How to add proper labels in docker for SSL?

user_816116 0
Viewed 1046

I have managed to setup Traefik to to work with my docker swarm and for HTTP requests it works great. However, I don't know how to setup SSL for some of my containers. I will be using letsencrypt for generating certificates.

traefik.toml (partial)

defaultEntryPoints = ["https","http"]

[entryPoints]
  [entryPoints.http]
  address = ":80"
  [entryPoints.https]
  address = ":443"
  [entryPoints.https.tls]

[acme]
email = "acme@example.com"
storage = "acme.json"
entryPoint = "https"
onHostRule = true
caServer = "https://acme-staging.api.letsencrypt.org/directory"

docker-compose.yml

version: '3'
services:
  web:
    ...
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.frontend.rule=Host:example.com,www.example.com"
        - "traefik.docker.network=public"
        - "traefik.frontend.entryPoints=http"
        - "traefik.backend=service_web"

In this configuration, my application never reaches SSL because my containers do not have SSL entryPoint setup. If I change "traefik.frontend.entryPoints" to "https", Letsencrypt gets called (LE givges error because of staging but that doesn't matter to me at this moment).

My biggest problem is that, I still don't know how to convert traefik TOML config into docker-compose labels. For example, Traefik docs explain entrypoints but I have bunch of services that live under different domains. Some have SSL, some do not have SSL; therefore, I want to be able to set up both http and https entryPoints, http to https redirects etc. using only docker-compose.

Also, once I am able to set entrypoints in docker-compose, do I need to keep the [entryPoints] block in traefik.toml?

traefik docker-compose docker ssl
1 Answers

Ahoi!

Requirements: Local-Persist Volume Plugin: https://github.com/CWSpear/local-persist (otherwise the Volume Driver has to be changed) The Network for Traefik has to be pre-created: "docker network create proxy -d overlay"

(1) Fire Up Traefik:

version: "3"

services:
  traefik:
    image: traefik
    #command: --consul --consul.endpoint=consul:8500
    #command: storeconfig --consul --consul.endpoint=consul:8500
    networks:
      - proxy
    ports:
      - 80:80
      - 443:443
      #- 8080:8080
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - traefikdata:/etc/traefik/
    deploy:
      #replicas: 3
      replicas: 1
      placement:
        constraints: [node.role == manager]
      update_config:
        parallelism: 1
        delay: 45s
        monitor: 15s
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 10
        window: 60s

volumes:
  traefikdata:
    driver: local-persist
    driver_opts:
      mountpoint: /data/docker/proxy

networks:
  proxy:
    external: true

Important Note: When using ACME and you'd like to scale the Traefik (like here 3), you have to use Consul or ETCD as a "storage" for the Config. You do not use Consule or ETCD if you just use one Instance of Traefik. With a normal Certificate ETCD & Consul is never required.

(2) Mount traefik.toml

logLevel = "WARN"
debug = false
defaultEntryPoints = ["http", "https"]

[entryPoints]
 [entryPoints.http]
 address = ":80"
 compress = false
   [entryPoints.http.redirect]
      entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]

#Letsencrypt
[acme]
email = "admin@berndklaus.at"
storage = "traefik/acme/account"
entryPoint = "https"
onHostRule = true
onDemand = true

#[[acme.domains]]
# main = "yourdomain.at"
# sans = ["sub1.yourdomain.at", "www.yourdomain.at"]
#[[acme.domains]]
# main = "anotherdomain.at"


#[web]
#address = ":8080"

[docker]
domain = "docker.localhost"
watch = true
swarmmode = true

The uncommented Part is not mandatory

(3) Start any Service

version: '3'

services:
  nginx:
    image: nginx
    deploy:
      labels:
        - "traefik.port=80"
        - "traefik.docker.network=proxy"
        - "traefik.frontend.rule=Host:sub1.yourdomain.at"
        - "traefik.backend=nginx"
        - "traefik.frontend.entryPoints=http,https"
      replicas: 1
    networks:
      proxy:
        aliases:
          - nginx
    volumes:
      - html:/usr/share/nginx/html
    environment:
      - NGINX_HOST=sub.yourdomain.at
      - NGINX_PORT=80
    #command: /bin/bash -c "envsubst < /etc/nginx/conf.d/mysite.template > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"

networks:
  proxy:
    external: true
  default:
    driver: overlay

volumes:
  html:
    driver: local-persist
    driver_opts:
      mountpoint: /data/docker/html

Some more examples: https://github.com/Berndinox/compose-v3-collection

user_31228010
Related