I run traefik as proxy for many containers successfully.
I also run a dockered prosody (XMPP-server) with published ports (5222 and 5269) in the traefik network. As I want it to work with strict TLS and no STARTTLS I use HostSNI-rule and tcp instead of http protocol in traffic for labeling, I passthrough the tls because it is terminated in xmpp instance itself (not traefik). I place the certificates there. It works.
Soon I realize I might have done it all wrong: since I want to compare it with a second XMPP service (ejabberd) behind traefik, a port conflict (5222 and 5269 already in use) makes me wonder why I mapped the ports at all on a bridged network with traefik in first instance? So I disabled them for prosody (no ports, no expose in docker-compose file of prosody). But now it can't be reached anymore although I have set the labels and service for traefik rules accordingly. (In Portainer>Inspect>Networksettings>ports show they are recognized, available in image).
First conclusion: I think traffic is not going over traefik at all (as local dns points to the docker host with the published ports). But if I stop traefik, xmpp clients won't connect with published ports neither. So then it must still go via traefik proxy, right?. How can one check/probe that actually? Why do I need the ports being exposed/published (I tried all of it) in docker in the use-case to work solely with traefik?
I decided to let prosody be with strict TLS (as is, including mapped ports which makes no sense to me) and enable STARTTLS with ejabberd and adding new entry-points for port 5221 and 5268 including mapping them in traefik. But no success for connection - what do I miss in the concept? (as standalone ejabberd container works well):
labels:
- "traefik.enable=true"
- "traefik.tcp.routers.xmpp2-c2c.entrypoints=xmpp2"
- "traefik.tcp.routers.xmpp2-c2c.rule=Host(`local.lan`)"
#- "traefik.tcp.routers.xmpp2-c2c.rule=HostSNI(`local.lan`)"
#- "traefik.tcp.routers.xmpp2-c2c.tls=true"
#- "traefik.tcp.routers.xmpp2-c2c.tls.passthrough=true"
- "traefik.tcp.routers.xmpp2-c2c.service=xmpp2-c2c-service"
- "traefik.tcp.services.xmpp2-c2c-service.loadbalancer.server.port=5222"
- Why should I use traefik at all then? Maybe I should put them (XMPP servers) not behind a reverse-proxy as it is missing the primary goal for serving different services at the same domain (tls termination). But for the sake of comprehension I still expect it to work with traefik - or is there anything else I forgot to think about?