generated from bisco/codex-bootstrap
Alfredo Di Stasio
76 lines
1.8 KiB
Markdown
76 lines
1.8 KiB
Markdown
# Deployment
|
|
|
|
## Requirements
|
|
|
|
- Docker Engine with Docker Compose plugin.
|
|
- Backend services reachable from the Docker host or container by IP address and port.
|
|
- Backend services must terminate TLS and present valid SSL certificates for the expected client names.
|
|
|
|
## Configuration
|
|
|
|
Update `config/dynamic/tcp-services.yml` with the required SNI hostnames and backend addresses:
|
|
|
|
```yaml
|
|
tcp:
|
|
routers:
|
|
example:
|
|
rule: "HostSNI(`example.org`)"
|
|
service: example
|
|
tls:
|
|
passthrough: true
|
|
|
|
services:
|
|
example:
|
|
loadBalancer:
|
|
servers:
|
|
- address: "host.docker.internal:8443"
|
|
```
|
|
|
|
If a backend listens on the Docker host, use `host.docker.internal:PORT`. Compose maps that name through Docker's `host-gateway` feature.
|
|
|
|
HTTP-01 certificate challenges are routed separately with HTTP `Host(...)` rules on port `80`. Configure the `*-acme` services in `config/dynamic/tcp-services.yml` to point at the local port where the challenge responder listens.
|
|
|
|
The `./config` directory is the host-based configuration volume. It is mounted read-only into the container:
|
|
|
|
```yaml
|
|
volumes:
|
|
- ./config:/etc/traefik:ro
|
|
```
|
|
|
|
## Ports
|
|
|
|
- Host `80/tcp` -> container `8080/tcp`: public HTTP entrypoint for ACME HTTP-01 challenge paths.
|
|
- Host `443/tcp` -> container `8443/tcp`: public TCP TLS passthrough load-balancer entrypoint.
|
|
- Container `8082/tcp`: internal Traefik ping entrypoint used only by the container healthcheck.
|
|
|
|
## Deploy
|
|
|
|
Validate the Compose configuration:
|
|
|
|
```bash
|
|
docker compose config
|
|
```
|
|
|
|
Start the stack:
|
|
|
|
```bash
|
|
docker compose up -d
|
|
```
|
|
|
|
Check status:
|
|
|
|
```bash
|
|
docker compose ps
|
|
docker compose logs traefik
|
|
```
|
|
|
|
## Rollback
|
|
|
|
Stop the stack:
|
|
|
|
```bash
|
|
docker compose down
|
|
```
|
|
|
|
Then revert the deployment commit or restore the previous load-balancer configuration.
|