Frontend</th>	Backend</th>	Rules</th></tr></thead>
`dashboard.traefik.moritzvd.eu</code> (HTTP, HTTPS and :8080)</td>`	dashboard</td>	basic authentication via `traefik.toml</code></td></tr>`
`traefik.moritzvd.eu</code> (HTTPS)</td>`	httpd</td>	permanent redirect from `http://</code> to https://</code> and security headers</td></tr>`
`whoami.moritzvd.eu</code> (HTTP, HTTPS)</td>`	whoami</td>	default setup</td></tr> </tbody></table> Folder structure:</p> ├──</span> acme.json </span># stores SSL certs and keys </span>├──</span> docker-compose.yml </span># defines containers </span>├──</span> htdocs </span>│</span> └── index.html </span># super awesome website </span>└──</span> traefik.toml </span># Traefik`s configuration: </span> </span># defines entrypoints, enables dashboard, </span> </span># ACME, Docker provider and access logging </span></code></pre> I created a repository at GitHub</a> that follows our upgrade steps. You can take a look at the initial situation in this commit</a>.</p> From Frontends and Backends to Routers, Services and Middlewares#</a> </h2> Before we upgrade this setup we need to understand some key differences between Traefik v1.7 and v2. The notion of "Frontends" and "Backends" is gone, in the new version the concepts of "Routers", "Middlewares" and "Services" were introduced. Especially against the backdrop of our planned upgrade, these concepts can be considered as follows:</p> Frontends become Routers</li> Backends become Services</li> Things like frontend.redirect</code> or frontend.headers</code> become middlewares</li> </ul> The great part about middlewares is that they can be reused. For instance a scheme redirection from http</code> to https</code> can be defined once and used again all over the setup by just adding it to a router.</p> Please check out the documentation</a> for more background on these new concepts.</p> Step 1 - Upgrading the Traefik dashboard#</a> </h2> We will start of by focusing on the basic setup and enabling dashboard. Begin by stopping your 1.7 setup with docker-compose stop && docker-compose rm -f</code> after that comment out the services whoami</code> and httpd</code>, they'll be enabled again later on. Next we'll replace the tag of the Traefik image with v2.1</code>.</p> Like before Traefik uses a static</em> and a dynamic</em> configuration. The first are set during startup. The later are fully dynamic and can change while Traefik is running.</p> In v2 both can't be mixed that's why we are creating two new configuration files. The new version also introduced YAML support, since we are already using it for docker-compose</code> I suggest we switch from TOML to YAML. Of course this is a purely subjective decision on my part.</p> $</span> touch dynamic_conf.yml traefik.yml </span></code></pre> Both files need to be mounted in our docker-compose.yml</code> file like this:</p> </span>volumes</span>: </span> - </span>./traefik.yml:/traefik.yml </span> - </span>./dynamic_conf.yml:/dynamic_conf.yml </span></code></pre> Static configuration (Entrypoints, ACME, Providers...)#</a> </h3> Now we can start reworking our static configuration traefik.yml</code>. I'm following the structure of the old TOML file from top to bottom</em>.</p> Entrypoints#</a> </h4> First lets refactor the Entrypoints to YAML. In the same step we're also removing the basic authentication for the dashboard/API and the https</code> redirect. Don't worry they'll be added again as middlewares 🚀</p> entryPoints</span>: </span> </span>dashboard</span>: </span> </span>address</span>: </span>:8080 </span> </span>http</span>: </span> </span>address</span>: </span>:80 </span> </span>https</span>: </span> </span>address</span>: </span>:443 </span></code></pre> Dashboard and API#</a> </h4> Next up the Dashboard/API. We just tell Traefik to enable both like this:</p> api</span>: </span> </span>dashboard</span>: </span>true </span></code></pre> The Entrypoint definition will be part of our dynamic configuration as part of a router. Remember in v2 static and dynamic configuration don't mix!