Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve implementation of Traefik #105

Open
felbinger opened this issue Apr 26, 2024 · 0 comments
Open

Improve implementation of Traefik #105

felbinger opened this issue Apr 26, 2024 · 0 comments

Comments

@felbinger
Copy link
Owner

This project describe the setup process for traefik (dockerized) and nginx (service on host) as reverse proxy.

There are some open questions:

  • Can traefik assign each http router a separate ipv6 address?
  • How to configure authenticated origin pulls with cloudflare?
  • Describe for traefik with cloudflare how to use origin server wildcard certificates (instead of using ACME with LEGO):
    should work like this:
    commands:
      # ...
      - "--tls.certificatesresolvers.myresolver1.acme=false"
      - "--tls.certificatesresolvers.myresolver1.certFile=/certs/domain1.crt"
      - "--tls.certificatesresolvers.myresolver1.keyFile=/certs/domain1.key"
      - "--tls.certificatesresolvers.myresolver1.domains[0]=domain1.com"
      - "--tls.certificatesresolvers.myresolver2.acme=false"
      - "--tls.certificatesresolvers.myresolver2.certFile=/certs/domain2.crt"
      - "--tls.certificatesresolvers.myresolver2.keyFile=/certs/domain2.key"
      - "--tls.certificatesresolvers.myresolver2.domains[0]=domain2.com"
    # ...
    volumes:
      # ...
      - "/srv/traefik/certs:/certs"
  • Test traefik setup - I wrote it from what I remembered last time doing it...
  • Think about splitting the three traefik container definition into separate files (to avoid duplicate configuration fragments).
  • Keycloak: Admin Webinterface Protection for Traefik as Reverse Proxy:
    I found this on an old server - please test this before putting it into admin guide...
      labels:
        # ...
        - "traefik.http.routers.r_keycloak.rule=Host(`id.domain.de`)" # <- edit (user interface)
        - "traefik.http.routers.r_keycloak.tls=true"
        - "traefik.http.routers.r_keycloak.entrypoints=websecure"
        - "traefik.http.middlewares.mw_keycloak-host-rewrite.headers.customrequestheaders.Host=id.domain.de" # <- edit
        - "traefik.http.middlewares.mw_keycloak-host-rewrite2.headers.customrequestheaders.X-Forwarded-Host=id.domain.de" # <- edit
        - "traefik.http.middlewares.mw_keycloak-redirect.replacepathregex.regex=^\/auth\/$$"
        - "traefik.http.middlewares.mw_keycloak-redirect.replacepathregex.replacement=/auth/realms/main/account/" # <- edit
        - "traefik.http.middlewares.mw_keycloak-block-admin.replacepathregex.regex=^\/auth\/admin\/$$"
        - "traefik.http.middlewares.mw_keycloak-block-admin.replacepathregex.replacement=/auth/realms/master/account/" # <- edit
        - "traefik.http.routers.r_keycloak.middlewares=mw_keycloak-redirect@docker,mw_keycloak-block-admin@docker,mw_keycloak-host-rewrite@docker,mw_keycloak-host-rewrite2@docker"
    
        - "traefik.http.routers.r_keycloak-admin.rule=Host(`keycloak.domain.de`)" # <- edit (admin interface)
        - "traefik.http.routers.r_keycloak-admin.tls=true"
        - "traefik.http.routers.r_keycloak-admin.entrypoints=websecure"
        - "traefik.http.middlewares.mw_keycloak-admin-redirect.redirectregex.regex=^https:\/\/keycloak.domain.de\/?$$" # <- edit
        - "traefik.http.middlewares.mw_keycloak-admin-redirect.redirectregex.replacement=https://keycloak.domain.de/auth/admin/" # <- edit
        - "traefik.http.routers.r_keycloak-admin.middlewares=mw_keycloak-admin-redirect@docker"
    
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant