Tutorial

How To Use Traefik as a Reverse Proxy for Docker Containers on Ubuntu 16.04

How To Use Traefik as a Reverse Proxy for Docker Containers on Ubuntu 16.04
Not using Ubuntu 16.04?Choose a different version or distribution.
Ubuntu 16.04

Introduction

Docker can be an efficient way to run web applications in production, but you may want to run multiple applications on the same Docker host. In this situation, you’ll need to set up a reverse proxy since you only want to expose ports 80 and 443 to the rest of the world.

Traefik is a Docker-aware reverse proxy that includes its own monitoring dashboard. In this tutorial, you’ll use Traefik to route requests to two different web application containers: a Wordpress container and an Adminer container, each talking to a MySQL database. You’ll configure Traefik to serve everything over HTTPS using Let’s Encrypt.

Prerequisites

To follow along with this tutorial, you will need the following:

Step 1 — Configuring and Running Traefik

The Traefik project has an official Docker image, so we will use that to run Traefik in a Docker container.

But before we get our Traefik container up and running, we need to create a configuration file and set up an encrypted password so we can access the monitoring dashboard.

We’ll use the htpasswd utility to create this encrypted password. First, install the utility, which is included in the apache2-utils package:

  1. sudo apt-get install apache2-utils

Then generate the password with htpasswd. Substitute secure_password with the password you’d like to use for the Traefik admin user:

  1. htpasswd -nb admin secure_password

The output from the program will look like this:

Output
admin:$apr1$ruca84Hq$mbjdMZBAG.KWn7vfN/SNK/

You’ll use this output in the Traefic configuration file to set up HTTP Basic Authentication for the Traefik health check and monitoring dashboard. Copy the entire output line so you can paste it later.

To configure the Traefik server, we’ll create a new configuration file called traefik.toml using the TOML format. TOML is a configuration language similar to INI files, but it is standardized. This file lets us configure the Traefik server and various integrations, or providers, we want to use. In this tutorial, we will use three of Traefik’s available providers: web, docker, and acme, which is used to support TLS using Let’s Encrypt.

  1. nano traefik.toml

First, add two named entry points, httpand https, that all backends will have access to by default:

traefik.toml
defaultEntryPoints = ["http", "https"]

We’ll configure the http and https entry points later in this file.

Next, configure the web provider, which gives you access to a dashboard interface. This is where you’ll paste the output from the htpasswd command:

traefik.toml
...
[web]
address = ":8080"
  [web.auth.basic]
  users = ["admin:your_encrypted_password"]

The dashboard is a separate web application that will run within the Traefik container. We set the dashboard to run on port 8080.

The web.auth.basic section configures HTTP Basic Authentication for the dashboard. Use the output from the htpasswd command you just ran for the value of the users entry. You could specify additional logins by separating them with commas.

Next, define the entry points. The entryPoints section configures the addresses that Traefik and the proxied containers can listen on. Add these lines to the file:

traefik.toml
...
[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
      entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]

The http entry point handles port 80, while the https entry point uses port 443 for TLS/SSL. We automatically redirect all of the traffic on port 80 to the https entry point to force secure connections for all requests.

Finally, add this section to configure Let’s Encrypt certificate support for Traefik:

traefik.toml
...
[acme]
email = "your_email@example.com"
storage = "acme.json"
entryPoint = "https"
onHostRule = true
onDemand = false

This section is called acme because ACME is the name of the protocol used to communicate with Let’s Encrypt to manage certificates. To have Traefik generate certificates for our hosts, we set the email key to your email address. We then specify that we will store the information that we will receive from Let’s Encrypt in a JSON file called acme.json. The entryPoint key needs to point to the entry point handling port 443, which in our case is the https entry point.

The last two keys, onHostRule and onDemand, dictate how Traefik should go about generating certificates. We want to fetch our certificates as soon as our containers with specified hostnames are created, and that’s what the onHostRule setting will do. The onDemand setting would attempt to generate certificates the first time that a request is made. This would slow down the first request and be very noticeable to the visitor, so we’ll avoid that.

Save the file and exit the editor. With all of this configuration in place, we can fire up Traefik.

Step 2 – Running the Traefik Container

Next, create a Docker network for the proxy to share with containers. The Docker network is necessary so that we can use it with applications that are run using Docker Compose. Let’s call this network proxy.

  1. docker network create proxy

When the Traefik container starts, we will add it to this network. Then we can add additional containers to this network later for Traefik to proxy to.

Next, create an empty file which will hold our Let’s Encrypt information. We’ll share this into the container so Traefik can use it:

  1. touch acme.json

Traefik will only be able to use this file if the root user inside of the container has unique read and write access to it. To do this, lock down the permissions on acme.json so that only the owner of the file has read and write permission.

  1. chmod 600 acme.json

Once the file gets passed to Docker, the owner will automatically change to the root user inside the container.

Finally, create the Traefik container with this command:

  1. docker run -d \
  2. -v /var/run/docker.sock:/var/run/docker.sock \
  3. -v $PWD/traefik.toml:/traefik.toml \
  4. -v $PWD/acme.json:/acme.json \
  5. -p 80:80 \
  6. -p 443:443 \
  7. -l traefik.frontend.rule=Host:monitor.example.com \
  8. -l traefik.port=8080 \
  9. --network proxy \
  10. --name traefik \
  11. traefik:1.3.6-alpine --docker

The command is a little long so let’s break it down.

We use the -d flag to run the container in the background as a daemon. We then share our docker.sock file into the container so that the Traefik process can listen for changes to containers. We also share the traefik.toml configuration file and the acme.json file we created into the container.

Next, we map ports :80 and :443 of our Docker host to the same ports in the Traefik container so Traefik receives all HTTP and HTTPS traffic to the server.

Then we set up two Docker labels that tell Traefik to direct traffic to the hostname monitor.example.com to port :8080 within the Traefik container, exposing the monitoring dashboard.

We set the network of the container to proxy, and we name the container traefik.

Finally, we use the traefik:1.3.6-alpine image for this container, because it’s small.

A Docker image’s ENTRYPOINT is a command that always runs when a container is created from the image. In this case, the command is the traefik binary within the container. You can pass additional arguments to that command when you launch the container. In our case, we pass the argument --docker to the ENTRYPOINT which ensures that the docker provider is registered with the default settings. The docker provider enables Traefik to act as a proxy in front of Docker containers. The default configuration of the Docker provider works well for us, so we won’t need to configure it in our traefik.toml.

With the container started, you now have a dashboard you can access to see the health of your containers. You can also use this dashboard to visualize the frontends and backends that Traefik has registered. Access the monitoring dashboard by pointing your browser to https://monitor.example.com. You will be prompted for your username and password, which are admin and the password you configured in Step 1.

Once logged in,. you’ll see an interface similar to this:

Empty Traefik dashboard

There isn’t much to see just yet, but leave this window open, and you will see the contents change as you add containers for Traefik to work with.

We now have our Traefik proxy running, configured to work with Docker, and ready to monitor other Docker containers. Let’s start some containers for Traefik to act as a proxy for.

Step 3 — Registering Containers with Traefik

With the Traefik container running, you’re ready to run applications behind it. Let’s launch the following cotainers behind Traefik:

  1. A blog using the official Wordpress image.
  2. A database management server using the official Adminer image.

We’ll manage both of these applications with Docker Compose using a docker-compose.yml file:

  1. nano docker-compose.yml

Add the following lines to the file to specify the version and the networks we’ll use:

docker-compose.yml
version: "3"

networks:
  proxy:
    external: true
  internal:
    external: false

We use Docker Compose version 3 because it’s the newest major version of the Compose file format.

For Traefik to recognize our applications, they must be part of the same network, and since we created the network manually, we pull it in by specifying the network name of proxy and setting external to true. Then we define another network so that we can connect our exposed containers to a database container that we won’t expose through Traefik. We’ll call this network internal.

Next, we’'ll define each of our services, one at a time. Let’s start with the blog container, which we’ll base on the official WordPress image. Add this configuration to the file:

docker-compose.yml
version: "3"
...

services:
  blog:
    image: wordpress:4.7.5-apache
    environment:
      WORDPRESS_DB_PASSWORD:
    labels:
      - traefik.backend=blog
      - traefik.frontend.rule=Host:blog.example.com
      - traefik.docker.network=proxy
      - traefik.port=80
    networks:
      - internal
      - proxy
    depends_on:
      - mysql

The environment key lets you specify environment variables that will be set inside of the container. By not setting a value for WORDPRESS_DB_PASSWORD, we’re telling Docker Compose to get the value from our shell and pass it through when we create the container. We will define this environment variable in our shell before starting the containers. This way we don’t hard-code passwords into the configuration file.