</p> ACME (Let's Encrypt)#</a> </h4> First up: In v2 the format of the acme.json</code> changed. This file needs to be converted from v1 to v2. For this task containous</em> released the traefik-migration-tool</a>. Run it from your working directory:</p> $</span> docker run</span> --rm -v </span>${</span>PWD</span>}:/data containous/traefik-migration-tool \ </span> acme</span> -i</span> /data/acme.json \ </span> -o</span> /data/acme-new.json </span>$</span> sudo chmod 600 acme-new.json </span>$</span> sudo mv acme-new.json acme.json </span></code></pre> ACME now is a certificate resolver that needs to be defined:</p> certificatesResolvers</span>: </span> </span>myhttpchallenge</span>: </span> </span>acme</span>: </span> </span>httpChallenge</span>: </span> </span># used during the challenge </span> </span>entryPoint</span>: </span>http </span> </span>email</span>: </span>hi+letsencrypt@moritzvd.eu </span> </span>storage</span>: </span>acme.json </span> </span># Use Let's Encrypt Staging CA when testing! </span> </span># caServer: https://acme-staging-v02.api.letsencrypt.org/directory </span></code></pre> Providers#</a> </h4> The documentation tells us</a>:</p> Configuration discovery in Traefik is achieved through Providers.</p> </blockquote> For us that means we need two providers docker</code> and file</code> the latter for our dynamic_conf.yml</code> that we'll be adding in a couple of minutes.</p> providers</span>: </span> </span>docker</span>: </span> </span>exposedByDefault</span>: </span>false </span> </span>network</span>: </span>web </span> </span>file</span>: </span> </span>filename</span>: </span>dynamic_conf.yml </span> </span>watch</span>: </span>true </span></code></pre> Access Logging and Traefik Debugging#</a> </h4> We want to keep logging access and also increase the verbosity of Traefik. That's why we just add:</p> log</span>: </span> </span>level</span>: </span>INFO </span>accessLog</span>: {} </span></code></pre> Our static configuration is now finished.</strong></p> Dynamic Configuration for Dashboard and API#</a> </h3> Now that we have defined the static configuration we need to work on our dynamic routers and middlewares. Remember they have the job of exposing our services and can change while Traefik is running.</p> Like on 1.7 we want our dashboard to be available on :8080 and https</code>. For that we need two Frontend</del> routers that expose the service api@internal</code>. These routers also need a use a basicAuth</code> middleware so that users are asked for our super secure passw0rd</code>.</p> Check create_docker_compose_basic_auth_string_for_traefik.sh</code> (my fork at gist</a>) to generate you own authentication string.</em></p> We start by defining our basic authentication middleware. We use the same password that was used in the old traefik.toml</code>.</p> In dynamic_conf.yml</code>:</p> http</span>: </span> </span>middlewares</span>: </span> </span>dashboard-auth</span>: </span> </span>basicAuth</span>: </span> </span>users</span>: </span> </span># admin:passw0rd </span> - "</span>admin:$2y$05$kqK7GlhnGCnt/fYdrCL2AeZykK2T0cN4sBcCaRs61vMz7yMWaR9M.</span>" </span></code></pre> Next we define our first router:</p> </span>routers</span>: </span> </span>my-api</span>: </span> </span>entryPoints</span>: </span> - </span>dashboard </span> </span>rule</span>: "</span>PathPrefix(`/dashboard`) \|\| PathPrefix(`/api`)</span>" </span> </span>service</span>: </span>api@internal </span> </span>middlewares</span>: </span> - </span>dashboard-auth </span></code></pre> What did we do here?</em> This router gets activated when the Route '/dashboard'</code> or '/api'</code> gets requested (the given rule</code> condition is fulfilled). It adds the dashboard-auth</code> middleware and than forwards the request to the api@internal</code> service. The router is only exposed on Port 8080 aka our dashboard</code> entrypoint.</p> No we can run first tests on our setup. The Traefik API should reply with a list of our active routers:</p> $</span> docker-compose up</span> -d </span>$</span> curl</span> -s --user</span> admin:passw0rd http://localhost:8080/api/http/routers \| </span>jq </span></code></pre> [ </span> { </span> "</span>entryPoints</span>": [ </span> "</span>dashboard</span>" </span> ], </span> "</span>middlewares</span>": [ </span> "</span>dashboard-auth@file</span>" </span> ], </span> "</span>service</span>": "</span>api@internal</span>", </span> "</span>rule</span>": "</span>PathPrefix(`/dashboard`) \|\| PathPrefix(`/api`)</span>", </span> "</span>status</span>": "</span>enabled</span>", </span> "</span>using</span>": [ </span> "</span>dashboard</span>" </span> ], </span> "</span>name</span>": "</span>my-api@file</span>", </span> "</span>provider</span>": "</span>file</span>" </span> } </span>] </span></code></pre> Next we add a second router that is in charge of securely exposing the dashboard and API via https</code>. It's mostly the same but uses a more precise rule and our ACME HTTP Challenge from traefik.yml</code>. The longer rule gets a higher priority</a> by Traefik than the one defined for port 8080.