Knowledgebase

Traefik is an open-source edge router that works as a reverse proxy and load balancer. It helps you route traffic to your backend services, manage SSL certificates, and enable automatic service discovery, among other features. With Traefik, you can efficiently manage microservices, containerized environments (like Docker or Kubernetes), and cloud-native applications.

In this tutorial, we will guide you through the process of installing and configuring Traefik on your AnonVM server to handle web traffic and act as a reverse proxy and load balancer.

Table of Contents

1. Prerequisites
2. What is Traefik?
3. Installing Traefik on AnonVM
4. Basic Traefik Configuration
5. Using Traefik with Docker (Optional)
6. Enabling HTTPS with Let's Encrypt
7. Configuring Traefik as a Load Balancer
8. Best Practices for Traefik
9. Troubleshooting Traefik

1. Prerequisites

Before proceeding with the installation, ensure that you have the following:

• Operating System: A supported Linux distribution, such as Ubuntu, CentOS, or Debian.
• Root or Sudo Access: You need root privileges to install software and configure Traefik.
• Internet Access: Traefik requires internet access to download required files and interact with external services, such as Let's Encrypt.
• Docker (Optional): If you're using Docker to deploy services, ensure Docker is installed.

2. What is Traefik?

Traefik is a modern reverse proxy and load balancer designed for microservices and containerized environments. It supports HTTP, HTTPS, TCP, and WebSocket protocols and can automatically discover services through dynamic backends such as Docker, Kubernetes, and cloud-based environments.

Some of the key features of Traefik:

• Automatic SSL: Supports Let's Encrypt for automatic SSL certificate management.
• Dynamic Service Discovery: Automatically discovers services running in Docker, Kubernetes, and more.
• Load Balancing: Routes traffic efficiently to different backend services.
• Easy Configuration: Provides both file-based and dynamic configuration options, including Docker and Kubernetes integration.

3. Installing Traefik on AnonVM

Step 1: Update Your System

Begin by updating your system to ensure you have the latest software and security patches.

Step 2: Install Traefik Using Docker (Recommended)

Traefik can be easily deployed using Docker. If Docker is not installed, follow these steps:

1. Install Docker (if not already installed):

    

   sudo apt install apt-transport-https ca-certificates curl software-properties-common curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add - sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" sudo apt update sudo apt install docker-ce

2. Verify Docker Installation:

   Run the following command to verify Docker is installed correctly:

    

   docker --version

Now that Docker is installed, let's move on to installing Traefik.

Step 3: Create a Docker Compose File for Traefik

1. Create a docker-compose.yml file:

   Inside your working directory, create the docker-compose.yml file that defines the Traefik service:

    

   mkdir ~/traefik cd ~/traefik nano docker-compose.yml

2. Define Traefik Configuration:

   Add the following configuration to docker-compose.yml:

   yaml

    

   version: "3" services: traefik: image: traefik:v2.10 command: - "--api.insecure=true" - "--providers.docker=true" - "--entrypoints.web.address=:80" - "--entrypoints.websecure.address=:443" - "--certificatesresolvers.myresolver.acme.tlschallenge=true" - "--certificatesresolvers.myresolver.acme.email=youremail@example.com" - "--certificatesresolvers.myresolver.acme.storage=/acme.json" ports: - "80:80" - "443:443" volumes: - "/var/run/docker.sock:/var/run/docker.sock" - "./acme.json:/acme.json" restart: always

   This configuration will set up Traefik to:

   • Use Docker as a provider to automatically discover services.
   • Expose HTTP and HTTPS entry points on ports 80 and 443.
   • Automatically generate SSL certificates using Let's Encrypt (ACME).
   • Expose the Traefik dashboard for monitoring the routing.

3. Create acme.json:

   Traefik stores the certificates in a file named acme.json. Create this file and ensure it has the right permissions:

    

   touch acme.json chmod 600 acme.json

4. Start Traefik:

   Now, run the following command to start Traefik with Docker Compose:

    

   sudo docker-compose up -d

5. Check Traefik Logs:

   After starting the containers, check the logs to ensure Traefik is running properly:

    

   sudo docker-compose logs -f

4. Basic Traefik Configuration

Step 1: Expose a Backend Service

Now, let's expose a simple web application or service behind Traefik.

1. Add a Service to Docker Compose:

   In your docker-compose.yml, add a simple web service, like an NGINX container, to demonstrate routing:

   yaml

    

   services: web: image: nginx:alpine labels: - "traefik.enable=true" - "traefik.http.routers.web.rule=Host(`yourdomain.com`)" - "traefik.http.services.web.loadbalancer.server.port=80" restart: always

2. Update DNS or Hosts File:

   Update your DNS to point yourdomain.com to your AnonVM server’s IP address or modify the /etc/hosts file for local testing.

3. Apply the Changes:

   After updating the configuration, apply the changes by running:

    

   sudo docker-compose up -d

   Traefik will automatically route traffic for yourdomain.com to the NGINX container.

5. Using Traefik with Docker

When using Docker, Traefik can automatically discover services by using Docker labels. This means that each service you deploy with Docker can be routed dynamically by Traefik based on the labels you add.

For example, to route traffic to a service called my-app, you would add the following labels to its Docker configuration:

6. Enabling HTTPS with Let's Encrypt

To enable HTTPS for your services, you need to configure Traefik to automatically generate SSL certificates using Let's Encrypt.

1. Modify docker-compose.yml:

   If you haven’t already, ensure your docker-compose.yml includes the Let's Encrypt configuration as shown earlier.

2. Visit the Service via HTTPS:

   After applying the configuration, visit https://yourdomain.com, and Traefik will automatically generate and serve an SSL certificate for your domain.

7. Configuring Traefik as a Load Balancer

Traefik can also act as a load balancer for multiple instances of a service. To configure this, add more instances of the backend service in your Docker Compose file:

Traefik will automatically distribute traffic across the available replicas of the web service.

8. Best Practices for Traefik

• Secure the Dashboard: Don’t expose the Traefik dashboard without proper authentication.
• Use Let's Encrypt: Always use HTTPS and automate SSL certificate management with Let's Encrypt.
• Use Docker Labels Effectively: Leverage Docker labels for service discovery and routing.
• Monitor Traefik Logs: Regularly check the logs for any issues or errors in the routing setup.

9. Troubleshooting Traefik

• Check Traefik Logs: To identify any issues, you can check the Traefik logs:

   

  sudo docker-compose logs -f traefik

• Verify DNS Settings: Ensure your domain is pointing to the correct IP address.