diff --git a/content/blog/setup-trafik.md b/content/blog/setup-trafik.md index ee99e22..7d71e7b 100644 --- a/content/blog/setup-trafik.md +++ b/content/blog/setup-trafik.md @@ -6,7 +6,7 @@ draft = false Do you use docker? Do you use nginx or apachi to proxy the container? Fear not you won't be needing them anymore once you are done with this tutorial. -Traefik is a simple docker centric proxy manager that is amazing and allows you to easilly proxy you docker container's with just a couple of label's. +Traefik is a simple docker centric proxy manager that is amazing and allows you to easilly proxy you docker containers with just a couple of labels. @@ -48,7 +48,7 @@ What we are doing here is binding the needed configuration files, the docker soc We are also forcing it to use the latest available stable image to make sure there are no bugs, and disabling proxying the traefik image itself io the lables to make sure it isn't exposed by any means. -We are also making it so it can restart itself unless we specifically stop it, and binding it to port 80 and 443 because those are the default http and https port's that every browser uses when connecting. +We are also making it so it can restart itself unless we specifically stop it, and binding it to port 80 and 443 because those are the default http and https ports that every browser uses when connecting. ## traefik.toml @@ -81,7 +81,7 @@ We are also making it so it can restart itself unless we specifically stop it, a watch = true ``` -In the entryPoint's we are defining the http and https port's and forcing http to redirect to https. +In the entryPoints we are defining the http and https ports and forcing http to redirect to https. In the api section we are enabling the dashboard, but disallowing insecure access to it. @@ -106,7 +106,7 @@ In the rest of the config we are defining the mail and storage for tls certific Here we are defining the basic auth credentials and routing the monitor domain to the dashboard with basic auth credentials and https. -Make sure to subsitute the string in qutes for users with what you get generated with httpasswd command: `htpasswd -nb somebody secure_password`. +Make sure to subsitute the string in qutes for users with what you get generated with httpasswd command: `htpasswd -n somebody`. ## acme.toml @@ -114,17 +114,17 @@ To create `acme.toml` run this command `touch acme.toml && chmod 600 acme.toml` ## docker web network -You might have seen the networks part in the docker compose, we need to create it to make other docker container's in different docker compose files be accessible to traefik so it can proxy to them. +You might have seen the networks part in the docker compose, we need to create it to make other docker containers in different docker compose files be accessible to traefik so it can proxy to them. To create it we just need to run `docker network create web` and we are done. --- -After all this is done, we can just run `docker compose up -d` and if everyting was setup correctly, running `docker compose logs -f` shouldn't show any error's. +After all this is done, we can just run `docker compose up -d` and if everyting was setup correctly, running `docker compose logs -f` shouldn't show any errors. -# Using trafik to proxy to docker container's +# Using trafik to proxy to docker containers -Now I'm going to explain to you how to use traefik to proxy to docker container's by using labels. For that I will be using ntfy docker image as an example. +Now I'm going to explain to you how to use traefik to proxy to docker containers by using labels. For that I will be using ntfy docker image as an example. > docker-compose.yml @@ -164,15 +164,15 @@ networks: The important part's of this docker compose are the following: -- ## No exposing port's +- ## No exposing ports As you can see, with traefik you don't need to expose port's from the container making it a lot more secure as it can directly proxy to them from itself using the web network. - ## labels -In labels we are defining the host domain we wan't to proxy to our container, we are also enabled tls and with entrypoint's making the container only acessible from https, making it impossible to be accessible with http no matter what. +In labels we are defining the host domain we wan't to proxy to our container, we are also enabled tls and with entrypoints making the container only acessible from https, making it impossible to be accessible with http no matter what. -We are also defining the certresolver to be lets-encrypt and setting the port from the container that traefik need's to proxy to 80, this port can be differen't depending on what you wan't to proxy. +We are also defining the certresolver to be lets-encrypt and setting the port from the container that traefik needs to proxy to 80, this port can be different depending on what you want to proxy. - ## networks @@ -184,11 +184,11 @@ After you have accustomed the