Docker and Traefik

Docker and Traefik

Docker

Only traefik_hosts receives Docker. The role installs Docker Engine from Docker's official Ubuntu repository with Buildx and Compose v2.

Managed packages:

docker-ce
docker-ce-cli
containerd.io
docker-buildx-plugin
docker-compose-plugin

The daemon configuration at /etc/docker/daemon.json enables BuildKit and bounds local log growth:

features:
  buildkit: true
log-driver: local
log-opts:
  max-size: "10m"
  max-file: "3"

Check Docker:

sudo systemctl is-active docker
sudo docker version
sudo docker compose version
sudo docker info --format '{{.LoggingDriver}}'

Adding a user to docker_users grants root-equivalent host access. Do not add untrusted users.

Traefik prerequisites

Before setup reaches Traefik:

• Host belongs to traefik_hosts.
• vault_traefik_acme_email is set in the encrypted vault.
• Public DNS A/AAAA design matches the server. This project disables IPv6, so do not publish an AAAA record unless you manage IPv6 yourself.
• TCP 80 and 443 reach this server from the Internet.

What the role manages

The role creates /opt/traefik and manages:

/opt/traefik/compose.yaml
/opt/traefik/letsencrypt/acme.json
/opt/traefik/logs/access.log

acme.json has mode 0600. Traefik publishes 80 and 443, redirects HTTP to HTTPS, obtains certificates through ACME HTTP-01, and uses the external Docker network named traefik.

Docker discovery is enabled with exposedByDefault=false. A container is not public unless its labels explicitly set traefik.enable=true.

Verify Traefik

sudo docker compose -f /opt/traefik/compose.yaml ps
sudo docker logs traefik --tail 100
curl -I http://your-domain.example
curl -I https://your-domain.example

The HTTP request should redirect to HTTPS. If ACME fails, first check public DNS and TCP 80 reachability, then read the Traefik logs.

Optional dashboard

The dashboard is off by default. Enable it only with all required values:

# group_vars/traefik_hosts.yaml
traefik_dashboard_enabled: true
traefik_dashboard_host: traefik.example.com
traefik_dashboard_username: admin
traefik_dashboard_password: "{{ vault_traefik_dashboard_password }}"

The role generates a bcrypt basic-auth value. Never put the dashboard password in a tracked group variable file.