traefik + ssl everywhere + swarm mode + docker-compose.yml

[jagbarcelo]

I've been following your step-by-step instructions on how to install traefik + portainer through Put Wildcard Certificates and SSL on EVERYTHING and also your related video https://www.youtube.com/watch?v=liV3c9m_OX8

Everything went fine but now I'm struggling to make it work after having created a Swarm with 3 Raspberry Pi's: I want traefik to work as proxy for containers running on any node of the swarm/cluster.

According to Traefik documentation, for it to work in a Swarm, it must be deployed on a master node (no problem since my 3 nodes are managers). Thus, I included this in the docker-compose.yml:

    deploy:
      #mode: global     #Should it be installed on every manager node or will it suffice with just one?
      placement:
        constraints:
          - node.role == manager

I've also created a new overlay network (instead of the regular bridge mode network you used, called proxy) and modify the docker-compose accordingly.

Besides, it seems that the labels must be nested one level deeper, under the deploy tag, thus:

[...]
    deploy:
      placement:
        constraints:
          - node.role == manager
      labels:
        - traefik.enable=true
        - traefik.docker.network=proxy-overlay
        [more labels here]
networks:
  proxy-overlay:
    external: true

I've also modified the data/traefiik.yml file to include:

providers:
  docker:
    swarmMode: true
    endpoint: "unix:///var/run/docker.sock"
    watch: true
    exposedByDefault: false

I'm using your file as template, tried every possible combination but I still cannot make it work:

techno-tim.github.io/reference_files/traefik-portainer-ssl/traefik/docker-compose.yml

Lines 1 to 45 in ef6b8c9

 version: '3' 
  
 services: 
   traefik: 
     image: traefik:latest 
     container_name: traefik 
     restart: unless-stopped 
     security_opt: 
       - no-new-privileges:true 
     networks: 
       - proxy 
     ports: 
       - 80:80 
       - 443:443 
     environment: 
       - CF_API_EMAIL=[e-mail] 
       - CF_DNS_API_TOKEN=YOU_API_TOKEN 
       # - CF_API_KEY=YOU_API_KEY 
       # be sure to use the correct one depending on if you are using a token or key 
     volumes: 
       - /etc/localtime:/etc/localtime:ro 
       - /var/run/docker.sock:/var/run/docker.sock:ro 
       - /home/username/traefik/data/traefik.yml:/traefik.yml:ro 
       - /home/username/traefik/data/acme.json:/acme.json 
       - /home/username/traefik/data/config.yml:/config.yml:ro 
     labels: 
       - "traefik.enable=true" 
       - "traefik.http.routers.traefik.entrypoints=http" 
       - "traefik.http.routers.traefik.rule=Host(`traefik-dashboard.local.example.com`)" 
       - "traefik.http.middlewares.traefik-auth.basicauth.users=USER:BASIC_AUTH_PASSWORD" 
       - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https" 
       - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https" 
       - "traefik.http.routers.traefik.middlewares=traefik-https-redirect" 
       - "traefik.http.routers.traefik-secure.entrypoints=https" 
       - "traefik.http.routers.traefik-secure.rule=Host(`traefik-dashboard.local.example.com`)" 
       - "traefik.http.routers.traefik-secure.middlewares=traefik-auth" 
       - "traefik.http.routers.traefik-secure.tls=true" 
       - "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare" 
       - "traefik.http.routers.traefik-secure.tls.domains[0].main=local.example.com" 
       - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.local.example.com" 
       - "traefik.http.routers.traefik-secure.service=api@internal" 
  
 networks: 
   proxy: 
     external: true 

Everytime, every possible change that has come to my mind leads me to a 404 File not found error page when the docker-compose file is deployed.

Can you shed some light on what changes would be needed in your template to make it work on a swarm mode cluster?

Thank you.