Is this the BEST Reverse Proxy for Docker? // Traefik Tutorial
ฝัง
- เผยแพร่เมื่อ 10 มิ.ย. 2024
- Is Traefik the best reverse proxy for Docker? Let's find out in this Tutorial! I explain what reverse proxies and load balancers are. We're setting up Traefik on my Docker Host and expose a simple NGINX web server.
Teleport-*: goteleport.com/thedigitallife
Related Videos/Links
• Kubernetes explained s...
________________
💜 Support me and become a Fan!
→ christianlempa.de/patreon
💬 Join our Community!
→ christianlempa.de/discord
________________
Read my Tech Documentation
christianlempa.de/docs
My Gear and Equipment-*
christianlempa.de/kit
________________
Timestamps:
00:00 - Introduction
00:59 - Why use Traefik?
02:01 - Load balancers and reverse proxies
03:20 - Use cases
04:38 - Deploy and Configure Traefik on Docker
11:09 - Expose a simple NGINX Webserver
15:37 - Traefik SSL Certs Letsencrypt
17:37 - HTTP to HTTPS Redirection
19:38 - Staging and Production Certs
21:02 - What's coming next?
________________
All links with "*" are affiliate links.
#Traefik #Docker #Letsencrypt
![CAMPปลิ้น | EP.76[1/2] โจโฉเปิดป่าโหดรับโอ๊ต-ป๊อบ รอบนี้พี่เอาจริง!](http://i.ytimg.com/vi/pNg5O7Pf-a0/mqdefault.jpg)
![[TH] VCT Masters Shanghai Playoffs - Grand Finals // GEN vs TH](http://i.ytimg.com/vi/HL-hhLrtctw/mqdefault.jpg)
Cheers Christain, I have recently forced myself to build up my Home lab and your videos are absolutely amazing. I dont normally leave a comment but Traefik has been a bit of a mind melting beast so i thought I need to share my appreciation here :p
This is a perfect tutorial and speed, thanks dude. You hit the important points quickly. Too many tutorials and overviews are 30-60+ minutes. Not sure who has that kind of time to watch. Usually we’re trying to quickly solve a problem. We may not need to become an Uber infrastructure expert, but need to learn enough quickly to solve problems and know where to keep ourselves out of trouble. Thanks again!
Thank you bro!
Plenty of us have the time. 💀💀💀💀💀😂😂 The average person, unlike me nowadays, spends hours a day on social media, and builds up extra anxiety, depression, etc. 😂💀🙊🤓
The only point I don't understand is how to install Portainer with it because it seems like he has installed it before installing Traefik. And I don't know how he got this with a SSL cert and the domain working...
@@chibiichen
I believe you should just add the same labels in the portainer docker compose file - obviously you will need to change the host label to point to your portainer
Awsome video explaining a very complex topic. Struggled for setting up traefik for some weeks, so this was what i was looking for. Alot of good info here.. Keep it up!
Great starter video, it really helped me move from NPM to Traefik - thanks Christian and Merry Christmas! 🙂
Hi Christian, great content,helped me a lot! About exchanging certs from staging to production - normally you don't do this, because you have separate containers for staging and production, also two different routes/domains for these service. Thanks a lot for your great job!
Still not decided between Traefik and NPM? Watch this 😜 -> th-cam.com/video/scrtJ1U4wJU/w-d-xo.html
oh my goodness! I saw quite a lot of similar tutorial, this one is the simplest and the most understandingable video I have even seen!
Thank you so much :)
Awesome! Exactly what I was looking for. Best traefik totorial I found so far! Thank you!
Thank you so much :)
I use traefik but nginx is way easier. Thanks again my bald online friend.
Haha, you're welcome
my nginx reverse proxy won't make the ssl :// kinda queless
I agree,, nginx is much easier, simple and powerful
Nginx won't give me let's encrypt certs or even just act as a reverse proxy, it sucks
@@OverAndOverAndOver you actually want Nginx Proxy Manager for that - it certainly does ssl certs, custom ports, access rules, custom paths, etc. But it's advanced configs is a bit difficult.
