Traefik

https://docs.traefik.io

Maintainer: @p4u1, @decentral1se, @javielico, Local-IT: @moritz, @msimon, @carla
Status: stable
Category: Utilities
Features: ?
Image: traefik, 4, upstream
Healthcheck: Yes
Backups: No
Email: N/A
Tests: 2
SSO: ? (Keycloak)

Basic usage

Set up Docker Swarm and abra
abra app new traefik
abra app config YOURAPPDOMAIN - be sure to change DOMAIN to something that resolves to your Docker swarm box
abra app deploy YOURAPPDOMAIN

Configuring basic auth

Create the usersfile locally: htpasswd -c usersfile <username>
Uncomment the Basic Auth section in your .env file
Insert the secret: `abra app secret insert usersfile v1 -f usersfile
Redploy your app: abra app deploy -f <domain>

Configuring SSL using DNS

Automatic certificate generation will Just Work™ for most recipes which use a fixed number of subdomains. If your server can't be reached from the Internet, or if you're deploying a recipe that needs to work across arbitrary subdomains, like federatedwiki and go-ssb-room (requiring the use of wildcard certificates,) you can give Traefik access to your DNS provider so that it can carry out Letsencrypt DNS challenges.

Use Gandi, OVH, DO, Azure, or PorkBun for DNS 🤡 (support for other providers can be easily added, see the lego docs.
Run abra app config YOURAPPDOMAIN
Uncomment e.g. ENABLE_GANDI and the related SECRET_.._VERSION line, e.g. SECRET_GANDIV5_API_KEY_VERSION
Set LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER to your provider, e.g. gandi
Generate an API key for your provider, probably using their web interface.
Run abra app secret insert YOURAPPDOMAIN SECRETNAME v1 SECRETVALUE, where SECRETNAME is from the compose file (e.g. compose.gandi-api-key.yml) e.g. gandiv5_api_key and SECRETVALUE is the API key.
- For Gandi, you can use either the deprecated API Key or a GandiV5 Personal Access Token, in which case use compose.gandi-personal-access-token.yml.
- See comments for each provider in your env file for specific instructions
Redeploy Traefik, using e.g. abra app deploy YOURAPPDOMAIN -f

Blocking scrapers with Anubis

Uncomment the lines on the Anubis section of the configuration. Set a domain name for the cookies and a domain that will serve Anubis redirection service. Optionally and for added security, set a list of the domain names for the apps that are going to be protected.

After deploying these changes, go to each recipe that supports Anubis and follow the process there. Enabling Anubis here is not enough for protection your apps.

Crowdsec

IMPORTANT even though Crowdsec is Open Source, the software sends information of the attacker IP and what decision(ban or captcha) to a centralized server for communit managed block lists.

On first deployment you need to generate an empty secret, because the lapi key is created at runtime.

abra app secret insert <domain> crowdsec_lapi_key v1

Then deploy your traefik recipe with the crowdsec compose and variables enabled and set CROWDSEC_BOUNCER_ENABLED=0 to prevent initializing the bouncer that has no key yet.

When traefik is running, generate the LAPI key with the following command:

abra app run <domain> crowdsec cscli bouncers add crowdsecBouncer

After that insert the LAPI key(command below) and redeploy traefik with CROWDSEC_BOUNCER_ENABLED=1 and CROWDSEC_TRAEFIK_CONFIG_VERSION=v2.

abra app secret insert <domain> crowdsec_lapi_key v2 -f -t <path-to/lapi-key-file>

When it is up and running go to the recipe you want to protect and add the following snippet and redeploy.

---
version: "3.8"
services:
  app:
    deploy:
      labels:
        - "traefik.http.routers.${STACK_NAME}.middlewares=crowdsec@file"

You can see if it is working by checking the ban list.

abra app run <domain> crowdsec cscli decisions list

When there are not bans yet you can try by banning your own IP.

abra app run <domain> crowdsec cscli decisions add --ip <your-ip> -d 10m # this will be effective 10min

Remove it with:

abra app run <domain> crowdsec cscli decisions remove --ip <your-ip> # this can still take a few minutes because of cache

Enabling onion service

Uncomment the line in the config setting ONION_ENABLED=1. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the onion recipe.

5.2 KiB Raw Permalink Blame History