config to what you need, you can just `docker comp # Disabling traefik -Next I will be talkling about how to disable traefik for container's because you don't want it to work for container's you don't want accessible over the network. +Next I will be talkling about how to disable traefik for containers because you don't want it to work for containers you dont want accessible over the network. ## Disabling for one service docker-compose -As the main example, I have a watchtower instance that I don't wan't proxied to the outside world. To do that we just add `traefik.enable=false` to the labels and trafik will stop being naughty. +As the main example, I have a watchtower instance that I dont wan't proxied to the outside world. To do that we just add `traefik.enable=false` to the labels and trafik will stop being naughty. > example ```yaml @@ -202,7 +202,7 @@ Take note that for this kind of docker-compose files, networks part IS NOT NEEDE ## Disabling for more complex docker-compose -Now here comes the more tricky part, disabling it for only specific docker containers, and making it so traefik can't access them from it's network. To accomplish that we will use the `traefik.enable=false` label once again, and make use of multiple networks to make sure traefik can only access the web interfaces and keep other containers secure like databases and only accessible to the web interfaces. +Now here comes the more tricky part, disabling it for only specific docker containers, and making it so traefik cant access them from its network. To accomplish that we will use the `traefik.enable=false` label once again, and make use of multiple networks to make sure traefik can only access the web interfaces and keep other containers secure like databases and only accessible to the web interfaces. > example docker-compose.yml @@ -255,8 +255,8 @@ services: - mysql ``` -Here we can see what I was talking about in action, take note I took this docker compose file from this digital ocean [blog post](https://www.digitalocean.com/community/tutorials/how-to-use-traefik-v2-as-a-reverse-proxy-for-docker-containers-on-ubuntu-20-04#step-3-registering-containers-with-traefik) that explain's it a lot better I could which you can use as a reference if you didn't understand something about what I was talking about. +Here we can see what I was talking about in action, take note I took this docker compose file from this digital ocean [blog post](https://www.digitalocean.com/community/tutorials/how-to-use-traefik-v2-as-a-reverse-proxy-for-docker-containers-on-ubuntu-20-04#step-3-registering-containers-with-traefik) that explains it a lot better I could which you can use as a reference if you didnt understand something about what I was talking about. # Conclusing -I hope that you were able to setup traefik, or if not and were just reading to see what it's all about I hope you had a good read and might have decided to try out traefik in the future. +I hope that you were able to setup traefik, or if not and were just reading to see what its all about I hope you had a good read and might have decided to try out traefik in the future. diff --git a/public/blog/index.xml b/public/blog/index.xml index d8b2ddc..e1f0b39 100644 --- a/public/blog/index.xml +++ b/public/blog/index.xml @@ -18,7 +18,7 @@ https://cronyakatsuki.xyz/blog/setup-trafik/ <p>Do you use docker? Do you use nginx or apachi to proxy the container? Fear not you won&rsquo;t be needing them anymore once you are done with this tutorial.</p> -<p>Traefik is a simple docker centric proxy manager that is amazing and allows you to easilly proxy you docker container&rsquo;s with just a couple of label&rsquo;s.</p> +<p>Traefik is a simple docker centric proxy manager that is amazing and allows you to easilly proxy you docker containers with just a couple of labels.</p> <!-- raw HTML omitted --> <h1 id="setting-up-traefik">Setting up Traefik</h1> <p>In this part we will setup traefik, with the dashboard enabled and secured with https and a password.</p> @@ -49,7 +49,7 @@ </span></span><span style="display:flex;"><span> <span style="color:#ca9ee6">external</span>: <span style="color:#ef9f76">true</span> </span></span></code></pre></div><p>What we are doing here is binding the needed configuration files, the docker socket so traefik can listen to it and automatically proxy the services, and the acme.json which will keep our ssl certificates.</p> <p>We are also forcing it to use the latest available stable image to make sure there are no bugs, and disabling proxying the traefik image itself io the lables to make sure it isn&rsquo;t exposed by any means.</p> -<p>We are also making it so it can restart itself unless we specifically stop it, and binding it to port 80 and 443 because those are the default http and https port&rsquo;s that every browser uses when connecting.</p> +<p>We are also making it so it can restart itself unless we specifically stop it, and binding it to port 80 and 443 because those are the default http and https ports that every browser uses when connecting.</p> <h2 id="traefiktoml">traefik.toml</h2> <div class="highlight"><pre tabindex="0" style="color:#c6d0f5;background-color:#303446;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span>[entryPoints] </span></span><span style="display:flex;"><span> [entryPoints.web] @@ -77,7 +77,7 @@ </span></span><span style="display:flex;"><span>[providers.file] </span></span><span style="display:flex;"><span> filename = <span style="color:#a6d189">&#34;traefik_dynamic.toml&#34;</span> </span></span><span style="display:flex;"><span> watch = <span style="color:#ef9f76">true</span> -</span></span></code></pre></div><p>In the entryPoint&rsquo;s we are defining the http and https port&rsquo;s and forcing http to redirect to https.</p> +</span></span></code></pre></div><p>In the entryPoints we are defining the http and https ports and forcing http to redirect to https.</p> <p>In the api section we are enabling the dashboard, but disallowing insecure access to it.</p> <p>In the rest of the config we are defining the mail and storage for tls certificates, and enabled docker provider binded to a web network, and enabled the file provider for the dashboard setup.</p> <h2 id="traefik_dynamictoml">traefik_dynamic.toml</h2> @@ -94,16 +94,16 @@ </span></span><span style="display:flex;"><span> [http.routers.api.tls] </span></span><span style="display:flex;"><span> certResolver = <span style="color:#a6d189">&#34;lets-encrypt&#34;</span> </span></span></code></pre></div><p>Here we are defining the basic auth credentials and routing the monitor domain to the dashboard with basic auth credentials and https.</p> -<p>Make sure to subsitute the string in qutes for users with what you get generated with httpasswd command: <code>htpasswd -nb somebody secure_password</code>.</p> +<p>Make sure to subsitute the string in qutes for users with what you get generated with httpasswd command: <code>htpasswd -n somebody</code>.</p> <h2 id="acmetoml">acme.toml</h2> <p>To create <code>acme.toml</code> run this command <code>touch acme.toml &amp;&amp; chmod 600 acme.toml</code> and we are done.</p> <h2 id="docker-web-network">docker web network</h2> -<p>You might have seen the networks part in the docker compose, we need to create it to make other docker container&rsquo;s in different docker compose files be accessible to traefik so it can proxy to them.</p> +<p>You might have seen the networks part in the docker compose, we need to create it to make other docker containers in different docker compose files be accessible to traefik so it can proxy to them.</p> <p>To create it we just need to run <code>docker network create web</code> and we are done.</p> <hr> -<p>After all this is done, we can just run <code>docker compose up -d</code> and if everyting was setup correctly, running <code>docker compose logs -f</code> shouldn&rsquo;t show any error&rsquo;s.</p> -<h1 id="using-trafik-to-proxy-to-docker-containers">Using trafik to proxy to docker container&rsquo;s</h1> -<p>Now I&rsquo;m going to explain to you how to use traefik to proxy to docker container&rsquo;s by using labels. For that I will be using ntfy docker image as an example.</p> +<p>After all this is done, we can just run <code>docker compose up -d</code> and if everyting was setup correctly, running <code>docker compose logs -f</code> shouldn&rsquo;t show any errors.</p> +<h1 id="using-trafik-to-proxy-to-docker-containers">Using trafik to proxy to docker containers</h1> +<p>Now I&rsquo;m going to explain to you how to use traefik to proxy to docker containers by using labels. For that I will be using ntfy docker image as an example.</p> <blockquote> <p>docker-compose.yml</p> </blockquote> @@ -141,7 +141,7 @@ </span></span></code></pre></div><p>The important part&rsquo;s of this docker compose are the following:</p> <ul> <li> -<h2 id="no-exposing-ports">No exposing port&rsquo;s</h2> +<h2 id="no-exposing-ports">No exposing ports</h2> </li> </ul> <p>As you can see, with traefik you don&rsquo;t need to expose port&rsquo;s from the container making it a lot more secure as it can directly proxy to them from itself using the web network.</p> @@ -150,8 +150,8 @@ <h2 id="labels">labels</h2> </li> </ul> -<p>In labels we are defining the host domain we wan&rsquo;t to proxy to our container, we are also enabled tls and with entrypoint&rsquo;s making the container only acessible from https, making it impossible to be accessible with http no matter what.</p> -<p>We are also defining the certresolver to be lets-encrypt and setting the port from the container that traefik need&rsquo;s to proxy to 80, this port can be differen&rsquo;t depending on what you wan&rsquo;t to proxy.</p> +<p>In labels we are defining the host domain we wan&rsquo;t to proxy to our container, we are also enabled tls and with entrypoints making the container only acessible from https, making it impossible to be accessible with http no matter what.