traefik-bootstrap¶

traefik-bootstrap is a Traefik that needs nothing from another host. It stands in for traefik-agent on a host in bootstrap mode, so that the host's web interfaces answer on their real hostnames before Authentik and the Traefik hub exist.

No host lists it. The inventory lists traefik-agent, and the run swaps this stack in while the host is in bootstrap mode. See What it changes.

What it runs¶

traefik
error-pages
socket-proxy
logrotate
socket-proxy-rw

These are the same five services as traefik-basic, from the same definitions. See traefik-basic for what each does and the ports Traefik publishes.

traefik-kop is the one service of traefik-agent that is missing. A host on traefik-bootstrap publishes no route to tf01 and is reached only through its own Traefik.

The Stack in Komodo carries the host's name, such as traefik-bootstrap-id01. The project is traefik, as in every Traefik stack, so the containers are named traefik-traefik, traefik-error-pages, and so on.

How it differs from the real Traefik¶

Three values in its komodo.env make the whole difference: the TLS options, a blank certificate resolver, and the chain with no sign-in. See How traefik-bootstrap differs from the real Traefik for the values and why each is needed.

The result for the reader is a certificate the browser warns about and no sign-in in front of any web interface. See What you see in bootstrap mode.

Values it reads¶

Key	Reads	Kind	Described under
`CF_API_EMAIL`	`CF_API_EMAIL`	Secret	Traefik
`CF_DNS_API_TOKEN`	`CF_DNS_API_TOKEN`	Secret	Traefik
`LE_EMAIL`	`LE_EMAIL`	Secret	Traefik
`CROWDSEC_LAPI_HOST`	`GLOBAL_CROWDSEC_LAPI_HOST`	Variable	Traefik
`AUTHENTIK_HOST`	`GLOBAL_AUTHENTIK_HOST`	Variable	Traefik

It also reads the 19 operational defaults, as every stack does.

The stack uses none of the five. With no resolver named, nothing asks Cloudflare or Let's Encrypt for anything, and the chain it sets never forwards to Authentik. The references are still in its komodo.env, so the values have to exist before the first deploy. See the Traefik values.

What the host needs¶

The project is traefik, so the stack's folders sit under /opt/docker/volumes/traefik and /opt/docker/logs/traefik. Both are mode 0750, owned by the admin account with group 101000.

Folder	Owner	Mode
`/opt/docker/logs/traefik/traefik`	`101000:101000`	`0755`
`/opt/docker/volumes/traefik/traefik-certs`	`101000:101000`	Default
`/opt/docker/volumes/traefik/traefik-plugins`	`101000:101000`	Default

Port	Allowed from	Comment
`80/tcp`	Anywhere	Traefik HTTP
`443/tcp`	Anywhere	Traefik HTTPS
`8443/tcp`	Anywhere	Traefik HTTPS (alt)

The host's NixOS configuration creates the folders and opens the ports when the host is deployed. It reads them from the host's file in the private repo, nixos/hosts/<host>.json, which nixos-sync.yml writes from the stack's setup.yaml. See Host layout.

The folders, seed files, and ports are the same as traefik-agent's. A host that leaves bootstrap mode keeps all of them, so the Traefik that takes over needs nothing new from the host.

Hostnames¶

The dashboard answers on port 8443, under the same two names as in every Traefik stack. See traefik-basic.

Application hostnames do not change when the host leaves bootstrap mode. Only the certificate and the sign-in do.

Verify¶

In Komodo, the traefik-bootstrap-<host> Stack shows as running with five services.

On the host, list the Stack's containers. Komodo names the Compose project after the Stack, not after PROJECT_NAME:

docker compose -p traefik-bootstrap-<host> ps

Every container shows healthy in the STATUS column.

Open the dashboard in a browser, with your host in place of id01:

https://traefik.id01.home.myah-mitchell.com:8443

Note

In bootstrap mode the browser warns about the certificate. Traefik serves its own self-signed one until the host leaves bootstrap mode, so accept the warning for now.

The dashboard loads with no sign-in. Under HTTP Routers it lists a route for each web interface the host's other stacks serve.

Removing it¶

The run never deletes a Stack. After a host leaves bootstrap mode, its traefik-bootstrap Stack is deleted by hand in Komodo, before traefik-agent deploys, because both bind ports 80, 443, and 8443. See Leaving bootstrap mode.

Not yet confirmed¶

Traefik serving its self-signed certificate when the resolver name is blank follows its documentation. It has not been checked on a host. See Bootstrap mode.