Well done mate. I was waiting with networking for too long with my app built on microservices. Your video was great entrypoint!
This was a seriously great video. Thank you so much for this! Love the content.
Thank you so much! ;)
Great work. Thank you very much for all the knowledge sharing!
Glad it was helpful!
Thanks for the video =)
Managed to setup Traefik with a bunch of other containers (e.g. portainer, pihole) by watching this video.
Really one of the best guides on this subject. Thanks! Would love to see a way to secure the traefik dash natively (without teleport)
Thanks! There will be something new coming ;)
Awesome video! Thank you for sharing you knowledge with us 👍
Thank you! 😉
Thanks for the tutorial Christian! I can understand you perfectly fine, you do not need to slow down.
Thank you for watching :)
honestly this tutorial is just incredibly good!
Glad you think so!
Super useful.
Thanks man !!
Lifesaver. You're so good at what you do. BTW I love how you pronounce the word "container". 😊
Thanks mate ;)
Best explanation I’ve found. Instant subscribe!
Thank you bro :)
Thank you for this tutorial! Did you also managed to get multiple simple docker hosts controlled by traefik without using something like e.g. docker swarm?
Best Video Tutorial Ever Seen On Traefik Proxy.
Wow, thanks!
thanks for sharing! Love it :)
You're welcome :D
damn bro, you're hella fast! thanks for sharing some of your skillz!
Christian, I really love these tutorials, I only mis a few topics here for traefik.
These are:
Access list
External application (via dynamic yml file)
Hope you can address these maybe in a next video. Keep up the good work!
Btw I’m running traefik now thanks to your latest nginx “little projects” video. Cost me 6 days because the traefik config file cannot handle tabs but only spaces…. Yeah😂
Thanks, you made this look easy! =)
Thank you! :)
Great stuff!
Fantastic Tutorial!
Thank you so much :)
Great video... And THANK YOU for properly referring to /etc/ as etcetera and not as Etsy
its extra terrestrial conf... everybody knows that!!!
Slightly off topic question but what software do you use for your drawing/blur effect in the video?
Thanks, Chris for this wonderful video. I can now sleep peacefully 😊
Haha you’re welcome ☺️
Awesome video! Does anyone know how to add a 2nd web server so it's load balanced? I duplicated my 1st web server container with a different name but Traefik treats it as a separate service. I have been reading through their documentation but haven't been able to figure it out.
Very useful 👌
Thanks a lot
Great and usefull video, thanks a lot!
You're welcome 😀
Hello! thank you for your great youtube content, I would like to use traefik for the first time, and I want to keep my legacy services that are not in containers (no docker), is it possible to set up DNS challenge with cloudflare for this setup? I mean without any configuration related to docker? I have not found any docs, tutorials that can help me, should I put the api token from cloudflare in a linux environment variable? thank you!
Haha, I wish I had this video like 3 weeks ago. Took me around 3 days to fully understand how Traefik works, but it's one of the best reverse proxies I have used and fully recommend to anyone. I myself use something called Authelia, definitely not as complicated as Teleport but does provide SSO for your services on a much smaller scale Although the learning curve is high, it's well worth it. Great tutorial man, really enjoyed this one.
Thank you! Yeah I can feel you, took me a few days as well to understand it :D
"You could now just wait for a 90 days HAHA" - that's probably the best part xD
:D
Looks like I'm gonna migrate from my freshly set up NPM to Traefik today :') Thanks for putting this on my radar!
Nice! Good luck then 😁
Great video, but can I also use traefik to get certificates from my local services without having an external dns pointing to it?
I just love traefik. Just have labels in your docker compose and instantly get an ssl secured subdomain for the application you run.
Can you not have the traefik docker install route to services on your local network outside of its docker network? Some of my services are just running in separate VMs instead of containers.
Thank you very mach!
Was using traefik but now I switched to caddy.
For simple configuration is easier.
For complex configuration is easier.
