Deploying Your Container with HTTPS Using Traefik as a Reverse Proxy

Introduction

In the modern landscape of web applications and services, ensuring secure and efficient traffic routing is crucial. Reverse proxies play a pivotal role in handling incoming requests, enabling SSL termination, and load balancing, all while enhancing the overall security and scalability of your infrastructure. One of the most popular and feature-rich reverse proxies is Traefik.

In this blog post, we'll delve into the world of Traefik and explore how to set it up as a powerful reverse proxy. Whether you're managing a single service or a complex microservices architecture, Traefik offers an easy-to-configure and flexible solution that can adapt to your requirements.

What is Traefik?

Traefik is a modern reverse proxy and load balancer that seamlessly integrates with container orchestration platforms like Docker and Kubernetes. It is based on the concept of EntryPoints, Routers, Middlewares, and Services. This modular approach allows Traefik to provide dynamic configuration, automatic service discovery, and support for multiple backends and protocols.

⚡ Key Features of Traefik ⚡

• Dynamic Configuration: Traefik's dynamic configuration allows changes to your services to trigger automatic updates without manual intervention, making it highly adaptive and easy to manage.

• Automatic Service Discovery: Traefik automatically discovers services running in containers without requiring manual configuration, saving you time and effort in managing routing rules.

• SSL Termination: Traefik can handle SSL certificates, making it effortless to secure your services with HTTPS. It can automatically request and renew Let's Encrypt certificates for your domains.

• Load Balancing: It distributes incoming requests across multiple instances of a service to ensure optimal utilization and high availability.

• Middleware Support: Traefik supports middleware plugins, allowing you to add additional functionalities like authentication, rate limiting, and more, directly in the routing pipeline.

• Web Dashboard and API: Traefik provides a user-friendly dashboard and API for monitoring and configuration management, making it convenient to keep an eye on the overall system status.

Traefik Concepts

Traefik operates on the following core concepts:

• EntryPoints: EntryPoints are the network entry points into Traefik. They define the port that will receive the packets and whether to listen for TCP or UDP traffic.

• Routers: A router is in charge of connecting incoming requests to the services that can handle them based on defined rules. Routers match incoming requests with specific conditions (such as host, path, or header values) and route them to the appropriate service.

• Middlewares: Middlewares are attached to routers and can modify requests or responses before they are sent to your service. They enable you to apply various transformations, authentication, and rate-limiting rules.

• Services: Services are responsible for configuring how to reach the actual services that will eventually handle the incoming requests.

Setting Up Traefik with Docker Compose 🐳

To demonstrate the deployment of Traefik as a reverse proxy, we'll use Docker Compose, which simplifies the process of defining and running multi-container Docker applications.

Prerequisites:

• Docker installed on your server or development environment.
• A domain name with DNS configured to point to your server's IP address.

Step 1: Create a Docker Compose File 👩‍💻

Create a new file named docker-compose.yaml and open it in a text editor. We'll define our Traefik service with the necessary configurations in this file.

version: "3"

services:
  traefik:
    image: traefik:v2.10
    command:
      - --api
      - --providers.docker
      - --entrypoints.web.address=:80
      - --entrypoints.traefikapi.address=:8080
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --certificatesresolvers.myresolver.acme.tlschallenge=true
      - --certificatesresolvers.myresolver.acme.email=[e-mail]
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
    ports:
      # The HTTP port
      - "80:80"
      # The HTTPS port
      - "443:443"
      # The Traefik Dashboard & API port
      - "8080:8080"
    restart: unless-stopped
    volumes:
      # Traefik can listen to the Docker events
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      # acme.json should be created on host instance
      - "./acme.json:/letsencrypt/acme.json"
    labels:
      # Traefik Dashboard HTTP with BasicAuth
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`your_domain.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      - "traefik.http.routers.traefik.entrypoints=traefikapi"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=your_admin_user:your_hashed_admin_password"

  user-api-backend:
    image: your_user_api_image:latest
    labels:
      #  HTTPS YOUR APP
      - "traefik.enable=true"
      - "traefik.http.routers.user-api-backend.rule=Host(`your_domain.com`)"
      - "traefik.http.routers.user-api-backend.entrypoints=websecure"
      - "traefik.http.routers.user-api-backend.tls=true"
      - "traefik.http.routers.user-api-backend.tls.certresolver=myresolver"
      - "traefik.http.services.user-api-backend.loadbalancer.server.port=3000" # YOUR APP PORT

Explanation

Traefik Service: We define a service named traefik using the official Traefik image with version 2.10 (you can replace this with the latest version available).