</p> </span>my-secure-api</span>: </span> </span>entryPoints</span>: </span> - </span>https </span> </span># Activate this router if Client requests specific subdomain and '/dashboard' or '/api' </span> </span>rule</span>: "</span>Host(`dashboard.traefik.moritzvd.eu`) && (PathPrefix(`/api`) \|\| PathPrefix(`/dashboard`))</span>" </span> </span>service</span>: </span>api@internal </span> </span>middlewares</span>: </span> - </span>dashboard-auth </span> </span>tls</span>: </span> </span># Use ACME HTTP Challenge defined in 'traefik.yml' to get valid cert </span> </span>certResolver</span>: </span>myhttpchallenge </span></code></pre> Now we can access the Dashboard securely from our Browser:</p> </p> Finally we want to redirect from http://</code> to https://</code>. This great article by Gérald Croë</a> gave me the idea to just do this as a general catch-all router. Since at the end we all just want https everywhere right?</p> For this we first define a redirectScheme</code> middleware:</p> </span>redirect-to-https</span>: </span> </span>redirectScheme</span>: </span> </span>scheme</span>: </span>https </span> </span>permanent</span>: </span>true </span></code></pre> Now we add our catch-all router:</p> </span>https-redirect</span>: </span> </span>entryPoints</span>: </span> - </span>http </span> </span># Activate this Router on any Host requested </span> </span>rule</span>: "</span>hostregexp(`{host:.+}`)</span>" </span> </span>service</span>: </span>dummy </span> </span>middlewares</span>: </span> - </span>redirect-to-https </span></code></pre> Because Traefik always requires a service when defining routers in a configuration file we add a "dummy" service</code>. This service will never be reached because the middleware will redirect them to the requested service on https</code>.</p> The service</code> of course needs to be defined:</p> </span>services</span>: </span> </span>dummy</span>: </span> </span>loadBalancer</span>: </span> </span>servers</span>: </span> - </span>url</span>: </span>localhost </span></code></pre> Now all clients get permanently redirected to the secure version:</p> $</span> curl</span> -sI</span> http://dashboard.traefik.moritzvd.eu/api/http/routers </span>HTTP/1.1</span> 308 Permanent Redirect </span>Location:</span> https://dashboard.traefik.moritzvd.eu/api/http/routers </span>Date:</span> Tue, 03 Dec 2019 16:24:09 GMT </span>Content-Length:</span> 18 </span>Content-Type:</span> text/plain; </span>charset</span>=</span>utf-8 </span></code></pre> Step 2 - Upgrading the whoami</em> service#</a> </h2> Now that we have the nice dashboard and the practical API running we focus on our services. As before we directly setup the Traefik configuration via labels in our docker-compose.yml</code>. We start of by upgrading the simple whoami</code> service. The service is a "tiny Go web server that prints OS information and HTTP requests"</em> (containous/whoami</a>).</p> First we uncomment the services definition that we disabled before.</p> Our old Traefik 1.7 service definition looks like this:</p> </span>whoami</span>: </span> </span>image</span>: </span>containous/whoami </span> </span>container_name</span>: </span>whoami </span> </span>restart</span>: </span>unless-stopped </span> </span>networks</span>: </span> - </span>web </span> </span>labels</span>: </span> - "</span>traefik.enable=true</span>" </span> - "</span>traefik.backend=whoami</span>" </span> - "</span>traefik.frontend.rule=Host:whoami.traefik.moritzvd.eu</span>" </span> - "</span>traefik.docker.network=web</span>" </span></code></pre> The former configuration tells us the following: We need one router that activates when the whoami.traefik.moritzvd.eu</code> is requested. We name this router whoami-secure</code> as the name suggests we only want it to be accessible via https</code>.</p> We define the router</code> and the rule</code> and the entrypoint</code> in two label lines:</p> # The router is named inline </span> - "</span>traefik.http.routers.whoami-secure.entrypoints=https</span>" </span> - "</span>traefik.http.routers.whoami-secure.rule=Host(`whoami.traefik.moritzvd.eu`)</span>" </span> - "</span>traefik.http.routers.whoami-secure.tls.certresolver=myhttpchallenge</span>" </span></code></pre> Because we defined a global catch-all redirect router the http</code> to https</code> redirection is already taken care of. Our finished service definition looks like this:</p> </span>whoami</span>: </span> </span>image</span>: </span>containous/whoami </span> </span>container_name</span>: </span>whoami </span> </span>restart</span>: </span>unless-stopped </span> </span>networks</span>: </span> - </span>web </span> </span>labels</span>: </span> - "</span>traefik.enable=true</span>" </span> - "</span>traefik.http.routers.whoami-secure.entrypoints=https</span>" </span> - "</span>traefik.http.routers.whoami-secure.rule=Host(`whoami.traefik.moritzvd.eu`)</span>" </span> - "</span>traefik.http.routers.whoami-secure.tls.certresolver=myhttpchallenge</span>" </span></code></pre> We can now bring up the service by closing the file. Docker compose will pick up on the new service.