Skip to content

Instantly share code, notes, and snippets.

  • Save ogiovannyoliveira/47b3e9a294af45e1e890e96d98649371 to your computer and use it in GitHub Desktop.
Save ogiovannyoliveira/47b3e9a294af45e1e890e96d98649371 to your computer and use it in GitHub Desktop.
Docker + Traefik v1.7 and 2.0 + Let's Encrypt + Github Repository
Docker + Traefik + Let's Encrypt + Github Repository
Using:
- Ubuntu 19.04
- Docker Engine 19.03
- Docker Compose 1.25.0-rc2
- Traefik v1.7.18 with dnsChallenge
- Traefik v2.0.1 with httpChallenge
--
- Github Registry
- Let's Encrypt
1. Create a Ubuntu Droplet
1.1. You can create a Docker pre-installed Ubuntu too
2. Add domain to the Droplet -> yourdomain.com
2.1 Create A record for the Droplet -> @ for Droplet IP OR Change DNS on your domain provider
3. Connect to Ubuntu CLI
4. Install Docker
4.1. curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
4.2. sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable edge"
4.3. sudo apt-get update
4.4 apt-cache policy docker-ce
4.5 sudo apt-get install -y docker-ce
4.6 sudo systemctl status docker
5. Run your first image -> docker run doxalabs/hello-world
6. Install docker-compose
6.1. sudo curl -L "https://github.com/docker/compose/releases/download/1.25.0-rc2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
6.2. sudo chmod +x /usr/local/bin/docker-compose
6.3. sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
6.3. docker-compose --version
7. Go to /etc Folder
8. Create a folder -> mkdir traefik && cd traefik
9. Create traefik files
9.1. sudo touch /opt/traefik/docker-compose.yml
9.2. sudo touch /opt/traefik/acme.json
9.3. sudo chmod 600 /opt/traefik/acme.json
9.4. sudo touch /opt/traefik/traefik.toml
10. Update your docker-compose.yml file
10.1. nano docker-compose.yml
10.2. I am using dnsChallenge to create SSL. My domain provider is GoDaddy. Create a production API KEY and update environment parameters.
10.3 Update yourdomain.com on labes.
[Traefik v1.7] - docker-compose.yml with dnsChallenge
version: '3.7'
services:
reverse-proxy:
image: traefik:v1.7
restart: always
container_name: traefik
ports:
- 80:80
- 443:443
expose:
- 8080
networks:
- external
- internal
environment:
- GODADDY_API_KEY=...
- GODADDY_API_SECRET=...
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /opt/traefik/traefik.toml:/traefik.toml
- /opt/traefik/acme.json:/acme.json
labels:
- "traefik.backend=traefik"
- "traefik.docker.network=external"
- "traefik.enable=true"
- "traefik.frontend.rule=Host:traefik.yourdomain.com"
- "traefik.port=8080"
- "traefik.frontend.headers.forceSTSHeader=true"
- "traefik.frontend.headers.STSSeconds=315360000"
- "traefik.frontend.headers.STSIncludeSubdomains=true"
- "traefik.frontend.headers.STSPreload=true"
networks:
external:
external: true
internal:
11. Update traefik.toml file
11.1. Update users on entryPoints.traefik with -> echo $(htpasswd -nb username password) | sed -e s/\\$/\\$\\$/g
11.2. Update your-domain and your-email fields
11.3. Update your domain provider on acme.dnsChallenge
[Traefik v1.7] - traefik.toml with dnsChallenge
debug = false
loglevel = "ERROR"
defaultEntryPoints = ["https", "http"]
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[entryPoints.traefik]
address = ":8080"
[entryPoints.traefik.auth.basic]
users = ["username:hashed-password"]
[api]
entryPoint = "traefik"
[retry]
[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "your-domain.com"
watch = true
exposedByDefault = false
[acme]
email = "your-email.com"
storage = "acme.json"
onHostRule = true
entryPoint = "https"
[acme.dnsChallenge]
provider = "godaddy"
delayBeforeCheck = 0
[[acme.domains]]
main = "*.your-domain.com"
sans = ["your-domain.com"]
12. Create a network -> docker network create external
13. Run traefik
13.1. docker-compose up -d
13.2. docker ps
13.3. If you don't see traefik running then chek the logs -> docker logs containerId
13.4. If it's running then create a CNAME for traefik -> @ then visit traefik.your-domain.com
13.5. Enter your username and non-hashed password to see the dashboard
14. Run your own image from Github Registry / Others
14.1. Create a folder -> mkdir opt/my-container
14.2 Create docker-compose -> nano docker-compose.yml
[Traefik 1.7] - docker-compose.yml
version: "3.7"
services:
your-container-name:
image: docker.pkg.github.com/github-username/repo-name/tag-name:latest
restart: always
container_name: your-container-name
networks:
- web
labels:
- traefik.docker.network=external
- traefik.backend=your-container-name
- traefik.frontend.rule=Host:your-container-name.your-domain.com
- traefik.enable=true
- traefik.port=80
networks:
web:
