
5959
<<: *default-opts
60-
image: traefik:1.7.24
60+
image: traefik:1.7.26
6161
ports:
6262
- target: 80
6363
protocol: tcp

‎traefik_stack6/README.md

+2-179
Original file line numberDiff line numberDiff line change
@@ -1,180 +1,3 @@
1-
## WORK IN PROGRESS
2-
3-
2019-12-31
4-
5-
This README is from https://github.com/pascalandy/docker-stack-this/tree/master/traefik_stack5
6-
7-
---
8-
9-
## What is this?
10-
11-
Using a **one-liner**, this docker stack will run many services (Traefik (with auth), Socat, Portainer, Nginx, Caddy, Whoami) in a straightforward copy-paste command.
12-
13-
You may also refer the [README](https://github.com/pascalandy/docker-stack-this/blob/master/README.md) at the root of this repo.
14-
15-
## Start here
16-
1. Go to http://labs.play-with-docker.com/
17-
2. Create **one** instance
18-
3. Copy-paste this one-liner:
19-
20-
#### Stable setup (recommended)
21-
22-
```
23-
ENV_BRANCH="master"
24-
ENV_MONOREPO="traefik_stack6"
25-
26-
# On play-with-docker, install common apps
27-
apk update && apk upgrade && apk add --no-cache \
28-
nano bash git curl wget unzip openssl tar ca-certificates && \
29-
rm -rf /var/cache/apk/* /tmp* && \
30-
docker swarm init --advertise-addr $(hostname -i) && \
31-
git clone https://github.com/pascalandy/docker-stack-this.git && \
32-
cd docker-stack-this && \
33-
git checkout ${ENV_BRANCH} && \
34-
cd ${ENV_MONOREPO} && \
35-
./runup.sh;
36-
```
37-
38-
#### Edge setup (NOT recommended)
39-
40-
```
41-
ENV_BRANCH="edge"
42-
ENV_MONOREPO="traefik_stack6"
43-
44-
# On play-with-docker, install common apps
45-
apk update && apk upgrade && apk add --no-cache \
46-
nano bash git curl wget unzip openssl tar ca-certificates && \
47-
rm -rf /var/cache/apk/* /tmp* && \
48-
docker swarm init --advertise-addr $(hostname -i) && \
49-
git clone https://github.com/pascalandy/docker-stack-this.git && \
50-
cd docker-stack-this && \
51-
git checkout ${ENV_BRANCH} && \
52-
cd ${ENV_MONOREPO} && \
53-
./runup.sh;
54-
```
55-
56-
These scripts will do the hard of deploying the stacks for us.
57-
58-
#### example
59-
60-
![2019-08-01_16h56](https://user-images.githubusercontent.com/6694151/62326965-5ca8f880-b47d-11e9-9416-2139d514fc64.gif)
61-
62-
## See your stacks
63-
64-
```
65-
$ docker stack ls
66-
67-
NAME SERVICES ORCHESTRATOR
68-
toolgui 2 Swarm
69-
toolproxy 2 Swarm
70-
toolwebapp 4 Swarm
71-
```
72-
73-
74-
## See your services
75-
76-
```
77-
$ docker service ls
78-
79-
ID NAME MODE REPLICAS IMAGE PORTS
80-
xjdsq3gxd59y toolgui_agent global 1/1 portainer/agent:latest
81-
0h375hmmnelo toolgui_portainer replicated 1/1 portainer/portainer:latest
82-
xim07ahqctsp toolproxy_socat replicated 1/1 devmtl/socatproxy:1.2
83-
y249kaecel8e toolproxy_traefik replicated 1/1 traefik:1.7.12 *:80->80/tcp, *:443->443/tcp, *:8080->8080/tcp
84-
s0061fdhvv6o toolwebapp_home replicated 1/1 abiosoft/caddy:1.0.1-no-stats
85-
ocpk5l6yg2gt toolwebapp_who1 replicated 1/1 nginx:1.15-alpine
86-
raq5czrlhrmb toolwebapp_who2 replicated 1/1 emilevauge/whoami:latest
87-
66b1rduru5k9 toolwebapp_who3 replicated 1/1 emilevauge/whoami:latest
88-
```
89-
90-
## Confirm that your services (containers) are running
91-
92-
1. When you see that all services are deployed, click on `80` to see the static landing page.
93-
2. From the same URL generated by play-with-docker, in the address bar of your browser, add `/who1` or `/who2` or `/who3` or `/portainer` to access other services.
94-
95-
96-
#### Full URL example
97-
98-
```
99-
http://pwd10-0-7-3-80.host1.labs.play-with-docker.com/
100-
http://pwd10-0-7-3-80.host1.labs.play-with-docker.com/who1
101-
http://pwd10-0-7-3-80.host1.labs.play-with-docker.com/who2
102-
http://pwd10-0-7-3-80.host1.labs.play-with-docker.com/who3
103-