</p> $</span> docker-compose up</span> -d </span>traefik</span> is up-to-date </span>Creating</span> whoami ... done </span></code></pre> Traefik will generate a new certificate and key, and will ask Let's Encrypt to give us a signed certificate. This normally happens within a couple of seconds. After that we can access the service:</p> $</span> curl</span> -s </span>'</span>https://whoami.traefik.moritzvd.eu</span>' </span>Hostname:</span> edf3d71d3412 </span>IP:</span> 127.0.0.1 </span>IP:</span> 172.18.0.3 </span>RemoteAddr:</span> 172.18.0.2:39308 </span>GET</span> / HTTP/1.1 </span>Host:</span> whoami.traefik.moritzvd.eu </span>User-Agent:</span> curl/7.58.0 </span>Accept: </span>/ </span>Accept-Encoding:</span> gzip </span>X-Forwarded-For: </span>[</span>...</span>] </span>X-Forwarded-Host:</span> whoami.traefik.moritzvd.eu </span>X-Forwarded-Port:</span> 443 </span>X-Forwarded-Proto:</span> https </span>X-Forwarded-Server:</span> 248ac49c7b90 </span>X-Real-Ip: </span>[</span>...</span>] </span></code></pre> Step 3 - Upgrading the httpd</em> service#</a> </h2> Now we can upgrade our final service. For the sake of this guide we want to expose a good old Apache httpd. We also want to add some security headers like STS and CORS Headers. These become part of a new middleware that we call in our router.</p> In order to upgrade, we first uncomment the old Traefik 1.7 style definition. Afterward we do the following modifications:</p> Delete the lines:</p> - "</span>traefik.backend=httpd</span>" </span># The new router is named inline </span> - "</span>traefik.docker.network=web</span>" </span># already defined this as default in `traefik.yml` </span> - "</span>traefik.port=80</span>" </span># We are using the standard port exposed by httpd </span></code></pre> Than we define our new router. We'll call it httpd-secure</code> and we want to expose it on our https</code> entrypoint.</p> - "</span>traefik.http.routers.httpd-secure.entrypoints=https</span>" </span> - "</span>traefik.http.routers.httpd-secure.rule=Host(`traefik.moritzvd.eu`)</span>" </span> - "</span>traefik.http.routers.httpd-secure.tls.certresolver=myhttpchallenge</span>" </span># Don't forget the certresolver </span></code></pre> Now we need to rework our header definitions. Fortunately, the definitions have remained the same. But they now need to be defined as part of a headers</code> middleware. We just need to Replace traefik.frontend.headers</code> with traefik.http.middlewares.httpd-security.headers</code>.</p> Our labels now look like this:</p> - "</span>traefik.http.middlewares.httpd-security.headers.browserXSSFilter=true</span>" </span> - "</span>traefik.http.middlewares.httpd-security.headers.customFrameOptionsValue=SAMEORIGIN</span>" </span> - "</span>traefik.http.middlewares.httpd-security.headers.forceSTSHeader=true</span>" </span> - "</span>traefik.http.middlewares.httpd-security.headers.frameDeny=true</span>" </span> - "</span>traefik.http.middlewares.httpd-security.headers.SSLHost=traefik.moritzvd.eu</span>" </span> - "</span>traefik.http.middlewares.httpd-security.headers.SSLRedirect=true</span>" </span> - "</span>traefik.http.middlewares.httpd-security.headers.STSIncludeSubdomains=true</span>" </span> - "</span>traefik.http.middlewares.httpd-security.headers.STSSeconds=63072000</span>" </span></code></pre> By doing this we created a new middleware called httpd-security</code>. Of course this middleware needs to be added to our httpd-secure</code> router. This middleware could also be added to any other service that is in need of some nice security headers.</p> - "</span>traefik.http.routers.httpd-secure.middlewares=httpd-security</span>" </span></code></pre> After firing docker-compose up -d</code> all our services are now back again and served with Traefik 2.1. 🏁</p> I hope I could help in upgrading your setup from 1.7 to 2.1. We could go the extra mile and refactor everything even further by including all of the configuration in the docker-compose.yml</code> file.</p> Credits for sources used in the banner: Background vector created by vectorpouch - www.freepik.com</a> and the Traefik logo licensed under the Creative Commons 3.0 Attributions license</a>.</em></p>