The labels section is where you specify configuration values for Traefik. Docker labels don’t do anything by themselves, but Traefik reads these so it knows how to treat containers. Here’s what each of these labels does:

  • traefik.backend specifies the name of the backend service in Traefik (which points to the actual blog container).
  • traefik.frontend.rule=Host:blog.example.com tells Traefik to examine the host requested and if it matches the pattern of blog.example.com it should route the traffic to the blog container.
  • traefik.docker.network=proxy specifies which network to look under for Traefik to find the internal IP for this container. Since our Traefik container has access to all of the Docker info, it would potentially take the IP for the internal network if we didn’t specify this.
  • traefik.port specifies the exposed port that Traefik should use to route traffic to this container.

With this configuration, all traffic sent to our Docker host’s port 80 will be routed to the blog container.

We assign this container to two different networks so that Traefik can find it via the proxy network and it can communicate with the database container through the internal network.

Lastly, the depends_on key tells Docker Compose that this container needs to start after its dependencies are running. Since WordPress needs a database to run, we must run our mysql container before starting our blog container.

Next, configure the MySQL service by adding this configuration to your file:

docker-compose.yml
services:
...
  mysql:
    image: mysql:5.7
    environment:
      MYSQL_ROOT_PASSWORD:
    networks:
      - internal
    labels:
      - traefik.enable=false

We’re using the official MySQL 5.7 image for this container. You’ll notice that we’re once again using an environment item without a value. The MYSQL_ROOT_PASSWORD and WORDPRESS_DB_PASSWORD variables will need to be set to the same value to make sure that our WordPress container can communicate with the MySQL. We don’t want to expose the mysql container to Traefik or the outside world, so we’re only assigning this container to the internal network. Since Traefik has access to the Docker socket, the process will still expose a frontend for the mysql container by default, so we’ll add the label traefik.enable=false to specify that Traefik should not expose this container.

Finally, add this configuration to define the Adminer container:

docker-compose.yml
services:
...

  adminer:
    image: adminer:4.3.1-standalone
    labels:
      - traefik.backend=adminer
      - traefik.frontend.rule=Host:db-admin.example.com
      - traefik.docker.network=proxy
      - traefik.port=8080
    networks:
      - internal
      - proxy
    depends_on:
      - mysql

This container is based on the official Adminer image. The network and depends_on configuration for this container exactly match what we’re using for the blog container.

However, since we’re directing all of the traffic to port 80 on our Docker host directly to the blog container, we need to configure this container differently in order for traffic to make it to our adminer container. The linetraefik.frontend.rule=Host:db-admin.example.com tells Traefik to examine the host requested. If it matches the pattern of db-admin.example.com Traefik will route the traffic to the adminer container.

Save the file and exit the text editor.

Next, set values in your shell for the WORDPRESS_DB_PASSWORD and MYSQL_ROOT_PASSWORD variables before you start your containers:

  1. export WORDPRESS_DB_PASSWORD=secure_database_password
  2. export MYSQL_ROOT_PASSWORD=secure_database_password

Substitute secure_database_password with your desired database password.

With these variables set, run the containers using docker-compose:

  1. docker-compose up -d

Now take another look at the Traefik admin dashboard. You’ll see that there is now a backend and a frontend for the two exposed servers:

Populated Traefik dashboard

Navigate to blog.example.com, substituting example.com with your domain. You’ll be redirected to a TLS connection and can now complete the Wordpress setup:

WordPress setup screen

Now access Adminer by visiting db-admin.example.com in your browser, again substituting example.com with your domain. The mysql container isn’t exposed to the outside world, but the adminer container has access to it through the internal Docker network that they share using the mysql container name as a host name.

On the Adminer login screen, use the username root, use mysql for the server, and use the value you set for MYSQL_ROOT_PASSWORD for the password. Once logged in, you’ll see the Adminer user interface:

Adminer connected to the MySQL database

Both sites are now working, and you can use the dashboard at monitor.example.com to keep an eye on your applications.

Conclusion

In this tutorial, you configured Traefik to proxy requests to other applications in Docker containers.

Traefik’s declarative configuration at the application container level makes it easy to configure more services, and there’s no need to restart the traefik container when you add new applications to proxy traffic to since Traefik notices the changes immediately through the Docker socket file it’s monitoring.

To learn more about what you can do with Traefik, head over to the official Traefik documentation.

Thanks for learning with the DigitalOcean Community. Check out our offerings for compute, storage, networking, and managed databases.

Learn more about us


About the authors


Still looking for an answer?

Ask a questionSearch for more help

Was this helpful?
 
