Skip to content

Commit 70c24a7

Browse files
l4rm4ndl4rm4nd
committed
chore: use socket-proxy for traefik
1 parent 7987eb8 commit 70c24a7

File tree

3 files changed

+75
-39
lines changed

3 files changed

+75
-39
lines changed

‎examples/traefik/docker-compose-command-config.yml‎

Lines changed: 51 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -8,41 +8,42 @@ services:
88
container_name: traefik
99
restart: always
1010
command:
11-
- --providers.docker=true # enable docker provider
12-
- --providers.docker.network=proxy # define default network to monitor for docker provider
13-
- --providers.docker.exposedbydefault=false # do not expose docker hosts per default
14-
- --providers.file.watch=true # monitor file provider for changes
15-
- --providers.file.filename=/etc/traefik/fileConfig.yml # location of the dynamic configuration
16-
- --entrypoints.http.address=:80 # entrypoint for unencrypted http
17-
- --entrypoints.http.forwardedHeaders.trustedIPs=103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,104.16.0.0/13,104.24.0.0/14,108.162.192.0/18,131.0.72.0/22,141.101.64.0/18,162.158.0.0/15,172.64.0.0/13,173.245.48.0/20,188.114.96.0/20,190.93.240.0/20,197.234.240.0/22,198.41.128.0/17,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32 # define cloudflare ip ranges as trusted
18-
- --entrypoints.http.http.redirections.entryPoint.to=https # automatic redirect from http to https
19-
- --entrypoints.http.http.redirections.entryPoint.scheme=https # automatic redirect from http to https
20-
- --entrypoints.https.address=:443 # entrypoint for encrypted https
21-
- --entrypoints.https.forwardedHeaders.trustedIPs=103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,104.16.0.0/13,104.24.0.0/14,108.162.192.0/18,131.0.72.0/22,141.101.64.0/18,162.158.0.0/15,172.64.0.0/13,173.245.48.0/20,188.114.96.0/20,190.93.240.0/20,197.234.240.0/22,198.41.128.0/17,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32 # define cloudflare ip ranges as trusted
22-
- --entrypoints.https.http.middlewares=security-headers@file,rate-limit@file # define default middlewares for all proxy entries
23-
- --api.dashboard=true # enable traefik api dashboard
24-
- --api.insecure=true # expose traefik api dashboard on TCP/8080 without need for router
11+
- "--providers.docker=true" # enable docker provider
12+
- "--providers.docker.network=proxy" # define default network to monitor for docker provider
13+
- "--providers.docker.endpoint=tcp://socket-proxy:2375" # define socket-proxy as docker socket
14+
- "--providers.docker.exposedbydefault=false" # do not expose docker hosts per default
15+
- "--providers.file.watch=true" # monitor file provider for changes
16+
- "--providers.file.filename=/etc/traefik/fileConfig.yml" # location of the dynamic configuration
17+
- "--entrypoints.http.address=:80" # entrypoint for unencrypted http
18+
- "--entrypoints.http.forwardedHeaders.trustedIPs=103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,104.16.0.0/13,104.24.0.0/14,108.162.192.0/18,131.0.72.0/22,141.101.64.0/18,162.158.0.0/15,172.64.0.0/13,173.245.48.0/20,188.114.96.0/20,190.93.240.0/20,197.234.240.0/22,198.41.128.0/17,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32" # define cloudflare ip ranges as trusted
19+
- "--entrypoints.http.http.redirections.entryPoint.to=https" # automatic redirect from http to https
20+
- "--entrypoints.http.http.redirections.entryPoint.scheme=https" # automatic redirect from http to https
21+
- "--entrypoints.https.address=:443" # entrypoint for encrypted https
22+
- "--entrypoints.https.forwardedHeaders.trustedIPs=103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,104.16.0.0/13,104.24.0.0/14,108.162.192.0/18,131.0.72.0/22,141.101.64.0/18,162.158.0.0/15,172.64.0.0/13,173.245.48.0/20,188.114.96.0/20,190.93.240.0/20,197.234.240.0/22,198.41.128.0/17,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32" # define cloudflare ip ranges as trusted
23+
- "--entrypoints.https.http.middlewares=security-headers@file,rate-limit@file" # define default middlewares for all proxy entries
24+
- "--api.dashboard=true" # enable traefik api dashboard
25+
- "--api.insecure=true" # expose traefik api dashboard on TCP/8080 without need for router
2526
####################################################