Upgrading to Traefik 2 with Docker

Unknown — Fri, 13 Dec 2019 22:20:00 +0000

I'm running some web services for personal use. These services are mostly running from containers with a reverse proxy to expose them to the web. I leave this task to Traefik</a>.

Before that I used a popular triad of nginx</code>, docker-gen</code></a> and letsencrypt-nginx-proxy-companion</code></a>. This for the most part worked great but three services for one task also meant three sources for possible errors. Around this time last year I learned about Traefik with its single binary approach and general small footprint. After following a guide by Keith Thompson</a> I jumped ships.

This fall containous the company behind Traefik released version 2.0</a>. This is a major release including cool stuff like reusable middlewares</a>, a new fun web dashboard and advanced stuff for production deployments like canary deployments. This changes come with a trade off. The new version has lots of breaking changes because of that I had to update my deployment and understand the new paradigms introduced. In this post I want to help share my findings and show a path to upgrade from 1.7 to 2. So without further ado, let’s jump right in.

Step 0 - Our initial Traefik v1.7 setup#</a>
</h2>
Before we go further, we are setting up a small Docker based environment in Traefik 1.7 that we are going to upgrade. For that I'll assume that you already have docker</code> and docker-compose</code> installed and know your way around these tools.</p>
We are exposing two Docker containers and Traefik's dashboard. The setup is quite simple and can be described as follows: Of course you need to use your own subdomains</em></p>
Frontend</th> Backend</th> Rules</th></tr></thead>

dashboard.traefik.moritzvd.eu</code> (HTTP, HTTPS and :8080)</td> dashboard</td> basic authentication via traefik.toml</code></td></tr>
traefik.moritzvd.eu</code> (HTTPS)</td> httpd</td> permanent redirect from http://</code> to https://</code> and security headers</td></tr>
whoami.moritzvd.eu</code> (HTTP, HTTPS)</td> whoami</td> default setup</td></tr>
</tbody></table>
Folder structure:</p>
├──</span> acme.json </span># stores SSL certs and keys
</span>├──</span> docker-compose.yml </span># defines containers
</span>├──</span> htdocs
</span>│</span>   └── index.html </span># super awesome website
</span>└──</span> traefik.toml </span># Traefik`s configuration:
</span>                 </span># defines entrypoints, enables dashboard,
</span>                 </span># ACME, Docker provider and access logging
</span></code></pre>
I created a repository at GitHub</a> that follows our upgrade steps. You can take a look at the initial situation in this commit</a>.</p>
From Frontends and Backends to Routers, Services and Middlewares#</a>
</h2>
Before we upgrade this setup we need to understand some key differences between Traefik v1.7 and v2. The notion of "Frontends" and "Backends" is gone, in the new version the concepts of "Routers", "Middlewares" and "Services" were introduced. Especially against the backdrop of our planned upgrade, these concepts can be considered as follows:</p>

Frontends become Routers</li>
Backends become Services</li>
Things like frontend.redirect</code> or frontend.headers</code> become middlewares</li>
</ul>
The great part about middlewares is that they can be reused. For instance a scheme redirection from http</code> to https</code> can be defined once and used again all over the setup by just adding it to a router.</p>
Please check out the documentation</a> for more background on these new concepts.</p>
Step 1 - Upgrading the Traefik dashboard#</a>
</h2>
We will start of by focusing on the basic setup and enabling dashboard. Begin by stopping your 1.7 setup with docker-compose stop && docker-compose rm -f</code> after that comment out the services whoami</code> and httpd</code>, they'll be enabled again later on. Next we'll replace the tag of the Traefik image with v2.1</code>.</p>
Like before Traefik uses a static</em> and a dynamic</em> configuration. The first are set during startup. The later are fully dynamic and can change while Traefik is running.</p>
In v2 both can't be mixed that's why we are creating two new configuration files. The new version also introduced YAML support, since we are already using it for docker-compose</code> I suggest we switch from TOML to YAML. Of course this is a purely subjective decision on my part.</p>
$</span> touch dynamic_conf.yml traefik.yml
</span></code></pre>
Both files need to be mounted in our docker-compose.yml</code> file like this:</p>
    </span>volumes</span>:
</span>      - </span>./traefik.yml:/traefik.yml
</span>      - </span>./dynamic_conf.yml:/dynamic_conf.yml
</span></code></pre>
Static configuration (Entrypoints, ACME, Providers...)#</a>
</h3>
Now we can start reworking our static configuration traefik.yml</code>. I'm following the structure of the old TOML file from top to bottom</em>.</p>
Entrypoints#</a>
</h4>
First lets refactor the Entrypoints to YAML. In the same step we're also removing the basic authentication for the dashboard/API and the https</code> redirect. Don't worry they'll be added again as middlewares 🚀</p>
entryPoints</span>:
</span>  </span>dashboard</span>:
</span>    </span>address</span>: </span>:8080
</span>  </span>http</span>:
</span>    </span>address</span>: </span>:80
</span>  </span>https</span>:
</span>    </span>address</span>: </span>:443
</span></code></pre>
Dashboard and API#</a>
</h4>
Next up the Dashboard/API. We just tell Traefik to enable both like this:</p>
api</span>:
</span>  </span>dashboard</span>: </span>true
</span></code></pre>
The Entrypoint definition will be part of our dynamic configuration as part of a router. Remember in v2 static and dynamic configuration don't mix!</p>
ACME (Let's Encrypt)#</a>
</h4>
First up: In v2 the format of the acme.json</code> changed. This file needs to be converted from v1 to v2. For this task containous</em> released the traefik-migration-tool</a>. Run it from your working directory:</p>
$</span> docker run</span> --rm -v </span>${</span>PWD</span>}:/data containous/traefik-migration-tool \
</span>    acme</span> -i</span> /data/acme.json \
</span>    -o</span> /data/acme-new.json
</span>$</span> sudo chmod 600 acme-new.json
</span>$</span> sudo mv acme-new.json acme.json
</span></code></pre>
ACME now is a certificate resolver that needs to be defined:</p>
certificatesResolvers</span>:
</span>  </span>myhttpchallenge</span>:
</span>    </span>acme</span>:
</span>      </span>httpChallenge</span>:
</span>        </span># used during the challenge
</span>        </span>entryPoint</span>: </span>http
</span>      </span>email</span>: </span>hi+letsencrypt@moritzvd.eu
</span>      </span>storage</span>: </span>acme.json
</span>      </span># Use Let's Encrypt Staging CA when testing!
</span>      </span># caServer: https://acme-staging-v02.api.letsencrypt.org/directory
</span></code></pre>
Providers#</a>
</h4>
The documentation tells us</a>:</p>

Configuration discovery in Traefik is achieved through Providers.</p>
</blockquote>
For us that means we need two providers docker</code> and file</code> the latter for our dynamic_conf.yml</code> that we'll be adding in a couple of minutes.</p>
providers</span>:
</span>  </span>docker</span>:
</span>    </span>exposedByDefault</span>: </span>false
</span>    </span>network</span>: </span>web
</span>  </span>file</span>:
</span>    </span>filename</span>: </span>dynamic_conf.yml
</span>    </span>watch</span>: </span>true
</span></code></pre>
Access Logging and Traefik Debugging#</a>
</h4>
We want to keep logging access and also increase the verbosity of Traefik. That's why we just add:</p>
log</span>:
</span>  </span>level</span>: </span>INFO
</span>accessLog</span>: {}
</span></code></pre>
Our static configuration is now finished.</strong></p>
Dynamic Configuration for Dashboard and API#</a>
</h3>
Now that we have defined the static configuration we need to work on our dynamic routers and middlewares. Remember they have the job of exposing our services and can change while Traefik is running.</p>
Like on 1.7 we want our dashboard to be available on :8080 and https</code>. For that we need two Frontend</del> routers that expose the service api@internal</code>. These routers also need a use a basicAuth</code> middleware so that users are asked for our super secure passw0rd</code>.</p>
Check create_docker_compose_basic_auth_string_for_traefik.sh</code> (my fork at gist</a>) to generate you own authentication string.</em></p>
We start by defining our basic authentication middleware. We use the same password that was used in the old traefik.toml</code>.</p>
In dynamic_conf.yml</code>:</p>
http</span>:
</span>  </span>middlewares</span>:
</span>    </span>dashboard-auth</span>:
</span>      </span>basicAuth</span>:
</span>        </span>users</span>:
</span>          </span># admin:passw0rd
</span>          - "</span>admin:$2y$05$kqK7GlhnGCnt/fYdrCL2AeZykK2T0cN4sBcCaRs61vMz7yMWaR9M.</span>"
</span></code></pre>
Next we define our first router:</p>
  </span>routers</span>:
</span>    </span>my-api</span>:
</span>      </span>entryPoints</span>:
</span>        - </span>dashboard
</span>      </span>rule</span>: "</span>PathPrefix(`/dashboard`) || PathPrefix(`/api`)</span>"
</span>      </span>service</span>: </span>api@internal
</span>      </span>middlewares</span>:
</span>        - </span>dashboard-auth
</span></code></pre>
What did we do here?</em> This router gets activated when the Route '/dashboard'</code> or '/api'</code> gets requested (the given rule</code> condition is fulfilled). It adds the dashboard-auth</code> middleware and than forwards the request to the api@internal</code> service. The router is only exposed on Port 8080 aka our dashboard</code> entrypoint.</p>
No we can run first tests on our setup. The Traefik API should reply with a list of our active routers:</p>
$</span> docker-compose up</span> -d
</span>$</span> curl</span> -s --user</span> admin:passw0rd http://localhost:8080/api/http/routers | </span>jq
</span></code></pre>
[
</span>  {
</span>    "</span>entryPoints</span>": [
</span>      "</span>dashboard</span>"
</span>    ],
</span>    "</span>middlewares</span>": [
</span>      "</span>dashboard-auth@file</span>"
</span>    ],
</span>    "</span>service</span>": "</span>api@internal</span>",
</span>    "</span>rule</span>": "</span>PathPrefix(`/dashboard`) || PathPrefix(`/api`)</span>",
</span>    "</span>status</span>": "</span>enabled</span>",
</span>    "</span>using</span>": [
</span>      "</span>dashboard</span>"
</span>    ],
</span>    "</span>name</span>": "</span>my-api@file</span>",
</span>    "</span>provider</span>": "</span>file</span>"
</span>  }
</span>]
</span></code></pre>
Next we add a second router that is in charge of securely exposing the dashboard and API via https</code>. It's mostly the same but uses a more precise rule and our ACME HTTP Challenge from traefik.yml</code>. The longer rule gets a higher priority</a> by Traefik than the one defined for port 8080.</p>
    </span>my-secure-api</span>:
</span>      </span>entryPoints</span>:
</span>        - </span>https
</span>      </span># Activate this router if Client requests specific subdomain and '/dashboard' or '/api'
</span>      </span>rule</span>: "</span>Host(`dashboard.traefik.moritzvd.eu`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))</span>"
</span>      </span>service</span>: </span>api@internal
</span>      </span>middlewares</span>:
</span>        - </span>dashboard-auth
</span>      </span>tls</span>:
</span>        </span># Use ACME HTTP Challenge defined in 'traefik.yml' to get valid cert
</span>        </span>certResolver</span>: </span>myhttpchallenge
