generated from bisco/codex-bootstrap
Alfredo Di Stasio
107 lines
2.7 KiB
Markdown
107 lines
2.7 KiB
Markdown
# Traefik TCP Load Balancer
|
|
|
|
Docker Compose deployment for Traefik used as a TCP load balancer with TLS passthrough.
|
|
|
|
## What it does
|
|
|
|
- publishes `443/tcp` on the Docker host;
|
|
- publishes `80/tcp` on the Docker host for HTTP-01 certificate challenges;
|
|
- forwards TCP TLS traffic to backend IP addresses and ports;
|
|
- leaves SSL certificates and private keys on the backends;
|
|
- stores Traefik configuration in the host `./config` directory;
|
|
- uses the Traefik file provider, without mounting the Docker socket.
|
|
|
|
## Configuration
|
|
|
|
Add or edit one file per site under `config/dynamic/`. For example, `config/dynamic/lab-younerd.yml` contains:
|
|
|
|
```yaml
|
|
http:
|
|
routers:
|
|
lab-younerd-http:
|
|
entryPoints:
|
|
- web
|
|
rule: "Host(`lab.younerd.org`)"
|
|
service: lab-younerd-http
|
|
|
|
services:
|
|
lab-younerd-http:
|
|
loadBalancer:
|
|
healthCheck:
|
|
path: "/"
|
|
hostname: "lab.younerd.org"
|
|
interval: "10s"
|
|
timeout: "3s"
|
|
servers:
|
|
- url: "http://127.0.0.1:8080"
|
|
|
|
tcp:
|
|
routers:
|
|
lab-younerd-tls:
|
|
entryPoints:
|
|
- tls
|
|
rule: "HostSNI(`lab.younerd.org`)"
|
|
service: lab-younerd-tls
|
|
tls:
|
|
passthrough: true
|
|
|
|
services:
|
|
lab-younerd-tls:
|
|
loadBalancer:
|
|
healthCheck:
|
|
interval: "10s"
|
|
timeout: "3s"
|
|
servers:
|
|
- address: "127.0.0.1:8443"
|
|
```
|
|
|
|
`HostSNI(...)` matches the hostname sent by the client during the TLS handshake. This deployment uses host networking so Traefik can reach services bound to the Docker host loopback address, such as `127.0.0.1:8443`.
|
|
|
|
HTTP-01 certificate challenges use normal HTTP routing on port `80`, not SNI. The included example forwards:
|
|
|
|
```text
|
|
lab.younerd.org -> 127.0.0.1:8080
|
|
azionelab.org -> 127.0.0.1:9080
|
|
www.azionelab.org -> 127.0.0.1:9080
|
|
```
|
|
|
|
Adjust `8080` and `9080` to the local ports where the backend HTTP service is listening. The full HTTP request is forwarded so the backend can handle redirects and ACME challenge paths.
|
|
|
|
Each backend service includes health checks. TCP checks verify that the TLS port accepts connections; HTTP checks call `/` with the configured hostname and treat successful or redirect responses as healthy.
|
|
|
|
## Run
|
|
|
|
Validate the Compose file:
|
|
|
|
```bash
|
|
docker compose config
|
|
```
|
|
|
|
Start Traefik:
|
|
|
|
```bash
|
|
docker compose up -d
|
|
```
|
|
|
|
View logs:
|
|
|
|
```bash
|
|
docker compose logs -f traefik
|
|
```
|
|
|
|
Stop the service:
|
|
|
|
```bash
|
|
docker compose down
|
|
```
|
|
|
|
## Documentation
|
|
|
|
- Architecture: `docs/architecture.md`
|
|
- Deployment: `docs/deployment.md`
|
|
- Operations: `docs/operations.md`
|
|
- Security: `docs/security.md`
|
|
- Testing: `docs/testing.md`
|
|
- Runbook: `docs/runbook.md`
|
|
- ADR: `docs/adr/0001-traefik-tcp-tls-passthrough.md`
|