</p> +<p>We are also defining the certresolver to be lets-encrypt and setting the port from the container that traefik needs to proxy to 80, this port can be different depending on what you want to proxy.</p> <ul> <li> <h2 id="networks">networks</h2> @@ -161,9 +161,9 @@ <hr> <p>After you have accustomed the config to what you need, you can just <code>docker compose up -d</code>, go to your traefik monitor and after some time you will see ntfy addedd to reverse proxying with tls certficate and only accessible from https.</p> <h1 id="disabling-traefik">Disabling traefik</h1> -<p>Next I will be talkling about how to disable traefik for container&rsquo;s because you don&rsquo;t want it to work for container&rsquo;s you don&rsquo;t want accessible over the network.</p> +<p>Next I will be talkling about how to disable traefik for containers because you don&rsquo;t want it to work for containers you dont want accessible over the network.</p> <h2 id="disabling-for-one-service-docker-compose">Disabling for one service docker-compose</h2> -<p>As the main example, I have a watchtower instance that I don&rsquo;t wan&rsquo;t proxied to the outside world. To do that we just add <code>traefik.enable=false</code> to the labels and trafik will stop being naughty.</p> +<p>As the main example, I have a watchtower instance that I dont wan&rsquo;t proxied to the outside world. To do that we just add <code>traefik.enable=false</code> to the labels and trafik will stop being naughty.</p> <blockquote> <p>example</p> </blockquote> @@ -173,7 +173,7 @@ </span></span><span style="display:flex;"><span><span style="color:#ef9f76">...</span> </span></span></code></pre></div><p>Take note that for this kind of docker-compose files, networks part IS NOT NEEDED, just create the docker compose file as you would usually without having the networks part.</p> <h2 id="disabling-for-more-complex-docker-compose">Disabling for more complex docker-compose</h2> -<p>Now here comes the more tricky part, disabling it for only specific docker containers, and making it so traefik can&rsquo;t access them from it&rsquo;s network. To accomplish that we will use the <code>traefik.enable=false</code> label once again, and make use of multiple networks to make sure traefik can only access the web interfaces and keep other containers secure like databases and only accessible to the web interfaces.</p> +<p>Now here comes the more tricky part, disabling it for only specific docker containers, and making it so traefik cant access them from its network. To accomplish that we will use the <code>traefik.enable=false</code> label once again, and make use of multiple networks to make sure traefik can only access the web interfaces and keep other containers secure like databases and only accessible to the web interfaces.</p> <blockquote> <p>example docker-compose.yml</p> </blockquote> @@ -223,9 +223,9 @@ </span></span><span style="display:flex;"><span> - web </span></span><span style="display:flex;"><span> <span style="color:#ca9ee6">depends_on</span>: </span></span><span style="display:flex;"><span> - mysql -</span></span></code></pre></div><p>Here we can see what I was talking about in action, take note I took this docker compose file from this digital ocean <a href="https://www.digitalocean.com/community/tutorials/how-to-use-traefik-v2-as-a-reverse-proxy-for-docker-containers-on-ubuntu-20-04#step-3-registering-containers-with-traefik">blog post</a> that explain&rsquo;s it a lot better I could which you can use as a reference if you didn&rsquo;t understand something about what I was talking about.</p> +</span></span></code></pre></div><p>Here we can see what I was talking about in action, take note I took this docker compose file from this digital ocean <a href="https://www.digitalocean.com/community/tutorials/how-to-use-traefik-v2-as-a-reverse-proxy-for-docker-containers-on-ubuntu-20-04#step-3-registering-containers-with-traefik">blog post</a> that explains it a lot better I could which you can use as a reference if you didnt understand something about what I was talking about.</p> <h1 id="conclusing">Conclusing</h1> -<p>I hope that you were able to setup traefik, or if not and were just reading to see what it&rsquo;s all about I hope you had a good read and might have decided to try out traefik in the future.</p> +<p>I hope that you were able to setup traefik, or if not and were just reading to see what its all about I hope you had a good read and might have decided to try out traefik in the future.</p> diff --git a/public/blog/setup-trafik/index.html b/public/blog/setup-trafik/index.html index e6b66af..bf28cef 100644 --- a/public/blog/setup-trafik/index.html +++ b/public/blog/setup-trafik/index.html @@ -9,7 +9,7 @@ Setup Trafik @@ -49,7 +49,7 @@ Setting up Traefik In this part we will setup traefik, with the dashboard enable

