bisco/loadbalancer
1
0
Fork 0
generated from bisco/codex-bootstrap
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: route host loopback backends

Browse Source
This commit is contained in:
Alfredo Di Stasio
2026-06-30 10:16:03 +02:00
parent f3759e76ea
commit 1509c1e5fd
11 changed files with 46 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture.md
+7 -7
View File
@@ -4,24 +4,24 @@ This project runs Traefik Proxy as a Dockerized TCP load balancer.
## Components
- `compose.yaml`: defines the Traefik container, published port, host-based configuration volume, container hardening, and healthcheck.
- `compose.yaml`: defines the Traefik container, host networking, host-based configuration volume, container hardening, and healthcheck.
- `config/traefik.yml`: static Traefik configuration for HTTP, TCP TLS, ping, file provider, and logging.
- `config/dynamic/tcp-services.yml`: dynamic HTTP challenge routers, TCP routers, and backend load-balancer services.
## Data flow
1. A client opens a TLS connection to the Docker host on `443/tcp`.
2. Docker forwards the connection to Traefik on container port `8443/tcp`.
3. Traefik matches the TCP router using `HostSNI(*)`.
2. Traefik receives the connection directly through host networking on `443/tcp`.
3. Traefik matches the TCP router using `HostSNI(...)`.
4. Traefik forwards the unchanged TCP stream to one configured backend IP address and port.
5. The selected backend terminates TLS and presents its own SSL certificate.
For HTTP-01 certificate validation:
1. Let's Encrypt opens an HTTP connection to the Docker host on `80/tcp`.
2. Docker forwards the request to Traefik on container port `8080/tcp`.
3. Traefik matches the HTTP `Host(...)` and `PathPrefix('/.well-known/acme-challenge/')` router.
4. Traefik forwards the request to the configured local challenge responder.
2. Traefik receives the request directly through host networking on `80/tcp`.
3. Traefik matches the HTTP `Host(...)` router.
4. Traefik forwards the full HTTP request to the configured local backend so that backend redirects and ACME challenge handling remain in one place.
## Persistence
@@ -31,6 +31,6 @@ No certificates, private keys, application data, or Docker socket are mounted in
## Deployment topology
Traefik runs as one Docker container on the load-balancer host. Backends are external to this Compose stack and must be reachable from the container through their configured IP addresses and ports. The Compose service defines `host.docker.internal` through Docker's `host-gateway` feature for backends that listen on the Docker host itself.
Traefik runs as one Docker container on the load-balancer host with `network_mode: host`. Backends are external to this Compose stack and can be reached on host loopback addresses such as `127.0.0.1:8443`.
See `docs/adr/0001-traefik-tcp-tls-passthrough.md` for the design decision.