# Traefik

[![Build Status](https://build.coopcloud.tech/api/badges/coop-cloud/traefik/status.svg)](https://build.coopcloud.tech/coop-cloud/traefik)

> https://docs.traefik.io

<!-- metadata -->
* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@decentral1se](https://git.coopcloud.tech/decentral1se), [@javielico](https://git.coopcloud.tech/javielico), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
* **Status**: `stable`
* **Category**: Utilities
* **Features**: ?
* **Image**: [`traefik`](https://hub.docker.com/_/traefik), 4, upstream
* **Healthcheck**: Yes
* **Backups**: No
* **Email**: N/A
* **Tests**: 2
* **SSO**: ? (Keycloak)
<!-- endmetadata -->

## Basic usage

1. Set up Docker Swarm and [`abra`]
2. `abra app new traefik`
3. `abra app config YOURAPPDOMAIN` - be sure to change `DOMAIN` to something that resolves to
   your Docker swarm box
4. `abra app deploy YOURAPPDOMAIN`

## Configuring basic auth

1. Create the usersfile locally: `htpasswd -c usersfile <username>`
2. Uncomment the Basic Auth section in your .env file
3. Insert the secret: `abra app secret insert <domain> usersfile v1 -f usersfile
4. Redploy your app: `abra app deploy -f <domain>`

## Configuring SSL using DNS

Automatic certificate generation will Just Work™ for most recipes which use a
fixed number of subdomains. If your server can't be reached from the Internet,
or if you're deploying a recipe that needs to work across arbitrary
subdomains, like
[`federatedwiki`](https://git.coopcloud.tech/coop-cloud/federatedwiki/) and
[`go-ssb-room`](https://git.coopcloud.tech/coop-cloud/federatedwiki/) (requiring
the use of wildcard certificates,) you can give Traefik access to your DNS provider
so that it can carry out Letsencrypt DNS challenges.

1. Use Gandi, OVH, DO, Azure, or PorkBun for DNS 🤡 (support for other providers
   can be easily added, see
   [the `lego` docs](https://go-acme.github.io/lego/dns/#dns-providers).
2. Run `abra app config YOURAPPDOMAIN`
3. Uncomment e.g. `ENABLE_GANDI` and the related `SECRET_.._VERSION` line, e.g.
   `SECRET_GANDIV5_API_KEY_VERSION`
4. Set `LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER` to your provider, e.g. `gandi`
4. Generate an API key for your provider, probably using their web interface.
5. Run `abra app secret insert YOURAPPDOMAIN SECRETNAME v1 SECRETVALUE`, where
   `SECRETNAME` is from the compose file (e.g. `compose.gandi-api-key.yml`) e.g.
   `gandiv5_api_key` and `SECRETVALUE` is the API key.
   - For Gandi, you can use either the deprecated API Key or a GandiV5 Personal
     Access Token, in which case use compose.gandi-personal-access-token.yml.
   - See comments for each provider in your env file for specific instructions
6. Redeploy Traefik, using e.g. `abra app deploy YOURAPPDOMAIN -f`

## Blocking scrapers with [Anubis](https://anubis.techaro.lol/)

Uncomment the lines on the Anubis section of the configuration.  Set
a domain name for the cookies and a domain that will serve Anubis
redirection service.  Optionally and for [added
security](https://anubis.techaro.lol/docs/admin/configuration/redirect-domains),
set a list of the domain names for the apps that are going to be
protected.

After deploying these changes, go to each recipe that supports Anubis
and follow the process there.  **Enabling Anubis here is not enough for
protection your apps.**

## Crowdsec

IMPORTANT even though Crowdsec is Open Source, the software sends information of the attacker IP and what decision(ban or captcha) to a centralized server for communit managed block lists.

On first deployment you need to generate an empty secret, because the lapi key is created at runtime.
```
abra app secret insert <domain> crowdsec_lapi_key v1
```

Then deploy your traefik recipe with the crowdsec compose and variables enabled and set `CROWDSEC_BOUNCER_ENABLED=0` to prevent initializing the bouncer that has no key yet.

When traefik is running, generate the LAPI key with the following command:
```
abra app run <domain> crowdsec cscli bouncers add crowdsecBouncer
```

After that insert the LAPI key(command below) and redeploy traefik with `CROWDSEC_BOUNCER_ENABLED=1` and `CROWDSEC_TRAEFIK_CONFIG_VERSION=v2`.
```
abra app secret insert <domain> crowdsec_lapi_key v2 -f -t <path-to/lapi-key-file>
```

When it is up and running go to the recipe you want to protect and add the following snippet and redeploy.
```
---
version: "3.8"
services:
  app:
    deploy:
      labels:
        - "traefik.http.routers.${STACK_NAME}.middlewares=crowdsec@file"
```

You can see if it is working by checking the ban list.
```
abra app run <domain> crowdsec cscli decisions list
```

When there are not bans yet you can try by banning your own IP.
```
abra app run <domain> crowdsec cscli decisions add --ip <your-ip> -d 10m # this will be effective 10min
```
Remove it with:
```
abra app run <domain> crowdsec cscli decisions remove --ip <your-ip> # this can still take a few minutes because of cache
```

## Enabling onion service

Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).

[`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra