This will build an image for Traefik a modernized proxy built in GO built for containerized service deployment.
- Sane Defaults to have a working solution by just running the image
- Automatically generates configuration files on startup, or option to use your own
- Supports most traditional use cases w/Docker
- Choice of Logging (Console, File w/logrotation)
This is an incredibly complex piece of software that will tries to get you up and running with sane defaults, you will need to switch eventually over to manually configuring the configuration file when depending on your usage case
- About
- Maintainer
- Table of Contents
- Prerequisites and Assumptions
- Installation
- Configuration
- Maintenance
- Contributions
- Support
- License
- References
- Assumes you have access to create records on your DNS server to be able to fully use this image. While it will work locally, features such as certificate issuance via LetsEncrypt will fail without proper resolving DNS.
Clone this repository and build the image with docker build -t (imagename) .
Builds of the image are available on Docker Hub
docker pull docker.io/tiredofit/traefik:(imagetag)Builds of the image are also available on the Github Container Registry
docker pull ghcr.io/tiredofit/docker-traefik:(imagetag)
The following image tags are available along with their tagged release based on what's written in the Changelog:
| Traefik Version | OS Base | Tag |
|---|---|---|
| latest | Alpine | :latest |
| 2.9.x | Alpine | :2.9-latest |
| 2.8.x | Alpine | :2.8-latest |
| 2.7.x | Alpine | :2.7-latest |
| 2.6.x | Alpine | :2.6-latest |
| 2.5.x | Alpine | :2.5-latest |
| 2.4.x | Alpine | :2.4-latest |
| 2.3.x | Alpine | :2.3-latest |
| 2.2.x | Alpine | :2.2-latest |
| 1.7.x | Alpine | :1.7-latest |
Images are built primarily for amd64 architecture, and may also include builds for arm/v7, arm64 and others. These variants are all unsupported. Consider sponsoring my work so that I can work with various hardware. To see if this image supports multiple architecures, type docker manifest (image):(tag)
-
The quickest way to get started is using docker-compose. See the examples folder for a working compose.yml that can be modified for development or production use.
-
Set various environment variables to understand the capabilities of this image.
-
Map persistent storage for access to configuration and data files for backup.
_This image in it's auto configured state allows for using less labels than usual. This is what I use in my produciton environments, and if I need to add more configuration options I do, but if you are simply using as an HTTP/HTTPS reverse proxy you can get by with the bare minimum on your proxied containers as such:
- traefik.enable=true
- traefik.http.routers.whoami.rule=Host(`whoami.example.com`) || Host(`whoami2.example.com`)
- traefik.http.services.whoami.loadbalancer.server.port=80The following directories/files should be mapped for persistent storage in order to utilize the container effectively.
| Folder | Description |
|---|---|
/data/config |
(Optional) - Traefik core configuration files. Auto Generates on Container startup |
/data/config/custom |
(Optional) - If using manual mode and wish to add dynamic File configuration, add it in here (.yml) |
/data/logs |
(Optional) - Logfiles if you wish to store to files |
/data/certs |
(Optional) - If you wish to utilize ACME/LetsEncrypt Certificates or SSL map this directory |
/var/run/docker.sock |
Easiest way to get going - Map the hosts docker socket to the container |
This image relies on an Alpine Linux or Debian Linux base image that relies on an init system for added capabilities. Outgoing SMTP capabilities are handlded via msmtp. Individual container performance monitoring is performed by zabbix-agent. Additional tools include: bash,curl,less,logrotate, nano.
Be sure to view the following repositories to understand all the customizable options:
| Image | Description |
|---|---|
| OS Base | Customized Image based on Alpine Linux |
There are a huge amount of configuration variables and it is recommended that you get comfortable for a few hours with the Traefik Documentation
You will eventually based on your usage case switch over to SETUP_TYPE=MANUAL and edit your own config.yml. While I've tried to make this as easy to use as possible, once in production you'll find much better success with large implementations with this approach.
By Default this image is ready to run out of the box, without having to alter any of the settings with the exception of the docker-compose.yml hostname/domainname variables/labels.