Hi thanks for the tutorial, do you have a website that categories all your videos?
This is probably a silly question, but Traefik can handle reverse-proxying for things that aren't Docker/K8s containers right? All of my services run in a bunch of Proxmox nodes, and while I do have quite a few services that are in docker containers, a pretty significant amount of them are also LXCs that run through Proxmox as well.
I currently use Nginx Proxy Manager, but I'm finding that there are often times where I feel the configuration I need goes against the grain of what it's designed for, and I'd also like to maybe start doing some automation as well and I've heard Traefik's API is quite nice (whereas NPM does have an API that the dashboard consumes, but it's not well documented at all) so Traefik seems to be shaping up to be a pretty decent candidate to replace NPM for me so long as I can just tell it "When you get a request at this host, redirect it to this IP + Port".
Amazing video , It did worked a 100% , Now i want to route traffic to my old server . How i do that ? Do I set up an htpp provider ? your help is greatly appreciated
Danke Christian! Question, maybe basic, so sorry if so. So, say I deploy a Linode Linux server, then put Docker on it and install Portainer to manage the docker. Then I run through this tutorial to put a get Traefix setup as a container. How can I put Portainer behind Traefik? Or do I need to? Thanks again
In this tutorial, Is portioner itself being resolved though Traefik or is Portainer just a container with no SSL?
Thanks!
Thank you for your support :)
Compered to NPM this is a pretty complicated install but worth doing for some considering NPM has some issues.
Nice work sir, one day I will take the time to learn how to do this, for now I will stick with NPM.
What issues does NPM have?
@@chibiichen The biggest one, which ive found out only today while trying to use it with docker swarm, is that the webUI still doesn't have support for loadbalanced upstreams. It was first submitted as a missing feature on the github 4 years ago, cited as coming with v3 which is still nowhere to be seen. As things stand, if I want to run my docker swarm setup through NPM, i'd have to manually edit configuration files any time I want to add or remove a service, which then breaks any time I make changes. The fact this feature was put off, saved for v3, which still hasn't come after all this time is a major reason for moving away.
Is it true, that I should add a treafik network to every stack I got in portainer to got access to use it with other containers in portainer?
thank you
hi Christian thanks for the great content i follow the tutorial but unfortunately i got error 404 page not found and i did the || label but got same error
I have a question related to using traefik with kubernetes. So at home I have a k3s cluster with 2 raspis where i would like to run some application ans theres also a Synology NAS which exposes some services aswell.
I'm quite new to the whole networking stuff so I'm trying to figure out how to setup traefik the best way. If its setup inside kubernetes for example would it still be possible to route incomming traffic to other machines in the network such as the NAS?
great job, thank you
Thank you too!
Love you my, friend, like and comment done!!
Thanks!
Hello, great video! if i have more then one node, can i use the same traefik for all nodes somehow? :D
Hello Christian,
I had a question about the routes. When I have a standalone OpenVPN server on the network and I want to route it through Traffik, it doesn't work. Do you know how to approach this problem? First of all OVPN can be accessed via TCP or UDP. I would be glad about a feedback.
Gr8 video mate i would do the example
So, do i need to portforward the ports 80 and 443 from my internet router to the docker host where traefik is running?
Very good video and tutorial. I have a pfsense router in front of my Truescale server. so now I am confused wherethe reverse proxy should be configured and how to do that and still pass traffic through the pfsense router. Can you help / or do another video as this is a very common setup and confusing where the certificates all go. I would like to use a wild card certificate on both the Pfsense and Truescale servers
Thanks for this excellent video. I watch it at speed rate of 0,75 to follow it. 😁
But it is interesting actually and I want also apply this for my TrueNas server.
Great video. If I want to set it up only on local network, do I still need to buy a domain? I assume using a local dns server would solve it without a domain.
Thanks! No you don't need to buy a domain, when it's local, but you'll need to mess around with self-signed certs then, I guess. Might be not as straightforward, but possible. Btw I'm also using self-signed certs locally.
Why does your Portainer dashboard look nicer and have more options than mine? And it doesn't say if it's CE or BE?
sir please do a video on hosting multiple websites with docker & nginx using subdomains
like your clip, plan to switch and your clip helped a little along the way. But what I haven't find a answer if i have have several different servers. lets say a web server which is pure server and another docker server different machine. etc..
Would appreciate it if you could make one that also points to other servers in the same network.
Christian, how do u do traefik labels when a container uses multiple ports e.g.
6060:80
3262:8080
4363:9354
And then there is also the possibility of a multiple container images in the docker compose which also use their own ports.
Is there any docker compose example how this type of traefik deployment would look like?
If it was just one port, i would know how to do as i got that to work. but i'm having issues figuring how to deal with multiple ports required x-x;
Simply the best tutorial about Traefik. I never understood the labels and wasn't too sure about the difference between the dynamic and static configuration.
Thanks! :)
Static - Traefik will read at startup
Dynamic - Traefik will watch for any change during runtime and reflect on it (only if you enable file or folder watch).
Label - Similar to Dynamic, but Traefik will watch the label on the container on Docker. The benefit is that traefik will add a rule as soon as the container is up, but if it goes down, it gets removed.
Is there any sense of using traefik, if we already have ELB and also internal Swarm load balancer?
10:19 where you mention about exposing the dashboard, I cant quite understand what you mean. Dont do this in production ...so do what instead? If you dont open the port from the router what difference does it makes if you bind port 8080 of the host to the port 8080 inside the docker?
PS even thougjh all of your videos are quite nice and presentation also you speak too fast (even though i can understand you ) and the general meaning \explanation is lost at the end.
Yeah if you don't open it on the router you should be fine. The warning is there to encourage you to use internal docker network with a reverse proxy and authentication mechanism if you want to expose it to the public
Thanks for making this video! I tried Traefik a couple of years ago, didn't understand a thing, and looking at your video now, I'm going "wait, it's _that_ easy? :D"... I'd like to say though, since config-changes to the traefik.yaml file require a restart, putting it in the docker-compose.yaml file makes more sense to me since it removes the need for two files, down to one, and you're already in the right location editing the docker-compose.yaml file to restart the service.
Haha thank you! Glad it could help you :)
how would you run traefik with Pi-hole both using the port 80?
I followed this tutorial line by line but I can't access the dashboard? What could I possibly be doing wrong?
same problem
Hi. I get too many redirects error. What could be the solution?
I love you!
Great video but I have a question. Would you say it is secure to expose dashboard/admin webui to specific IP, let's say VPN IP? As far as I know you can do it by simply adding the desired IP to -p
It's a viable option, I also sometimes do firewall rules based on my static public IP or internal VPN ip. However, it's probably not the "best" way to do it, I'll explain that in a future video soon, when we talk more about modern network security concepts which will go away from traditional vpn (internal/external network) concepts!
Stay tuned, there is more stuff in that space coming :)
@@christianlempa For me it's the option that keeps me from learning iptables he-he. I am always tuned, keep up great work.
I have issues trying to get ssl to work
how would you do the lettsencrypt crts
Hi. You helped me a lot in getting to know traefik. However, I need help with nextcloud, specifically nextcloudpi on docker. After setting everything up. I'm getting an Internal Server Error on the page.
You may have covered this and I just missed it but can I configure a proxy to connect to a service running at a different IP address? I have a Bitwarden and a website running on a Raspberry Pi that I would like to connect to. Thank you.
Sure, you can add a dynamic configuration in the Traefik config file to route a connection to a custom IP address, that could be anywhere. It might be not as straightforward as on the same node, but it's technically possible.
Do you think a video about how you approach 'bind mounts vs named volumes' would be worth making? I see that it's kind of a mixed bag in your boiler plate templates.
