Traefik - un reverse proxy pour Docker

Voir aussi :

• https://www.grottedubarbu.fr/kubernetes-portainer-traefik/
• https://www.grottedubarbu.fr/securiser-socket-docker/

traefik.yml

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"

serversTransport:
  insecureSkipVerify: true
#  rootCAs:
#    - certs/inter-chain.pem

providers:
  file:
    filename: dynamic_conf.yml
    watch: true
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false

log:
  #level: DEBUG
  level: INFO

api:
  dashboard: true
  #debug: true
  #insecure: true

dynamic_conf.yml

tls:
  certificates:
    - certFile: certs/registry.docker.local.crt
      keyFile: certs/registry.docker.local.key

    - certFile: certs/wildcard.docker.local.crt
      keyFile: certs/wildcard.docker.local.key
      stores:
        - default

  stores:
    default:
      defaultCertificate:
        certFile: certs/wildcard.docker.local.crt
        keyFile: certs/wildcard.docker.local.key

  options:
    default:
      minVersion: VersionTLS12
      sniStrict: true

docker-compose.yml

version: '3.7'
services:
  traefik:
    image: traefik
    #restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - $PWD/traefik.yml:/traefik.yml:ro
      - $PWD/dynamic_conf.yml:/dynamic_conf.yml:ro
      - $PWD/certs:/certs:ro
#    environment:
#      PUID: ${PUID}
#      PGID: ${PGID}
#      TZ: ${TZ}
    labels:
      - traefik.enable=true
      - traefik.http.routers.dashboard.entrypoints=web
      - traefik.http.routers.dashboard.rule=Host(`traefik.docker.local`)
      #- traefik.http.services.s-dashboard.loadbalancer.server.port=8080
      - traefik.port=8080
      - traefik.http.routers.s-dashboard.entrypoints=websecure
      - traefik.http.routers.s-dashboard.rule=Host(`traefik.docker.local`)
      - traefik.http.routers.s-dashboard.service=api@internal
      - traefik.http.routers.s-dashboard.middlewares=auth@docker
      # mkpasswd -m md5 |sed -e 's/\$/$$/g'
      - traefik.http.middlewares.auth.basicauth.users=jean:$$1$$qvbVKuOn$$qKZpjcMQuMFWNgC9vtycL1
      - traefik.http.routers.s-dashboard.tls=true
      - traefik.http.routers.dashboard.middlewares=https-redirect@docker
      - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
      - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
 
#  hello:
#    image: osones/helloworld
#    labels:
#      - traefik.enable=true
#      - traefik.http.routers.hw.entrypoints=web
#      - traefik.http.routers.hw.rule=Host(`hw.docker.local`)
#      - traefik.http.routers.s-hw.entrypoints=websecure
#      - traefik.http.routers.s-hw.rule=Host(`hw.docker.local`)
#      - traefik.http.routers.s-hw.tls=true
#      - traefik.http.routers.hw.middlewares=https-redirect@docker
#      - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
#      - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
#      #- "traefik.port=80"
#      #- "traefik.backend=hello"

  redis:
    image: redis
    #restart: unless-stopped
    restart: always
  registry:
    image: registry:2
    depends_on:
      - redis
    environment:
    environment:
      - REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/data
      - REGISTRY_STORAGE_CACHE_BLOBDESCRIPTOR=redis
      - REGISTRY_REDIS_ADDR=redis:6379
    volumes:
      - $PWD/data:/data
    labels:
      - traefik.enable=true
      - traefik.port=5000
      - traefik.http.routers.s-registry.rule=Host(`registry.docker.local`)
      - traefik.http.routers.s-registry.entrypoints=websecure
      - traefik.http.routers.s-registry.tls=true

  registry-ui:
    image: konradkleine/docker-registry-frontend:v2
    #restart: unless-stopped
    depends_on:
      - registry
    environment:
      ENV_DOCKER_REGISTRY_HOST: 'registry'
      ENV_DOCKER_REGISTRY_PORT: 5000
      #ENV_DOCKER_REGISTRY_USE_SSL: 1
      ENV_DEFAULT_REPOSITORIES_PER_PAGE: 50
    labels:
      - traefik.enable=true
      - traefik.port=80
      - traefik.http.routers.s-registry-ui.rule=Host(`registry-ui.docker.local`)
      - traefik.http.routers.s-registry-ui.entrypoints=websecure
      - traefik.http.routers.s-registry-ui.tls=true
      - traefik.http.routers.s-registry-ui.middlewares=auth@docker
      - traefik.http.middlewares.auth.basicauth.users=jean:$$1$$qvbVKuOn$$qKZpjcMQuMFWNgC9vtycL1

Exemple de génération de certificats. Notez que Traefik est capable d'utiliser Let's Encrypt

mkdir certs
openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/wildcard.docker.local.key -x509 -days 365 -out certs/wildcard.docker.local.crt

docker-compose up -d