generated from bisco/codex-bootstrap
Alfredo Di Stasio
61 lines
1.6 KiB
Markdown
61 lines
1.6 KiB
Markdown
# Operations
|
|
|
|
## Startup and shutdown
|
|
|
|
Start Traefik:
|
|
|
|
```bash
|
|
docker compose up -d
|
|
```
|
|
|
|
Stop Traefik:
|
|
|
|
```bash
|
|
docker compose down
|
|
```
|
|
|
|
Restart after static configuration changes in `config/traefik.yml`:
|
|
|
|
```bash
|
|
docker compose restart traefik
|
|
```
|
|
|
|
Dynamic configuration changes under `config/dynamic/` are watched by Traefik and normally do not require a restart.
|
|
|
|
## Health checks
|
|
|
|
The container healthcheck runs:
|
|
|
|
```bash
|
|
traefik healthcheck --ping
|
|
```
|
|
|
|
Check health with:
|
|
|
|
```bash
|
|
docker compose ps
|
|
```
|
|
|
|
## Logs
|
|
|
|
Traefik logs to container stdout:
|
|
|
|
```bash
|
|
docker compose logs -f traefik
|
|
```
|
|
|
|
## Backend maintenance
|
|
|
|
To remove a backend from rotation, edit `config/dynamic/tcp-services.yml` and remove or comment out its `address` entry. Keep at least one reachable backend configured before applying the change.
|
|
|
|
This deployment uses host networking. For backends running on the Docker host, use `127.0.0.1:PORT` when the service is bound to host loopback.
|
|
|
|
For HTTP on port `80`, update the HTTP services in `config/dynamic/tcp-services.yml` to match the local backend ports that handle redirects and ACME challenge paths.
|
|
|
|
## Known operational risks
|
|
|
|
- TLS passthrough prevents Traefik from inspecting HTTP paths, headers, or certificate contents.
|
|
- Backend certificates and renewal jobs must be monitored on each backend.
|
|
- SNI routing depends on clients sending the expected hostname during the TLS handshake. Clients that connect by IP address or omit SNI will not match hostname-specific routers.
|
|
- Public port `80/tcp` forwards all HTTP paths for configured hostnames to the matching backend.
|