generated from bisco/codex-bootstrap
Alfredo Di Stasio
70 lines
1.4 KiB
Markdown
70 lines
1.4 KiB
Markdown
# Traefik TCP Load Balancer
|
|
|
|
Docker Compose deployment for Traefik used as a TCP load balancer with TLS passthrough.
|
|
|
|
## What it does
|
|
|
|
- publishes `443/tcp` on the Docker host;
|
|
- forwards TCP TLS traffic to backend IP addresses and ports;
|
|
- leaves SSL certificates and private keys on the backends;
|
|
- stores Traefik configuration in the host `./config` directory;
|
|
- uses the Traefik file provider, without mounting the Docker socket.
|
|
|
|
## Configuration
|
|
|
|
Edit SNI routes and backend targets in `config/dynamic/tcp-services.yml`:
|
|
|
|
```yaml
|
|
tcp:
|
|
routers:
|
|
lab-younerd:
|
|
rule: "HostSNI(`lab.younerd.org`)"
|
|
service: lab-younerd
|
|
tls:
|
|
passthrough: true
|
|
|
|
services:
|
|
lab-younerd:
|
|
loadBalancer:
|
|
servers:
|
|
- address: "host.docker.internal:8443"
|
|
```
|
|
|
|
`HostSNI(...)` matches the hostname sent by the client during the TLS handshake. If a backend listens on the Docker host itself, use `host.docker.internal:PORT`.
|
|
|
|
## Run
|
|
|
|
Validate the Compose file:
|
|
|
|
```bash
|
|
docker compose config
|
|
```
|
|
|
|
Start Traefik:
|
|
|
|
```bash
|
|
docker compose up -d
|
|
```
|
|
|
|
View logs:
|
|
|
|
```bash
|
|
docker compose logs -f traefik
|
|
```
|
|
|
|
Stop the service:
|
|
|
|
```bash
|
|
docker compose down
|
|
```
|
|
|
|
## Documentation
|
|
|
|
- Architecture: `docs/architecture.md`
|
|
- Deployment: `docs/deployment.md`
|
|
- Operations: `docs/operations.md`
|
|
- Security: `docs/security.md`
|
|
- Testing: `docs/testing.md`
|
|
- Runbook: `docs/runbook.md`
|
|
- ADR: `docs/adr/0001-traefik-tcp-tls-passthrough.md`
|