标签: traefik

我正在尝试在 docker swarm 模式下使用 traefik 2.0 (!)。这是我的堆栈：

version: '3.7'
services:
  traefik:
    image: traefik:latest
    ports:
      - 80:80
      - 443:443
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
        preferences:
          - spread: node.id
      labels:
        - traefik.enable=true
        - traefik.http.routers.traefikRouter.rule=Host(`127.0.0.11`)
        - traefik.http.routers.traefikRouter.service=api@internal
        - traefik.http.routers.traefikRouter.entrypoints=http
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: >
      --providers.docker
      --providers.docker.exposedbydefault=false
      --providers.docker.swarmmode=true
      --entryPoints.http.address=":80"
      --entryPoints.https.address=":443"
      --accesslog
      --log.level=DEBUG
      --api=true
      --api.dashboard=true
    networks:
      - traefik-public

  whoami:
    image: containous/whoami
    deploy:
      replicas: 2
      labels:
        - traefik.enable=true
        - traefik.http.services.whoami.loadbalancer.server.port=80
        - traefik.http.routers.whoami.rule=Host(`127.0.0.12`)
        - traefik.http.routers.whoami.service=whoami
        - traefik.http.routers.whoami.entrypoints=http
    networks:
      - traefik-public

# Run on …

我设置了一个监听 4000 端口的 GraphQL 游乐场。

所以我添加了以下 Traefik 标签：

graphql:
  restart: unless-stopped
  labels:
    - traefik.enable=true
    - "traefik.http.routers.${CI_PROJECT_PATH_SLUG}-${CI_ENVIRONMENT_SLUG}-graphql.rule=Host(`graphql.${CI_ENVIRONMENT_HOST}`)"
    - traefik.http.routers.${CI_PROJECT_PATH_SLUG}-${CI_ENVIRONMENT_SLUG}-graphql.tls.certresolver=letsencrypt
    - traefik.http.services.${CI_PROJECT_PATH_SLUG}-${CI_ENVIRONMENT_SLUG}-graphql.loadbalancer.server.port=4000

当我尝试获取graphql.site.com.

现在我希望它匹配site.com/graphql，所以我将路由器标签更改为：

"traefik.http.routers.${CI_PROJECT_PATH_SLUG}-${CI_ENVIRONMENT_SLUG}-graphql.rule=Host(`${CI_ENVIRONMENT_HOST}`) && Path(`/graphql`)"

使用此配置，我在site.com/graphql.

我错过了什么？

我正在尝试在traefik.yml文件中声明 https 重定向。现在我尝试在.traefik服务中添加这些规则docker-compose.yml。这就像一个魅力。虽然我更喜欢在traefik.yml文件中配置这个全局和中间件重定向，然后只在 .traefik 服务中引用它docker-compose.yml。

我以前吃过的

version: '3'

networks:
  web:
    external: true

services:
  traefik:
    image: traefik:v2.1
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./.traefik/traefik.yml:/traefik.yml
      - ./.traefik/acme.json:/acme.json
    networks:
      - web
    labels:
       - "traefik.enable=true"
       - "traefik.http.routers.traefik.rule=Host(`$HOSTNAME`)"
       - "traefik.http.routers.traefik.service=api@internal"
       - "traefik.http.routers.traefik.tls.certresolver=le"
       - "traefik.http.routers.traefik.entrypoints=https"
       # Global redirect to https
       - "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"
       - "traefik.http.routers.http-catchall.entrypoints=http"
       - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
       # Middleware redirect
       - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

这很容易，并将所有其他域从 http 重定向到 https。

我现在想要什么

我想在traefik.yml.

到目前为止，我已经这样做了。

api: {}

entryPoints: …

这可能是一个关于 traefik 和 SSL 配置的新手问题。我想在 traefik 中使用我自己的（自签名，公司，...）证书。我试图遵循文档，但我不断收到以下消息：

... level=debug msg="没有默认证书，生成一个"

我的traefik.toml看起来像这样：

[entryPoints]
    [entryPoints.web]
    address = ":80"

    [entryPoints.web.http]
        [entryPoints.web.http.redirections]
        [entryPoints.web.http.redirections.entryPoint]
            to = "websecure"
            scheme = "https"

    [entryPoints.websecure]
    address = ":443"

[log]
    level = "DEBUG"
[api]
    insecure = true
    dashboard = true
[providers.docker]
    exposedByDefault = false

[[tls]]
  entryPoints = ["websecure"]

[[tls.certificate]]
    certFile = "/certs/cert.crt"
    keyFile = "/certs/cert.key"

[tls.stores]
  [tls.stores.default]
    [tls.stores.default.defaultCertificate]
      certFile = "/cert/cert.crt"
      keyFile  = "/cert/cert.key"

我的docker-compose.yml样子是这样的：

[entryPoints]
    [entryPoints.web]
    address = ":80"

    [entryPoints.web.http]
        [entryPoints.web.http.redirections]
        [entryPoints.web.http.redirections.entryPoint]
            to = "websecure" …

我正在学习 helm3 和 k8s (microk8s)。在尝试以下命令时：

helm install traefik traefik/traefik  -n traefik --values traefik-values.yaml

和 traefik-values.yaml 具有以下值：

additionalArguments:
  - "--certificatesresolvers.letsencrypt.acme.email=<my-email>"
  - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
  - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
  - "--certificatesResolvers.letsencrypt.acme.tlschallenge=true"
  - "--api.insecure=true"
  - "--accesslog=true"
  - "--log.level=INFO"
hostNetwork: true
ipaddress: <my-ip>
service:
  type: ClusterIP
ports:
  web:
    port: 80
  websecure:
    port: 443

我收到此绑定权限错误

traefik.go:76: command traefik error: error while building entryPoint web: error preparing server: error opening listener: listen tcp :80: bind: permission denied

另一方面，我可以使用以下yaml文件（大约是Traefik 站点上的示例）在相同的端口（80 和 443）上安装 Traefik ：

---
apiVersion: v1 …