</span></code></pre>
Now we can access the Dashboard securely from our Browser:</p>
</p>
Finally we want to redirect from http://</code> to https://</code>. This great article by Gérald Croë</a> gave me the idea to just do this as a general catch-all router. Since at the end we all just want https everywhere right?</p>
For this we first define a redirectScheme</code> middleware:</p>
    </span>redirect-to-https</span>:
</span>      </span>redirectScheme</span>:
</span>        </span>scheme</span>: </span>https
</span>        </span>permanent</span>: </span>true
</span></code></pre>
Now we add our catch-all router:</p>
    </span>https-redirect</span>:
</span>      </span>entryPoints</span>:
</span>        - </span>http
</span>      </span># Activate this Router on any Host requested
</span>      </span>rule</span>: "</span>hostregexp(`{host:.+}`)</span>"
</span>      </span>service</span>: </span>dummy
</span>      </span>middlewares</span>:
</span>        - </span>redirect-to-https
</span></code></pre>
Because Traefik always requires a service when defining routers in a configuration file we add a "dummy" service</code>. This service will never be reached because the middleware will redirect them to the requested service on https</code>.</p>
The service</code> of course needs to be defined:</p>
  </span>services</span>:
</span>    </span>dummy</span>:
</span>      </span>loadBalancer</span>:
</span>        </span>servers</span>:
</span>          - </span>url</span>: </span>localhost
</span></code></pre>
Now all clients get permanently redirected to the secure version:</p>
$</span> curl</span> -sI</span> http://dashboard.traefik.moritzvd.eu/api/http/routers
</span>HTTP/1.1</span> 308 Permanent Redirect
</span>Location:</span> https://dashboard.traefik.moritzvd.eu/api/http/routers
</span>Date:</span> Tue, 03 Dec 2019 16:24:09 GMT
</span>Content-Length:</span> 18
</span>Content-Type:</span> text/plain; </span>charset</span>=</span>utf-8
</span></code></pre>
Step 2 - Upgrading the whoami</em> service#</a>
</h2>
Now that we have the nice dashboard and the practical API running we focus on our services. As before we directly setup the Traefik configuration via labels in our docker-compose.yml</code>. We start of by upgrading the simple whoami</code> service. The service is a "tiny Go web server that prints OS information and HTTP requests"</em> (containous/whoami</a>).</p>
First we uncomment the services definition that we disabled before.</p>
Our old Traefik 1.7 service definition looks like this:</p>
  </span>whoami</span>:
</span>    </span>image</span>: </span>containous/whoami
</span>    </span>container_name</span>: </span>whoami
</span>    </span>restart</span>: </span>unless-stopped
</span>    </span>networks</span>:
</span>      - </span>web
</span>    </span>labels</span>:
</span>      - "</span>traefik.enable=true</span>"
</span>      - "</span>traefik.backend=whoami</span>"
</span>      - "</span>traefik.frontend.rule=Host:whoami.traefik.moritzvd.eu</span>"
</span>      - "</span>traefik.docker.network=web</span>"
</span></code></pre>
The former configuration tells us the following: We need one router that activates when the whoami.traefik.moritzvd.eu</code> is requested. We name this router whoami-secure</code> as the name suggests we only want it to be accessible via https</code>.</p>
We define the router</code> and the rule</code> and the entrypoint</code> in two label lines:</p>
# The router is named inline
</span>      - "</span>traefik.http.routers.whoami-secure.entrypoints=https</span>"
</span>      - "</span>traefik.http.routers.whoami-secure.rule=Host(`whoami.traefik.moritzvd.eu`)</span>"
</span>      - "</span>traefik.http.routers.whoami-secure.tls.certresolver=myhttpchallenge</span>"
</span></code></pre>
Because we defined a global catch-all redirect router the http</code> to https</code> redirection is already taken care of. Our finished service definition looks like this:</p>
  </span>whoami</span>:
</span>    </span>image</span>: </span>containous/whoami
</span>    </span>container_name</span>: </span>whoami
</span>    </span>restart</span>: </span>unless-stopped
</span>    </span>networks</span>:
</span>      - </span>web
</span>    </span>labels</span>:
</span>      - "</span>traefik.enable=true</span>"
</span>      - "</span>traefik.http.routers.whoami-secure.entrypoints=https</span>"
</span>      - "</span>traefik.http.routers.whoami-secure.rule=Host(`whoami.traefik.moritzvd.eu`)</span>"
</span>      - "</span>traefik.http.routers.whoami-secure.tls.certresolver=myhttpchallenge</span>"
</span></code></pre>
We can now bring up the service by closing the file. Docker compose will pick up on the new service.</p>