http://pwd10-0-7-3-80.host1.labs.play-with-docker.com/portainer
104-
```
105-
106-
The container for the first URL is named `home`.
107-
108-
109-
#### Web apps details:
110-
- **/** = [caddy](https://github.com/pascalandy/caddy-securityheader)
111-
- **/who1** = [caddy](https://github.com/pascalandy/caddy-securityheader)
112-
- **/who2** = [whoami](https://hub.docker.com/r/emilevauge/whoami/)
113-
- **/portainer** = [portainer](https://hub.docker.com/r/portainer/portainer/)
114-
115-
For /who1 and /who2 you will see the container's Ids (5fe91baf7a3a & 78a0c7287df1) in this example
116-
117-
```
118-
$ docker ps | grep whoami
119-
5fe91baf7a3a emilevauge/whoami:latest "/whoamI" About a minute ago Up About a minute 80/tcp toolwebapp_who3.1.9zk09prm85gnl0ieuuncynhxh
120-
78a0c7287df1 emilevauge/whoami:latest "/whoamI" About a minute ago Up About a minute 80/tcp toolwebapp_who2.1.wj7vf83ag91ft7jgdy3gwejp4
121-
```
122-
123-
124-
## How to access Traefik
125-
126-
![traefik](https://user-images.githubusercontent.com/6694151/50121682-86334d80-0227-11e9-8f25-93dd8714d306.jpg)
127-
128-
129-
#### Traefik password
130-
131-
**user**: admin / **pass**: changethispass
132-
133-
This password is encrypted in our configs `.configs/traefik.toml`
134-
135-
To quickly generate yours with htpasswd, use my container:
136-
137-
```
138-
docker run --rm -it devmtl/alpinefire:3.8-D sh -c 'htpasswd -Bbn admin changethispass'
139-
```
140-
141-
This will display:
142-
143-
```
144-
admin:$2y$05$pAfipn3.brdHMI2eWGnYH.84XYqLozp1sUPi36/l54UAwv.zGLtNC
145-
```
146-
147-
Insert this string in your `.configs/traefik.toml`.
148-
149-
#### What is Traefik?
150-
151-
[Traefik](https://docs.traefik.io/configuration/backends/docker/) is a powerful layer 7 reverse proxy. Once running, the proxy will give you access to many web apps. I think this is a substantial use case to understand how this reverse-proxy works.
152-
153-
#### Traefik version
154-
155-
In `toolproxy.yml` look for something like `traefik:1.7.19`.
156-
157-
#### Other stuff to know?
158-
159-
- This stack does not use ACME (https://). ACME is a pain while developing … reaching limits, etc.
160-
- If you don’t want to use socat, check out the monorepo `traefik-manager-noacme`
161-
162-
## Screenshots
163-
164-
![docker-stack-this-stack5_11](https://user-images.githubusercontent.com/6694151/34073735-76c60ae2-e26e-11e7-85a1-755a7177b3f2.jpg)
165-
![docker-stack-this-stack5_12](https://user-images.githubusercontent.com/6694151/34073736-76d461c8-e26e-11e7-9aea-c8dbc049a383.jpg)
166-
![docker-stack-this-stack5_13](https://user-images.githubusercontent.com/6694151/34073737-76e1d998-e26e-11e7-8b7c-c619e91adadd.jpg)
167-
![docker-stack-this-stack5_14](https://user-images.githubusercontent.com/6694151/34073738-76f163ae-e26e-11e7-86d7-27ea62ae3284.jpg)
168-
![docker-stack-this-stack5_15](https://user-images.githubusercontent.com/6694151/34073739-77006d4a-e26e-11e7-8f2e-cbd4268ea403.jpg)
169-
![docker-stack-this-stack5_16](https://user-images.githubusercontent.com/6694151/49540846-158f4700-f89f-11e8-8e14-ceca2ff2b910.jpg)
170-
171-
![docker-stack-this-stack5_17](https://user-images.githubusercontent.com/6694151/49540848-1922ce00-f89f-11e8-9fdc-b6fce70825c8.jpg)
172-
173-
## All commands
174-
In the active path, just execute those bash-scripts:
175-
176-
- `./runup.sh`
177-
- `./rundown.sh`
178-
179-
**Bonus!** `./runctop.sh` is not a stack but a simple `docker run` to see the memory consumed by each container.
1+
Based on `traefik_stack5`. It adds the ability to generate certificates using ACME by https://letsencrypt.org/.
1802

3+
You must understand how `traefik_stack5` runs. Then, it will be easy for you to run `traefik_stack6` on your own infra. I didn't test this on play-with-docker as ACME as rate limits.

‎traefik_stack6/stack-proxy.yml

+134
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
version: '3.7'
2+
3+
x-default-opts:
4+
&default-opts
5+
logging:
6+
options:
7+
max-size: "10m"
8+
9+
networks:
10+
ntw_front:
11+
external: true
12+
ntw_proxy:
13+
external: true
14+
15+
services:
16+
17+
# this custom haproxy allows us to move traefik to worker nodes (if needed)
18+
# while this container listens on managers and only allows
19+
# traefik to connect, read-only, to limited docker api calls
20+
# https://github.com/Tecnativa/docker-socket-proxy
21+
# image: devmtl/proxysocket:1.9.10 (with wget for heathcheck)
22+
# image: tecnativa/docker-socket-proxy
23+
proxysocket:
24+
<<: *default-opts
25+
image: devmtl/proxysocket:1.9.13
26+
networks:
27+
- ntw_proxy
28+
volumes:
29+
- /var/run/docker.sock:/var/run/docker.sock
30+
environment:
31+
# specific to 'docker stack deploy'
32+
NETWORKS: 1
33+
SERVICES: 1
34+
TASKS: 1
35+
SWARM: 1
36+
deploy:
37+
mode: global
38+
placement:
39+
constraints: [node.role == manager]
40+
restart_policy:
41+
condition: on-failure
42+
resources:
43+
limits:
44+
cpus: '0.20'
45+
memory: 8M
46+
reservations:
47+
cpus: '0.10'
48+
memory: 4M
49+
50+
# Traefik reverse proxy has a bunch of features:
51+
# - reverse proxy all 80/443 ingress traffic on a swarm
52+
# - dynamic config via each app's swarm service labels
53+
# - HA multi-container design for traefik
54+
# - runs traefik on host NIC directly, to improve performance
55+
# and capture client IP's
56+
#
57+
#- --debug=true
58+
#
59+
# OPTION A) Select STAGING or PROD letsencrypt server
60+
# https://acme-v02.api.letsencrypt.org/directory
61+
# https://acme-staging-v02.api.letsencrypt.org/directory
62+
#
63+
# OPTION B)
64+
#- --entryPoints=Name:http Address::80 # don't force HTTPS
65+
#- --entryPoints=Name:http Address::80 Redirect.EntryPoint:https # force HTTPS
66+
#
67+
# If not using proxysocket
68+
#- --docker.endpoint=unix:///var/run/docker.sock
69+
traefik:
70+
<<: *default-opts
71+
image: traefik:1.7.26-alpine
72+
ports:
73+
- target: 80
74+
protocol: tcp
75+
published: 80
76+
mode: ingress
77+
- target: 443
78+
protocol: tcp
79+
published: 443
80+
mode: ingress
81+
- target: 8080
82+
protocol: tcp
83+
published: 8080
84+
mode: ingress
85+
networks:
86+
- ntw_front
87+
- ntw_proxy
88+
volumes:
89+
- /mnt/DeployGRP/tooldata/traefik/traefik_stack6/acme.json:/etc/traefik/acme/acme.json
90+
command:
91+
- --docker
92+
- --docker.domain=traefik
93+
- --docker.swarmMode
94+
- --docker.watch
95+
- --docker.exposedbydefault=false
96+
- --docker.endpoint=tcp://proxysocket:2375
97+
- --entryPoints=Name:http Address::80 Redirect.EntryPoint:https
98+
- --entryPoints=Name:https Address::443 TLS
99+
- --defaultentrypoints=http,https
100+
- --acme
101+
- [email protected]
102+
- --acme.httpchallenge
103+
- --acme.httpchallenge.entrypoint=http
104+
- --acme.entryPoint=https
105+
- --acme.onhostrule=true
106+
- --acme.storage=/etc/traefik/acme/acme.json
107+
- --acme.caserver=https://acme-v02.api.letsencrypt.org/directory
108+
- --acme.acmelogging=true
109+
- --logLevel=ERROR
110+
- --api=true
111+
deploy:
112+
mode: replicated
113+
replicas: 1
114+
update_config:
115+
delay: 2s
116+
placement:
117+
constraints: [node.labels.nodeid==1]
118+
restart_policy:
119+
condition: on-failure
120+
max_attempts: 20
121+
resources:
122+
limits:
123+
cpus: '0.33'
124+
memory: 96M
125+
reservations:
126+
cpus: '0.05'
127+
memory: 48M
128+
labels:
129+
- traefik.frontend.rule=Host:traefik.firepress.link
130+
- traefik.docker.network=ntw_front
131+
- traefik.enable=true
132+
- traefik.port=8080
133+
134+
# https://github.com/pascalandy/docker-stack-this, inspired by https://github.com/BretFisher/dogvscat

0 commit comments

Comments
 (0)