10 Comments


This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Hi. Very much a noob with using docker. So following the instruction as carefully as possible, I got Traefik to see the others. When I access db-admin, the login form is populated with MySQL mysql root <password> mysql

Click login and get the error “SQLSTATE[HY000] [2002] php_network_getaddresses: getaddrinfo failed: Name does not resolve”

I did google the text but could not make sense how to resolve the issue.

The [web] option has been deprecated. Here’s what I used to get basic auth working on the Traefik dashboard:

[api]
dashboard = true
entrypoint = "webentry"

[entrypoints]
  #...
  # https://docs.traefik.io/configuration/api/#authentication
  [entrypoints.webentry]
    address = ":8080"
    [entrypoints.webentry.auth]
      [entrypoints.webentry.auth.basic]
        users = ["user:$apr1$xxxxxxxx"]

Im getting a 404 for all subdomains. Why not configure traefik in the docker compose file ?

I’m getting a ‘404 page not found’ when I try to direct to a conatiner running on a different port. Am I missing something?

little typo… look for `

The Traefik version in this guide is outdated. You need 1.5 or higher and a change in the traefik.toml in order to not run into this error: https://stackoverflow.com/questions/48219262/error-acme-could-not-determine-solvers-when-trying-to-get-a-letsencrpyt-cert

time=“2019-07-03T09:28:33Z” level=info msg=“Preparing server http &{Network: Address::80 TLS:<nil> Redirect:0xc420310de0 Auth:<nil> Compress:false}” time=“2019-07-03T09:28:33Z” level=info msg=“Preparing server https &{Network: Address::443 TLS:0xc4201fa6c0 Redirect:<nil> Auth:<nil> Compress:false}” time=“2019-07-03T09:28:33Z” level=info msg=“Starting server on :80” time=“2019-07-03T09:28:34Z” level=info msg=“Loading ACME Account…” time=“2019-07-03T09:28:34Z” level=info msg=“Loaded ACME config from store acme.json” time=“2019-07-03T09:28:34Z” level=error msg=“Cannot unmarshall private key []” time=“2019-07-03T09:28:34Z” level=error msg=“Error creating TLS config: private key was nil” time=“2019-07-03T09:28:34Z” level=fatal msg=“Error preparing server: private key was nil”

In the end I got it to work with

docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v $PWD/traefik.toml:/traefik.toml \
  -v $PWD/acme.json:/acme.json \
  -p 80:80 \
  -p 443:443 \
  -l traefik.frontend.rule=Host:monitor.domain.com \
  -l traefik.port=8080 \
  --network proxy \
  --name traefik \
  traefik:1.5.4-alpine --docker

and this traefik.toml:

debug = false

logLevel = "ERROR"

defaultEntryPoints = ["http", "https"]

[api]
dashboard = true
entrypoint = "webentry"

[entrypoints]
  #...
  # https://docs.traefik.io/configuration/api/#authentication
  [entrypoints.webentry]
    address = ":8080"
    [entrypoints.webentry.auth]
      [entrypoints.webentry.auth.basic]
        users = ["admin:encryptedkey"]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
  [entryPoints.https.tls]


[acme]
email = "jasper@domain.com"
storage = "acme.json"
entryPoint = "https"
onHostRule = true
onDemand = false
[acme.httpChallenge]
entryPoint = "http"

The “[web]” config is deprecated.

This is an awesome tutorial! Thanks for sharing. The process worked beautifully for me after I struggled to get TLS working without Traefik. However, I do have one question/issue that others might be able to help resolve…

One of my sites, lets call it ‘xyz.net’ has two aliases, ‘thexyz.com’ and ‘thexyz.net’. The Nginx container in my docker-compose.yml has a labels specification like so:

    labels:
      - traefik.backend=xyz_nginx
      - traefik.port=80
      - traefik.frontend.rule=Host:xyz.net,thexyz.com,thexyz.net

This works in my dev environment where I use self-signed certs and manually click to allow exceptions, but it doesn’t work in production. In production TLS works for the main domain, xyz.net, but I still get self-signed cert behavior for the two aliases.

Anybody got a suggestion to address/remedy this? Thanks in advance.

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Join the Tech Talk
Success! Thank you! Please check your email for further details.

Please complete your information!

Get our biweekly newsletter

Sign up for Infrastructure as a Newsletter.

Hollie's Hub for Good

Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

Become a contributor

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

Welcome to the developer cloud

DigitalOcean makes it simple to launch in the cloud and scale up as you grow — whether you're running one virtual machine or ten thousand.

Learn more
DigitalOcean Cloud Control Panel