| Parameter | Description | Default |
|---|---|---|
SETUP_TYPE |
AUTO to auto generate config on bootup, Otherwise MANUAL lets admin control configuration. |
AUTO |
CONFIG_FILE |
Configuration file to load | config.toml |
CHECK_NEW_VERSION |
Check for new Traefik Release | FALSE |
SEND_ANONYMOUS_USAGE |
Send Anonymous Usage Stats | FALSE |
TRAEFIK_USER |
Run traefik as user (options: root or traefik) |
`root |
CONFIG_CUSTOM_PATH |
Where to store custom/dynamic files | ${CONFIG_PATH}/custom/ |
CONFIG_PATH |
Where configuration files are kept | ${DATA_PATH}/config |
DATA_PATH |
Root Volatile Data folder | /data/ |
LOG_PATH |
Log Path | ${DATA_PATH}/logs |
| Parameter | Description | Default |
|---|---|---|
ACCESS_LOG_FILE |
File to store access log - Same directory as TRAEFIK_LOG_PATH |
access.log |
ACCESS_LOG_FORMAT |
Format to store logs in common / json |
common |
ACCESS_LOG_TYPE |
Display logs via CONSOLE or write to FILE |
CONSOLE |
LOG_FORMAT |
Format to store logs in common / json |
common |
LOG_TYPE |
Display logs via CONSOLE or write to FILE |
CONSOLE |
LOG_LEVEL |
Log levels DEBUG INFO WARN ERROR FATAL |
ERROR |
| Parameter | Description | Default | _FILE |
|---|---|---|---|
ENABLE_DOCKER |
Enable Docker Mode | TRUE |
|
DOCKER_ENDPOINT |
How to connect to Docker | unix:///var/run/docker.sock |
x |
DOCKER_CONSTRAINTS |
Docker Constraints | "" |
|
DOCKER_DEFAULT_HOST_RULE |
Docker Access rule - Default: Host({{ normalize .Name }}) |
"Host({{ normalize .Name }})" |
|
DOCKER_DEFAULT_NETWORK |
Default Network for Traefik to operate on | proxy |
|
DOCKER_HTTP_TIMEOUT |
Timeout in seconds for HTTP connections | 600 |
|
ENABLE_DOCKER_SWARM_MODE |
Enable Swarm Mode | FALSE |
|
DOCKER_SWARM_MODE_REFRESH |
Swarm refresh in seconds | 15 |
|
DOCKER_EXPOSE_CONTAINERS |
Expose Containers by Default | FALSE |
| Parameter | Description | Default |
|---|---|---|
ENABLE_HTTP |
Enable HTTP Support | TRUE |
ENABLE_HTTP_FORWARDED_HEADERS |
Enable HTTP Forwarded Headers | FALSE |
HTTP_LISTEN_IP |
Address to bind for HTTP | 0.0.0.0 |
HTTP_LISTEN_PORT |
Port to bind for HTTP | 80 |
HTTP_TIMEOUT_ACCEPTGRACE |
Accept Grace Timeout | 0 |
HTTP_TIMEOUT_GRACE |
Grace Timeout | 10 |
HTTP_TIMEOUT_IDLE |
Idle Timeout | 180 |
HTTP_TIMEOUT_READ |
Read Timeout | 0 |
HTTP_TIMEOUT_WRITE |
Write Timeout | 0 |
ENABLE_COMPRESSION_HTTP |
Enable Gzip Compression | TRUE |
ENABLE_HTTP_PROXY_PROTOCOL |
Enable HTTP Proxy Protocol Support | FALSE |
ENABLE_HTTP3 |
Enable HTTP3 support | FALSE |
ENABLE_HTTPS |
Enable HTTPS Support | TRUE |
HTTP3_LISTEN_PORT |
UDP port to bind for HTTP3 | 443 |
HTTPS_ENTRYPOINT |
Name of HTTP Entrypoint | websecure |
ENABLE_HTTPS_FORWARDED_HEADERS |
Enable HTTPS Forwarded Headers | FALSE |
HTTPS_LISTEN_IP |
Address to bind for HTTP | 0.0.0.0 |
HTTPS_LISTEN_PORT |
Port to bind for HTTPS | 443 |
HTTPS_TIMEOUT_ACCEPTGRACE |
Accept Grace Timeout | 0 |
HTTPS_TIMEOUT_GRACE |
Grace Timeout | 10 |
HTTPS_TIMEOUT_IDLE |
Idle Timeout | 180 |
HTTPS_TIMEOUT_READ |
Read Timeout | 0 |
HTTPS_TIMEOUT_WRITE |
Write Timeout | 0 |
ENABLE_COMPRESSION_HTTPS |
Enable Gzip Compression | TRUE |
ENABLE_HTTPS_UPGRADE |
Automatically forward HTTP -> HTTPS | TRUE |
ENABLE_HTTPS_SNI_STRICT |
Enable Strict SNI Checking for Certificates | FALSE |
ENABLE_HTTPS_PROXY_PROTOCOL |
Enable HTTP Proxy Protocol Support | FALSE |
TRUSTED_IPS |
Use for Proxy Protocol Variables - Comma Seperated. | 127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 |
TLS_MINIMUM_VERSION |
Set TLS Minimum Version for HTTPS | VersionTLS12 |
TLS_CIPHERS |
Set Ciphers | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, |
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, |
||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, |
||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 |
| Parameter | Description | Default | _FILE |
|---|---|---|---|
ENABLE_LETSENCRYPT |
Enable LetsEncrypt Certificate Generation | TRUE |
|
LETSENCRYPT_EMAIL |