2627
# !!! ADJUST TO YOUR INFRASTRUCTURE SETUP BELOW !!!!
27-
- --entrypoints.https.http.tls.certresolver=myresolver # define default cert resolver
28-
- --entrypoints.https.http.tls.domains[0].main=example.com # define main domain, change to your domain
29-
- --entrypoints.https.http.tls.domains[0].sans=*.example.com # define sans domain, change to your domain
30-
- [email protected] # define your email address
31-
#- --certificatesresolvers.myresolver.acme.httpchallenge=true # use http challenge
32-
#- --certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=http # define entrypoint for http challenge
33-
- --certificatesresolvers.myresolver.acme.dnschallenge=true # enable dns challenge to obtain wildcard certificates
34-
- --certificatesresolvers.myresolver.acme.dnschallenge.provider=cloudflare # define provider for certificates
35-
- --certificatesresolvers.myresolver.acme.storage=/etc/traefik/acme.json # define acme path for certificate information
36-
- --certificatesresolvers.myresolver.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53 # define dns servers for your resolver, here cloudflare
28+
- "--entrypoints.https.http.tls.certresolver=myresolver" # define default cert resolver
29+
- "--entrypoints.https.http.tls.domains[0].main=example.com" # define main domain, change to your domain
30+
- "--entrypoints.https.http.tls.domains[0].sans=*.example.com" # define sans domain, change to your domain
31+
- "[email protected]" # define your email address
32+
#- "--certificatesresolvers.myresolver.acme.httpchallenge=true" # use http challenge
33+
#- "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=http" # define entrypoint for http challenge
34+
- "--certificatesresolvers.myresolver.acme.dnschallenge=true" # enable dns challenge to obtain wildcard certificates
35+
- "--certificatesresolvers.myresolver.acme.dnschallenge.provider=cloudflare" # define provider for certificates
36+
- "--certificatesresolvers.myresolver.acme.storage=/etc/traefik/acme.json" # define acme path for certificate information
37+
- "--certificatesresolvers.myresolver.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53" # define dns servers for your resolver, here cloudflare
3738
####################################################
38-
- --log.level=INFO # enable log level
39-
- --accesslog=true # enable access logs
40-
- --accesslog.filepath=/logs/traefik.log # define access log path
41-
- --accesslog.format=json # set access log format to json instead clm
42-
- --accesslog.bufferingsize=0 # set access log buffer size to 0
43-
- --accesslog.filters.statuscodes=400-599 # only log http errors in logs; alternatively set 200-599 to include successful http requests
44-
- --accesslog.fields.headers.defaultmode=drop # drop all headers
45-
- --serversTransport.insecureSkipVerify=true # set insecureSkipVerify to true to allow self-signed certificates
39+
- "--log.level=INFO" # enable log level
40+
- "--accesslog=true" # enable access logs
41+
- "--accesslog.filepath=/logs/traefik.log" # define access log path
42+
- "--accesslog.format=json" # set access log format to json instead clm
43+
- "--accesslog.bufferingsize=0" # set access log buffer size to 0
44+
- "--accesslog.filters.statuscodes=400-599" # only log http errors in logs; alternatively set 200-599 to include successful http requests
45+
- "--accesslog.fields.headers.defaultmode=drop" # drop all headers
46+
- "--serversTransport.insecureSkipVerify=true" # set insecureSkipVerify to true to allow self-signed certificates
4647
labels:
4748
- traefik.enable=true # enable traefik
4849
- traefik.http.routers.api.rule=Host(`traefik.example.com`) # define subdomain for the traefik api dashboard
@@ -67,7 +68,25 @@ services:
6768
- host.docker.internal:172.17.0.1 # define internal ip; helps traefik to resolve containers running in host network mode
6869
networks:
6970
- proxy # define traefik docker network
71+
- docker-proxynet
72+
73+
socket-proxy:
74+
image: lscr.io/linuxserver/socket-proxy:1.26.2
75+
container_name: socket-proxy
76+
environment:
77+
- CONTAINERS=1
78+
- EVENTS=1
79+
volumes:
80+
- /var/run/docker.sock:/var/run/docker.sock:ro
81+
networks:
82+
- docker-proxynet
83+
restart: always
84+
read_only: true
85+
tmpfs:
86+
- /run
7087

