Traefik is an open-source reverse-proxy and load-balancer for HTTP, TCP and UDP. SSL certificates are managed with Let's Encrypt or your personal certificate authority.
An open-source reverse proxy and load balancer for HTTP and TCP-based applications that is easy, dynamic, automatic, fast, full-featured, production proven, provides metrics, and integrates with every major cluster technology...
|1.2||08/2022||Add the part "Why Traefik?"|
|2.0||06/2023||Add some information about environment and exec context, update versions|
Goal : Discover Traefik
docker compose (plugin) 2.17.x,
Execution context :
jho@vmi866042:/srv/docker/dc$ tree . ├── conf │ ├── acme.json │ ├── traefik.yml │ ├── traefikdynamic │ │ ├── general.yml │ │ ├── routersservices.yml ├── docker-compose.yml └── logs ├── traefikAccess.log ├── traefik.log
- path where are every folder and files :
- path of the principal configuration file for Traefik :
- folder where are every dynamic configuration files :
- path of the file which is used to store SSL certificates for let's encrypt (or other provider) :
- folder to store logs :
In your infrastructures, your users could need to access some services. With increasing availability requirements, you will need to have multiple servers needing to be accessible without user action. To do so, a type of server is needed, a "reverse-proxy". This reverse-proxy is the only entry point for your users.
A reverse proxy is used to:
- be a load balancer ;
- filter access ;
- manage authentication, or transfer it to another authentication provider ;
- cache pages to redistribute them on demand.
With its reverse proxy functions, Traefik is a fast and efficient router, which can automatically manage routes.
Some words to understand
What is "static configuration" ?
This is a set of options used when starting Traefik. These options mainly concern connection information to providers, tracing systems and metrics tools.
Options can be defined with 3 different ways :
- configuration file, with the TOML or YAML format (it's the
- settings in command lines (CLI flags) ;
- environment variables (deprecated).
You can only use one method at a time (configuration file or command lines).
Static configuration, whatever it's source (a configuration file, CLI flags or env vars) is read only once when starting Traefik. It is not possible to define routing (routers, services, middlewares, TLS configuration) in the static configuration file.
What is "dynamic configuration" ?
This is a set of options used by Traefik to define routers, services, middlewares and TLS configuration.
This configuration can be defined in different ways :
- One or more files (provider file) with the TOML or YAML format, without a link with the file
- with labels (provider Docker, Rancher, ...) ;
- with Ingress or CRD specific to Traefik (Kubernetes) ;
- with data stored in a KV store (available with v2.2).
Every source of dynamic configuration can be used at the same time. Dynamic configuration can be modified during execution of Traefik without the need to restart (because of the line
watch: true in the traefik.yml file).
In case of all providers (except the file provider), this configuration will automatically rebuild and updated (without loading) as soon as a change is detected (addition/deletion/modification of a container or a configuration file)
docker-compose.yml file for Traefik
With this file, you'll have a Traefik container which take requests and forward them depending on demand. I will use the path
/srv/docker/dc and will create needed files/folders.
Also, I'm using the dynamic configuration to setting up my routers and services - with many tries, I found easier the dynamic configuration instead of labels (and you will not have to restart your containers !)
Creation of folders and files, with needed rights.
sudo mkdir -p /srv/docker/dc/conf/traefikdynamic /srv/docker/dc/logs sudo touch /srv/docker/dc/conf/acme.json /srv/docker/dc/conf/traefik.yml /srv/docker/dc/logs/traefik.log sudo chmod 0600 /srv/docker/dc/conf/acme.json
Next, a configuration for Traefik v2, with its configuration file
traefik.yml (read only) and
acme.json file to store Let's Encrypt certificates (read/write). I created a new docker network called "oueb", with the command
docker network create oueb.
traefik.yml file is for startup options of Traefik. Actually, this is my simple configuration file, with 2 entry points (80/TCP & 443/TCP), logs, connection to docker socket and access to the Traefik web dashboard :
For this moment, a simple
docker compose up -d will retrieve the latest stable and available image (if you don't have it for now) and launch Traefik...
French article here.