Email address to register with Letsencrypt | x | |
LETSENCRYPT_CHALLENGE |
Use HTTP, TLS, or DNS Challenges |
HTTP |
|
LETSENCRYPT_KEYTYPE |
Keytype to use EC256 EC384 RSA2048 RSA4096 RSA8192 |
RSA4096 |
|
LETSENCRYPT_SERVER |
Use PRODUCTION or STAGING server |
PRODUCTION |
|
LETSENCRYPT_STORAGE_FILE |
What file to store ACME certificates in | acme.json |
|
LETSENCRYPT_STORAGE_PATH |
What path to store ACME certificates in: /traefik/certs/ |
${DATA_PATH}/certs |
|
LETSENCRYPT_DNS_PROVIDER |
See Traefik Documentation for values if using DNS Challenge |
||
LETSENCRYPT_DNS_RESOLVER |
Comma Seperated values values if using DNS Challenge e.g. 1.1.1.1:53,1.0.0.1:53 |
||
LETSENCRYPT_DNS_CHALLENGE_DELAY |
Wait for seconds before challenging | 15 |
|
LETSENCRYPT_WILDCARD_DOMAINS |
Create wildcard domains in this comma seperated values e.g. example.com,domain.tld |
x |
If using DNS Challenges, you will need to add additional Environment Variables for your DNS servers API/credentials See Traefik Documentation.
| Parameter | Description | Default |
|---|---|---|
ENABLE_METRICS |
Enable Metrics | TRUE |
METRICS_TYPE |
Metrics Type prometheus |
prometheus |
METRICS_LISTEN_IP |
Listen IP | 0.0.0.0 |
METRICS_LISTEN_PORT |
Metrics Listen Port | 8082 |
METRICS_ENTRYPOINT |
Metrics Entrypoint | metrics |
| Parameter | Description | Default | _FILE |
|---|---|---|---|
ENABLE_API |
Enable Dashboard | TRUE |
|
ENABLE_PING |
Enable Ping test/Health Check | TRUE |
|
ENABLE_DASHBOARD |
Enable Dashboard | TRUE |
|
DASHBOARD_HOSTNAME |
Hostname to respond for Dashboard e.g. traefik.example.com |
x | |
ENABLE_DASHBOARD_AUTHENTICATION |
Enable Dashboard Authentication | TRUE |
|
DASHBOARD_ADMIN_USER |
Username for access to Dashboard | admin |
x |
DASHBOARD_ADMIN_PASS |
Password for access to Dashboard | traefik |
x |
DASHBOARD_AUTHENTICATION |
Only type is BASIC at this time |
| Parameter | Description | Default |
|---|---|---|
ENABLE_CERTIFICATE_DUMPER |
Enable Dumping of Certificates from acme.json | TRUE |
CERTIFICATE_DUMPER_PATH |
Where to put the dumped certificates | ${LETSENCRYPT_STORAGE_PATH}/dump |
CERTIFICATE_DUMPER_POST_HOOK |
optional Argument or external script to execute post dumping of certificates Where to put the dumped certificates - e.g. chmod 644 ${CERTIFICATE_DUMPER_PATH} |
|
CERTIFICATE_DUMP_SUBDIRECTORIES |
Create subdirectories of hosts | TRUE |
CLEAN_DUMP_PATH |
Clean Dump path before redumping | FALSE |
| Parameter | Description | Default |
|---|---|---|
SERVER_TRANSPORT_INSECURE_SKIP_VERIFY |
Disable Certificate verification on Server Transports | FALSE |
The following ports are exposed.
| Port | Description |
|---|---|
80 |
HTTP |
443 |
HTTPS |
Inside the image are tools to perform modification on how the image runs.
For debugging and maintenance purposes you may want access the containers shell.
docker exec -it (whatever your container name is e.g. traefik) bashWelcomed. Please fork the repository and submit a pull request for any bug fixes, features or additions you propose to be included in the image. If it does not impact my intended usage case, it will be merged into the tree, tagged as a release and credit to the contributor in the CHANGELOG.
These images were built to serve a specific need in a production environment and gradually have had more functionality added based on requests from the community.
- The Discussions board is a great place for working with the community on tips and tricks of using this image.
- Sponsor me for personalized support
- Please, submit a Bug Report if something isn't working as expected. I'll do my best to issue a fix in short order.
- Feel free to submit a feature request, however there is no guarantee that it will be added, or at what timeline.
- Sponsor me regarding development of features.
- Best effort to track upstream changes, More priority if I am actively using the image in a production environment.
- Sponsor me for up to date releases.
MIT. See LICENSE for more details.