Maybe it would be nice to do a "docker best practices"? Let me think about it
can i do:
cloudflare -> reverse proxy -> origin server
Can we using proxy reversing to the docker container while we using UFW ?
i try using UFW to allow port 80 and 443 but it blocked port expose docker, how to using UFW instead using proxy reverse to docker container ?
run:
"ufw allow in on docker0"
then change DEFAULT_FORWARD_POLICE to “ACCEPT” in /etc/default/ufw
reload using:
"ufw reload"
Is it safe to expose port 80 for http cert renewal?
Hello there, I am doing the exact same steps but portainer does not show any port, and the name of looks like something auto generated: Traefik_traefik.1.ycjh9ftdo0jmli7bp5k31fqht . Any help?
Edit: I got the issue, while creating a new stack my stack is created in swarm mode. I had to leave swarm mode with command : docker swarm leave --force and now it creates everything in compose.
Man, i'm really struggling with cloudflare DNS challenge. I would love an update to this guide. You kinda sorta not really put stuff in the boilerplate, but it has zero context.
Thank you!
I am having an issue, I started using VS code which I love btw thank you for that, but the issue with my Traefik container is whenever I make changes to the config.yaml file it never changes anything. I can right click and compose down and compose up which does restart it with no issues but does not change anything with the config file, the other container with labels works no issues. But the config is a no go. Also I have tried to execute the bash command docker-compose up -d --force-recreate and I get error's saying the docker-compose file is invalid with the networks option I have and the environment variables in the file. Although I can right click in vs code and use up and down no issues. I am stuck here I don't understand. If you need to see logs I can send you whatever you think. I am just so lost. Would appreciate some help. Oh and BTW I used all of your templates.
Did you also install Portainer with Traefik? I wonder because you use it in the video but you didn't show how you installed it.
I noticed the github repository shows a git clone option but has not much information about how to run that.
Is there a way to install this without using docker, or kubernetes? I followed your video for nginx reverse proxy in the past. Now that manager has caused a lot of problems and cant for the life of me get it fixed and want to just throw it away honestly.
Im following the steps described in the video and Im getting "command traefik error: yaml: line 41: did not find expected key" not matter what I change. I even modified the volumes based off @christian github and still getting same results. :(
Can someone explain to me how u can do this without portainer?
How can I add the portainer container to traefik?
I keep getting this error level=error msg="open /etc/traefik/certs/acme.json: no such file or directory" providerName=acme
thx for the video, but the config files from your video is different from the github, that's a bit confusing
Nice one, thanks! Is it possible to setup traefik on one Docker Host and NGiNX on another Docker Host and label it without a Docker Swarm?
Haven't done it with swarm, yet :/
@@christianlempa the questions was: without Swarm, but two Docker Hosts
Hi, just wondering why in the your latest boilerplate docker-compose.yml file, it no longer has the volume for the ssl certificates. Is this no longer necessary? Won't they still get lost if the container is stopped?
I'm storing the certs in the /etc/traefik/certs folder which is alredy stored in a volume, so I thought I could remove it.
@@christianlempa Thanks for replying. Makes sense 🙂
How could your file run without slash in front of traefik-ssl-certs?
ERROR: Named volume "traefik-ssl-certs:/ssl-certs:rw" is used in service "traefik" but no declaration was found in the volumes section.
If you're using a named volume, you need to declare it in the compose-file. I'm sorry I probably changed my boilerplate to use a bind instead of named volume.
Thank you very much for this interessting video.
Maybe you should mention that it is not a good practise to put all your containers in the traefik network.
Best practise is to create a new "proxy" network for every container that needs to explicitly expose a service via traefik. This will ensure all your backend containers of your service stack (databases, etc...) are not accessible from traefik and also most important are not accessible from other docker containers running behinde traefik web proxy.
Thanks! Yeah that might be a topic for a separate video.
Nice
I only get error 404 using everything in a fresh install
Hi @christian Thanks for the amazing tutorial. For some odd reason my traefik is not coming up. I did a tcpdump to check on it. I see the traffic coming in and out of the machine, however nothing displays. Although I have to say in my tcpdump am having a length of 0
You're welcome! :) If you have a problem, join our discord, maybe somebody can help you.