name: external
15. Docker login.
15.1. If you are using Ubuntu 19 then run -> apt install pass
15.2. docker login docker.pkg.github.com --username "github-username"
15.3. Create a Github Access Token with repo, package write and read permission and enter this token as a password
16. Run your container
16.1. docker-compose up -d
16.2. docker ps
16.3. Create a CNAME for your-container-name -> @ then visit your-container-name.your-domain.com
These are for traefik v2.0
[Traefik v2.0] - docker-compose.yml with httpChallenge
version: '3.7'
services:
traefik:
image: traefik:v2.0.1
container_name: traefik
restart: unless-stopped
security_opt:
- no-new-privileges:true
networks:
- proxy
ports:
- 80:80
- 443:443
volumes:
- /etc/localtime:/etc/localtime:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./traefik.yml:/traefik.yml:ro
- ./acme.json:/acme.json
labels:
- "traefik.enable=true"
- "traefik.http.routers.traefik.entrypoints=http"
- "traefik.http.routers.traefik.rule=Host(`traefik.your-domain.com`)"
- "traefik.http.middlewares.traefik-auth.basicauth.users=username:hashed-password"
- "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
- "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
- "traefik.http.routers.traefik-secure.entrypoints=https"
- "traefik.http.routers.traefik-secure.rule=Host(`traefik.your-domain.com`)"
- "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
- "traefik.http.routers.traefik-secure.tls=true"
- "traefik.http.routers.traefik-secure.tls.certresolver=http"
- "traefik.http.routers.traefik-secure.service=api@internal"
- "traefik.http.services.traefik.loadbalancer.server.port=8080"
networks:
proxy:
external: true
[Traefik v2.0] - traefik.yml with httpChallenge
api:
dashboard: true
# Writing Logs to a File, in JSON
log:
level: DEBUG
filePath: "log-file.log"
format: json
# Configuring a buffer of 100 lines
accessLog:
filePath: "log-access.log"
bufferingSize: 100
entryPoints:
http:
address: ":80"
https:
address: ":443"
providers:
docker:
endpoint: "unix:///var/run/docker.sock"
exposedByDefault: false
certificatesResolvers:
http:
acme:
email: your-email.com
storage: acme.json
httpChallenge:
entryPoint: http
[Traefik v2.0] - your-container docker-compose.yml
version: '3.7'
services:
your-container-name:
image: docker.pkg.github.com/username/repo-name/image-name:latest
container_name: your-container-name
restart: unless-stopped
security_opt:
- no-new-privileges:true
networks:
- proxy
volumes:
- /etc/localtime:/etc/localtime:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./data:/data
labels:
- "traefik.enable=true"
- "traefik.http.routers.your-container-name.entrypoints=http"
- "traefik.http.routers.your-container-name.rule=Host(`your-container-name.your-domain.com`, `www.your-container-name.your-domain.com`)"
- "traefik.http.middlewares.your-container-name-https-redirect.redirectscheme.scheme=https"
- "traefik.http.routers.your-container-name.middlewares=your-container-name-https-redirect"
- "traefik.http.routers.your-container-name-secure.entrypoints=https"
- "traefik.http.routers.your-container-name-secure.rule=Host(`your-container-name.your-domain.com`, `www.your-container-name.your-domain.com`)"
- "traefik.http.routers.your-container-name-secure.tls=true"
- "traefik.http.routers.your-container-name-secure.tls.certresolver=http"
- "traefik.http.routers.your-container-name-secure.service=your-container-name"
- "traefik.http.services.your-container-name.loadbalancer.server.port=80"
- "traefik.docker.network=proxy"
networks:
proxy:
external: true
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment