Use traefik reverse proxy with docker swarm, based on this blog post: https://dockerswarm.rocks/traefik/
- docker service name is traefik
- overlay network name is traefik-public
- uses docker "host mode" to get real ip addresses and enable ipv6 ingress
- configured to run on single node in swarm based on constraints
- predefined middlewares for http, https and redirects from non-www to www
Add the following environment variables or use a shell script for that.
Create docker overlay network
docker network create --driver=overlay --attachable traefik-public
Export current Node Id to ensure that traefik runs always on same node
export NODE_ID=$(docker info -f '{{.Swarm.NodeID}}')
Create tag on node to add constraint for deployment
docker node update --label-add traefik-public.traefik-public-certificates=true $NODE_ID
Create Email for letsencrypt notifications
export [email protected]
Domain for traefik UI
export DOMAIN=my.domain.com
Basic Auth User for Traefik
export USERNAME=MY_USER \
export PASSWORD=MY_SECURE_PASSWORD
Hash Password
export HASHED_PASSWORD=$(openssl passwd -apr1 $PASSWORD)
Deploy Stack:
docker stack deploy -c docker-compose.yml traefik
The example has access log enabled and will log all traefik to a mounted host directory, log rotation on the host system rotates the logs periodically.
- Create directory, e.g.
/var/log/traefikand mount it in traefik docker-compose file
volumes:
...
# Mount log folder
- /var/log/traefik:/var/log/traefik
- Add log rotation on Host System - example for Ubuntu
nano /etc/logrotate.d/traefik
# assuming traefik container contains "traefik" in its name
/var/log/traefik/*.log {
daily
missingok
rotate 30
compress
delaycompress
notifempty
create 0644 root root
sharedscripts
postrotate
# kill & resstart container which contains "traefik" in name
docker kill --signal="USR1" $(docker ps | grep traefik | awk '{print $1}')
endscript
}
# debug logrotate & run it
logrotate /etc/logrotate.conf --debug
logrotate /etc/logrotate.conf