• command: The command section configures Traefik with necessary options, including enabling the API, using the Docker provider for dynamic service discovery, and defining entry points for HTTP, HTTPS, and the Traefik dashboard.
• ports: The ports section maps the ports 80, 443, and 8080 from the host to the corresponding ports in the Traefik container, allowing external access to these ports.
• volumes: The volumes section includes two volume mounts. The first one (/var/run/docker.sock:/var/run/docker.sock:ro) allows Traefik to listen to Docker events and dynamically update its configuration when new services are created or removed. The second volume (./acme.json:/letsencrypt/acme.json) mounts an acme.json file from the host to store SSL certificates obtained from Let's Encrypt for HTTPS termination.

• labels:The labels section contains additional configurations for Traefik:

  • traefik.enable=true enables Traefik for this service, allowing it to handle incoming traffic.
  • traefik.http.routers.traefik.rule=Host('your_domain.com') && (PathPrefix('/api') || PathPrefix('/dashboard')) defines the routing rule for this service. Requests with the host your_domain.com and paths starting with /api or /dashboard will be routed to Traefik, allowing access to the Traefik dashboard and API.
  • traefik.http.routers.traefik.entrypoints=traefikapi specifies that the Traefik dashboard and API should be accessible through the traefikapi entrypoint, which is configured in the global entrypoints section.
  • traefik.http.routers.traefik.service=api@internal designates the service api@internal for this router, which points to Traefik's internal API service.
  • traefik.http.routers.traefik.middlewares=auth associates the auth middleware with this router.
  • traefik.http.middlewares.auth.basicauth.users=your_admin_user:your_hashed_admin_password sets up Basic Authentication for the Traefik dashboard. Replace your_admin_user with the desired admin username and your_hashed_admin_password with the hashed password (generated using a tool like htpasswd).

user-api-backend Service: We've added a service named user-api-backend, which represents your user API backend running in a separate container.

• image: In this section, replace your_user_api_image with the actual name of the image containing your user API backend.

• labels: The labels section configures Traefik to handle incoming traffic for the user API backend service.

  • traefik.enable=true enables Traefik for this service, allowing it to handle incoming traffic for this container.
  • traefik.http.routers.user-api-backend.rule=Host('your_domain.com') defines the routing rule for this service. Requests with the host your_domain.com will be routed to this user API backend service.
  • traefik.http.routers.user-api-backend.entrypoints=websecure specifies that this service should be accessible through the websecure entrypoint, which handles HTTPS traffic.
  • traefik.http.routers.user-api-backend.tls=true enables TLS/SSL termination for this service, allowing secure HTTPS communication.
  • traefik.http.routers.user-api-backend.tls.certresolver=myresolver specifies the certificate resolver to use for this service, which is the same myresolver used for Traefik itself.
  • traefik.http.services.user-api-backend.loadbalancer.server.port=3000 indicates that the user API backend service listens on port 3000 within the container. Adjust this port number based on your application's configuration.

Remember to replace placeholders like your_domain.com, [e-mail], your_admin_user, your_hashed_admin_password, and your_user_api_image with your actual values for a fully functional and secure Traefik setup.

Step 2: Deploy Traefik 🚀

Save the docker-compose.yaml file and deploy Traefik using Docker Compose:

docker-compose up -d

🚀 Traefik will start running as a reverse proxy, ready to handle incoming requests and provide SSL termination for your services. 🚀

Accessing the Traefik Dashboard

To access the Traefik dashboard and monitor its activity, visit http://your_domain.com:8080/dashboard/#/ in your web browser. You'll be prompted to enter the admin credentials you set in the docker-compose.yaml file.

Conclusion

Traefik is a versatile and powerful reverse proxy that simplifies traffic routing, SSL termination, and load balancing for your services. By setting up Traefik with Docker Compose, you can easily manage and scale your infrastructure, ensuring seamless access and security for your applications.