forked from coop-cloud/traefik
decentral1se
acb4c6960a
The default docker swarm endpoint mode (vip) introduces unnecessary
indirection in the communication between services, namely the
docker-proxy and a dynamic haproxy endpoint container. This commit
switches the socket-proxy service to endpoint_mode: dnsrr by default and
the traefik service when using host-mode port publishing.
I would strongly recommend considering switching to host-mode port
publishing by default, especially as most coop-cloud deployments are
single-server.
See: toolshed/organising#648
Thanks to @mirsal. Rebased and merged from the following commit.
abbb3255f8
Traefik
- Category: Utilities
- Status: ?
- Image:
traefik, 4, upstream - Healthcheck: Yes
- Backups: No
- Email: N/A
- Tests: 2
- SSO: ? (Keycloak)
Basic usage
- Set up Docker Swarm and
abra abra app new traefikabra app config YOURAPPDOMAIN- be sure to changeDOMAINto something that resolves to your Docker swarm boxabra app deploy YOURAPPDOMAIN
Configuring wildcard SSL using DNS
Automatic certificate generation will Just Work™ for most recipes which use a fixed
number of subdomains. For some recipes which need to work across arbitrary
subdomains, like
federatedwiki and
go-ssb-room, you'll
need to give Traefik access to your DNS provider so that it can carry out
Letsencrypt DNS challenges.
- Use Gandi or OVH for DNS 🤡 (support for other providers can be easily added,
see the
legodocs. - Run
abra app config YOURAPPDOMAIN - Uncomment e.g.
ENABLE_GANDIand the relatedSECRET_.._VERSIONline, e.g.SECRET_GANDIV5_API_KEY_VERSION - Generate an API key for your provider
- Run
abra app secret insert YOURAPPDOMAIN SECRETNAME v1 SECRETVALUE, whereSECRETNAMEis from the compose file (e.g.compose.gandi-api-key.yml) e.g.gandiv5_api_keyandSECRETVALUEis the API key.- For Gandi, you can use either the deprecated API Key or a GandiV5 Personal Access Token, in which case use compose.gandi-personal-access-token.yml.
- Redeploy Traefik, using e.g.
abra app deploy YOURAPPDOMAIN -f