7188
networks:
7289
proxy:
7390
external: true
91+
docker-proxynet:
92+
internal: true

‎examples/traefik/docker-compose.yml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ services:
1414
- 443 # https
1515
- 8080 # http api dashboard
1616
volumes:
17-
- /var/run/docker.sock:/var/run/docker.sock:ro # ro = read-only access to the docker.sock
17+
#- /var/run/docker.sock:/var/run/docker.sock:ro # better use socket-proxy instead
1818
- ${DOCKER_VOLUME_STORAGE:-/mnt/docker-volumes}/traefik:/etc/traefik/ # put the provided traefik.yml and fileConfig.yml files at this location
1919
- ${DOCKER_VOLUME_STORAGE:-/mnt/docker-volumes}/traefik/logs:/logs
2020
environment:
@@ -30,7 +30,25 @@ services:
3030
- host.docker.internal:172.17.0.1
3131
networks:
3232
- proxy
33+
- docker-proxynet
34+
35+
socket-proxy:
36+
image: lscr.io/linuxserver/socket-proxy:1.26.2
37+
container_name: socket-proxy
38+
environment:
39+
- CONTAINERS=1
40+
- EVENTS=1
41+
volumes:
42+
- /var/run/docker.sock:/var/run/docker.sock:ro
43+
networks:
44+
- docker-proxynet
45+
restart: always
46+
read_only: true
47+
tmpfs:
48+
- /run
3349

3450
networks:
3551
proxy:
3652
external: true
53+
docker-proxynet:
54+
internal: true

‎examples/traefik/traefik.yml‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ entryPoints:
5959
address: :80
6060
forwardedHeaders:
6161
trustedIPs: &trustedIps
62-
# Start of Clouflare public IP list for HTTP requests, remove this if you don't use it; https://www.cloudflare.com/de-de/ips/
62+
# start of Clouflare public IP list for HTTP requests, remove this if you don't use it; https://www.cloudflare.com/de-de/ips/
6363
- 103.21.244.0/22
6464
- 103.22.200.0/22
6565
- 103.31.4.0/22
@@ -82,7 +82,7 @@ entryPoints:
8282
- 2405:8100::/32
8383
- 2a06:98c0::/29
8484
- 2c0f:f248::/32
85-
# End of Cloudlare public IP list
85+
# end of Cloudlare public IP list
8686
http:
8787
redirections:
8888
entryPoint:
@@ -93,7 +93,7 @@ entryPoints:
9393
https:
9494
address: :443
9595
forwardedHeaders:
96-
# Reuse list of Cloudflare Trusted IP's above for HTTPS requests
96+
# reuse list of Cloudflare Trusted IP's above for HTTPS requests
9797
trustedIPs: *trustedIps
9898
# enable HTTP3 QUIC via UDP/443
9999
#http3:
@@ -122,9 +122,8 @@ providers:
122122
# Docker provider for connecting all apps that are inside of the docker network
123123
docker:
124124
watch: true
125-
network: proxy # Add Your Docker Network Name Here
126-
#endpoint: "tcp://socket-proxy:2375"
127-
# Default host rule to containername.domain.example
125+
network: proxy # add Your Docker Network Name Here
126+
endpoint: "tcp://socket-proxy:2375" # use socket-proxy for secure access to docker api
128127
defaultRule: "Host(`{{ index .Labels \"com.docker.compose.service\"}}.example.com`)" # change 'example.com' to your proxy domain
129128
exposedByDefault: false
130129

0 commit comments

Comments
 (0)