$</span> docker-compose up</span> -d
</span>traefik</span> is up-to-date
</span>Creating</span> whoami ... done
</span></code></pre>
Traefik will generate a new certificate and key, and will ask Let's Encrypt to give us a signed certificate. This normally happens within a couple of seconds. After that we can access the service:</p>
$</span> curl</span> -s </span>'</span>https://whoami.traefik.moritzvd.eu</span>'
</span>Hostname:</span> edf3d71d3412
</span>IP:</span> 127.0.0.1
</span>IP:</span> 172.18.0.3
</span>RemoteAddr:</span> 172.18.0.2:39308
</span>GET</span> / HTTP/1.1
</span>Host:</span> whoami.traefik.moritzvd.eu
</span>User-Agent:</span> curl/7.58.0
</span>Accept: </span>*/*
</span>Accept-Encoding:</span> gzip
</span>X-Forwarded-For: </span>[</span>...</span>]
</span>X-Forwarded-Host:</span> whoami.traefik.moritzvd.eu
</span>X-Forwarded-Port:</span> 443
</span>X-Forwarded-Proto:</span> https
</span>X-Forwarded-Server:</span> 248ac49c7b90
</span>X-Real-Ip: </span>[</span>...</span>]
</span></code></pre>
Step 3 - Upgrading the httpd</em> service#</a>
</h2>
Now we can upgrade our final service. For the sake of this guide we want to expose a good old Apache httpd. We also want to add some security headers like STS and CORS Headers. These become part of a new middleware that we call in our router.</p>
In order to upgrade, we first uncomment the old Traefik 1.7 style definition. Afterward we do the following modifications:</p>
Delete the lines:</p>
    - "</span>traefik.backend=httpd</span>" </span># The new router is named inline
</span>    - "</span>traefik.docker.network=web</span>" </span># already defined this as default in `traefik.yml`
</span>    - "</span>traefik.port=80</span>" </span># We are using the standard port exposed by httpd
</span></code></pre>
Than we define our new router. We'll call it httpd-secure</code> and we want to expose it on our https</code> entrypoint.</p>
    - "</span>traefik.http.routers.httpd-secure.entrypoints=https</span>"
</span>    - "</span>traefik.http.routers.httpd-secure.rule=Host(`traefik.moritzvd.eu`)</span>"
</span>    - "</span>traefik.http.routers.httpd-secure.tls.certresolver=myhttpchallenge</span>" </span># Don't forget the certresolver
</span></code></pre>
Now we need to rework our header definitions. Fortunately, the definitions have remained the same. But they now need to be defined as part of a headers</code> middleware. We just need to Replace traefik.frontend.headers</code> with traefik.http.middlewares.httpd-security.headers</code>.</p>
Our labels now look like this:</p>
      - "</span>traefik.http.middlewares.httpd-security.headers.browserXSSFilter=true</span>"
</span>      - "</span>traefik.http.middlewares.httpd-security.headers.customFrameOptionsValue=SAMEORIGIN</span>"
</span>      - "</span>traefik.http.middlewares.httpd-security.headers.forceSTSHeader=true</span>"
</span>      - "</span>traefik.http.middlewares.httpd-security.headers.frameDeny=true</span>"
</span>      - "</span>traefik.http.middlewares.httpd-security.headers.SSLHost=traefik.moritzvd.eu</span>"
</span>      - "</span>traefik.http.middlewares.httpd-security.headers.SSLRedirect=true</span>"
</span>      - "</span>traefik.http.middlewares.httpd-security.headers.STSIncludeSubdomains=true</span>"
</span>      - "</span>traefik.http.middlewares.httpd-security.headers.STSSeconds=63072000</span>"
</span></code></pre>
By doing this we created a new middleware called httpd-security</code>. Of course this middleware needs to be added to our httpd-secure</code> router. This middleware could also be added to any other service that is in need of some nice security headers.</p>
      - "</span>traefik.http.routers.httpd-secure.middlewares=httpd-security</span>"
</span></code></pre>
After firing docker-compose up -d</code> all our services are now back again and served with Traefik 2.1. 🏁</p>
I hope I could help in upgrading your setup from 1.7 to 2.1. We could go the extra mile and refactor everything even further by including all of the configuration in the docker-compose.yml</code> file.</p>
Credits for sources used in the banner: Background vector created by vectorpouch - www.freepik.com</a>  and the Traefik logo licensed under the Creative Commons 3.0 Attributions license</a>.</em></p>

Step 3 - Upgrading the httpd</em> service`Background vector created by vectorpouch - www.freepik.com</a> and the Traefik logo licensed under the Creative Commons 3.0 Attributions license</a>.</em></p>`

moritzvd.eu - Docker

Monitoring Traefik 2 with Icinga

Upgrading to Traefik 2 with Docker

moritzvd.eu - Docker

Monitoring Traefik 2 with Icinga

Requirements#</a> </h2> A working Traefik v2.x reverse proxy with it's API exposed</li>

Upgrading to Traefik 2 with Docker