generated from bisco/codex-bootstrap
Alfredo Di Stasio
81 lines
1.9 KiB
Markdown
81 lines
1.9 KiB
Markdown
# Traefik TCP Load Balancer
|
|
|
|
Docker Compose deployment for Traefik used as a TCP load balancer with TLS passthrough.
|
|
|
|
## What it does
|
|
|
|
- publishes `443/tcp` on the Docker host;
|
|
- publishes `80/tcp` on the Docker host for HTTP-01 certificate challenges;
|
|
- forwards TCP TLS traffic to backend IP addresses and ports;
|
|
- leaves SSL certificates and private keys on the backends;
|
|
- stores Traefik configuration in the host `./config` directory;
|
|
- uses the Traefik file provider, without mounting the Docker socket.
|
|
|
|
## Configuration
|
|
|
|
Edit SNI routes and backend targets in `config/dynamic/tcp-services.yml`:
|
|
|
|
```yaml
|
|
tcp:
|
|
routers:
|
|
lab-younerd:
|
|
rule: "HostSNI(`lab.younerd.org`)"
|
|
service: lab-younerd
|
|
tls:
|
|
passthrough: true
|
|
|
|
services:
|
|
lab-younerd:
|
|
loadBalancer:
|
|
servers:
|
|
- address: "host.docker.internal:8443"
|
|
```
|
|
|
|
`HostSNI(...)` matches the hostname sent by the client during the TLS handshake. If a backend listens on the Docker host itself, use `host.docker.internal:PORT`.
|
|
|
|
HTTP-01 certificate challenges use normal HTTP routing on port `80`, not SNI. The included example forwards:
|
|
|
|
```text
|
|
lab.younerd.org/.well-known/acme-challenge/* -> host.docker.internal:8080
|
|
azionelab.org/.well-known/acme-challenge/* -> host.docker.internal:9080
|
|
www.azionelab.org/.well-known/acme-challenge/* -> host.docker.internal:9080
|
|
```
|
|
|
|
Adjust `8080` and `9080` to the local ports where the Certbot challenge responder or webroot service is listening.
|
|
|
|
## Run
|
|
|
|
Validate the Compose file:
|
|
|
|
```bash
|
|
docker compose config
|
|
```
|
|
|
|
Start Traefik:
|
|
|
|
```bash
|
|
docker compose up -d
|
|
```
|
|
|
|
View logs:
|
|
|
|
```bash
|
|
docker compose logs -f traefik
|
|
```
|
|
|
|
Stop the service:
|
|
|
|
```bash
|
|
docker compose down
|
|
```
|
|
|
|
## Documentation
|
|
|
|
- Architecture: `docs/architecture.md`
|
|
- Deployment: `docs/deployment.md`
|
|
- Operations: `docs/operations.md`
|
|
- Security: `docs/security.md`
|
|
- Testing: `docs/testing.md`
|
|
- Runbook: `docs/runbook.md`
|
|
- ADR: `docs/adr/0001-traefik-tcp-tls-passthrough.md`
|