traefik-basic¶
traefik-basic is Traefik with the four helpers it needs, and nothing that depends on another host. It is a building block. No host lists it, and traefik-agent includes it and adds the route publisher.
Every Traefik stack in the fleet runs the five services on this page, so the other Traefik pages describe only what they add.
What it runs¶
| Service | Does |
|---|---|
traefik |
Terminates TLS and routes requests to the containers on the proxy network |
error-pages |
Serves the page for any response from 400 to 599, and answers a hostname no route matches |
socket-proxy |
Gives Traefik a filtered, read-only view of the Docker API, which is how it finds containers |
socket-proxy-rw |
A second proxy that also allows POST, for logrotate alone |
logrotate |
Rotates Traefik's access log, then signals Traefik to open a new file |
The project is traefik in every Traefik stack, so the containers have the same names on every host: traefik-traefik, traefik-error-pages, and so on. A host runs one Traefik stack, so the names never collide.
Traefik publishes three ports on the host.
| Port | Entrypoint | Serves |
|---|---|---|
| 80 | http |
A redirect to HTTPS, for every request |
| 443 | https |
Every application route |
| 8443 | dashboard |
Traefik's own dashboard |
logrotate checks the log every five minutes. It rotates weekly, or sooner when the file reaches 50 MB, and keeps three old copies.
The rules it ships with¶
Traefik reads its middlewares and TLS options from files in containers/traefik/rules in fleet-stacks. A middleware is a step a request passes through before it reaches a container, and a chain is several of them in a fixed order. A route names one of two chains.
| Chain | Applies |
|---|---|
chain-no-auth@file |
Rate limiting, secure headers, and compression |
chain-authentik@file |
The same three, then a forward to Authentik for a sign-in |
The forward goes to the host named in AUTHENTIK_HOST. The rate limit is an average of 100 requests a second, with a burst of 50.
A stack picks its chain through TRAEFIK_AUTH_CHAIN, and a blank value takes chain-authentik@file. See Bootstrap mode for when the run sets it.
Values it reads¶
| Key | Reads | Kind | Described under |
|---|---|---|---|
CF_API_EMAIL |
CF_API_EMAIL |
Secret | Traefik |
CF_DNS_API_TOKEN |
CF_DNS_API_TOKEN |
Secret | Traefik |
LE_EMAIL |
LE_EMAIL |
Secret | Traefik |
CROWDSEC_LAPI_HOST |
GLOBAL_CROWDSEC_LAPI_HOST |
Variable | Traefik |
AUTHENTIK_HOST |
GLOBAL_AUTHENTIK_HOST |
Variable | Traefik |
It also reads the 19 operational defaults, as every stack does.
All five are created before the first host is built. See the Traefik values.
CROWDSEC_LAPI_HOST is carried and not used. The bouncer plugin's lines are commented out in the Traefik service.
What the host needs¶
The project is traefik, so the stack's folders sit under /opt/docker/volumes/traefik and /opt/docker/logs/traefik. Both are mode 0750, owned by the admin account with group 101000.
| Folder | Owner | Mode |
|---|---|---|
/opt/docker/logs/traefik/traefik |
101000:101000 |
0755 |
/opt/docker/volumes/traefik/traefik-certs |
101000:101000 |
Default |
/opt/docker/volumes/traefik/traefik-plugins |
101000:101000 |
Default |
| Port | Allowed from | Comment |
|---|---|---|
80/tcp |
Anywhere | Traefik HTTP |
443/tcp |
Anywhere | Traefik HTTPS |
8443/tcp |
Anywhere | Traefik HTTPS (alt) |
The host's NixOS configuration creates the folders and opens the ports when the host is deployed. It reads them from the host's file in the private repo, nixos/hosts/<host>.json, which nixos-sync.yml writes from the stack's setup.yaml. See Host layout.
The log folder is mode 0755 because logrotate refuses to rotate a file inside a folder that a group can write to.
system-agent's vector reads the access log from that same folder. See system-agent.
Hostnames¶
The dashboard answers on port 8443 only. With the host id01, the sub-domain home., and the domain myah-mitchell.com, its names are:
| Hostname | Comes from |
|---|---|
traefik.id01.home.myah-mitchell.com |
TRAEFIK_HOSTNAME on the host |
id01.home.myah-mitchell.com |
The host's own name |
The dashboard route uses the chain in TRAEFIK_AUTH_CHAIN, as every application route does.
Verify¶
No host lists traefik-basic, so these checks apply only where you deploy it yourself. On every host in the plan, use the checks on traefik-agent or traefik-bootstrap.
In Komodo, the traefik-basic Stack shows as running with five services.
On the host, list the Stack's containers. Komodo names the Compose project after the Stack, not after PROJECT_NAME:
Every container shows healthy in the STATUS column.
Open the dashboard in a browser, with your host in place of id01:
The dashboard asks for a sign-in through Authentik, unless TRAEFIK_AUTH_CHAIN is set to chain-no-auth@file.
How the Traefik stacks build on it¶
Four of the five Traefik stacks form a chain, each including the one before it and adding to it. See How the Traefik stacks relate for the same chain as a diagram, with the hosts that run each.
| Stack | Is |
|---|---|
| traefik-basic | The five services above |
| traefik-agent | traefik-basic and traefik-kop |
| traefik-server | traefik-agent and the Redis every host publishes to |
| traefik-dmz | traefik-agent, a replica of that Redis, and cloudflared |
traefik-bootstrap is outside the chain. It defines the same five services itself, under a second name for the Traefik service, which is how it gets different values in its komodo.env.
Data worth keeping¶
Folder under /opt/docker/volumes/traefik |
Holds |
|---|---|
traefik-certs |
acme.json, with the Let's Encrypt account and every certificate issued to it |
Losing the file costs a new certificate request on the next start, which counts against Let's Encrypt's rate limits.