Do you use docker? Do you use nginx or apachi to proxy the container? Fear not you won’t be needing them anymore once you are done with this tutorial.

-

Traefik is a simple docker centric proxy manager that is amazing and allows you to easilly proxy you docker container’s with just a couple of label’s.

+

Traefik is a simple docker centric proxy manager that is amazing and allows you to easilly proxy you docker containers with just a couple of labels.

Setting up Traefik

In this part we will setup traefik, with the dashboard enabled and secured with https and a password.

@@ -80,7 +80,7 @@ Setting up Traefik In this part we will setup traefik, with the dashboard enable external: true

What we are doing here is binding the needed configuration files, the docker socket so traefik can listen to it and automatically proxy the services, and the acme.json which will keep our ssl certificates.

We are also forcing it to use the latest available stable image to make sure there are no bugs, and disabling proxying the traefik image itself io the lables to make sure it isn’t exposed by any means.

-

We are also making it so it can restart itself unless we specifically stop it, and binding it to port 80 and 443 because those are the default http and https port’s that every browser uses when connecting.

+

We are also making it so it can restart itself unless we specifically stop it, and binding it to port 80 and 443 because those are the default http and https ports that every browser uses when connecting.

traefik.toml

[entryPoints]
   [entryPoints.web]
@@ -108,7 +108,7 @@ Setting up Traefik In this part we will setup traefik, with the dashboard enable
 [providers.file]
   filename = "traefik_dynamic.toml"
   watch = true
-

In the entryPoint’s we are defining the http and https port’s and forcing http to redirect to https.

+

In the entryPoints we are defining the http and https ports and forcing http to redirect to https.

In the api section we are enabling the dashboard, but disallowing insecure access to it.

In the rest of the config we are defining the mail and storage for tls certificates, and enabled docker provider binded to a web network, and enabled the file provider for the dashboard setup.

traefik_dynamic.toml

@@ -125,16 +125,16 @@ Setting up Traefik In this part we will setup traefik, with the dashboard enable [http.routers.api.tls] certResolver = "lets-encrypt"

Here we are defining the basic auth credentials and routing the monitor domain to the dashboard with basic auth credentials and https.

-

Make sure to subsitute the string in qutes for users with what you get generated with httpasswd command: htpasswd -nb somebody secure_password.

+

Make sure to subsitute the string in qutes for users with what you get generated with httpasswd command: htpasswd -n somebody.

acme.toml

To create acme.toml run this command touch acme.toml && chmod 600 acme.toml and we are done.

docker web network

-

You might have seen the networks part in the docker compose, we need to create it to make other docker container’s in different docker compose files be accessible to traefik so it can proxy to them.

+

You might have seen the networks part in the docker compose, we need to create it to make other docker containers in different docker compose files be accessible to traefik so it can proxy to them.

To create it we just need to run docker network create web and we are done.

-

After all this is done, we can just run docker compose up -d and if everyting was setup correctly, running docker compose logs -f shouldn’t show any error’s.

-

Using trafik to proxy to docker container’s

-

Now I’m going to explain to you how to use traefik to proxy to docker container’s by using labels. For that I will be using ntfy docker image as an example.

+

After all this is done, we can just run docker compose up -d and if everyting was setup correctly, running docker compose logs -f shouldn’t show any errors.

+

Using trafik to proxy to docker containers

+

Now I’m going to explain to you how to use traefik to proxy to docker containers by using labels. For that I will be using ntfy docker image as an example.

docker-compose.yml

@@ -172,7 +172,7 @@ Setting up Traefik In this part we will setup traefik, with the dashboard enable

The important part’s of this docker compose are the following:

As you can see, with traefik you don’t need to expose port’s from the container making it a lot more secure as it can directly proxy to them from itself using the web network.

@@ -181,8 +181,8 @@ Setting up Traefik In this part we will setup traefik, with the dashboard enable

labels

-

In labels we are defining the host domain we wan’t to proxy to our container, we are also enabled tls and with entrypoint’s making the container only acessible from https, making it impossible to be accessible with http no matter what.

-

We are also defining the certresolver to be lets-encrypt and setting the port from the container that traefik need’s to proxy to 80, this port can be differen’t depending on what you wan’t to proxy.

+

In labels we are defining the host domain we wan’t to proxy to our container, we are also enabled tls and with entrypoints making the container only acessible from https, making it impossible to be accessible with http no matter what.

+

We are also defining the certresolver to be lets-encrypt and setting the port from the container that traefik needs to proxy to 80, this port can be different depending on what you want to proxy.