traefik + ssl everywhere + swarm mode + docker-compose.yml

[jagbarcelo]

I've been following your step-by-step instructions on how to install traefik + portainer through Put Wildcard Certificates and SSL on EVERYTHING and also your related video https://www.youtube.com/watch?v=liV3c9m_OX8

Everything went fine but now I'm struggling to make it work after having created a Swarm with 3 Raspberry Pi's: I want traefik to work as proxy for containers running on any node of the swarm/cluster.

According to Traefik documentation, for it to work in a Swarm, it must be deployed on a master node (no problem since my 3 nodes are managers). Thus, I included this in the docker-compose.yml:

    deploy:
      #mode: global     #Should it be installed on every manager node or will it suffice with just one?
      placement:
        constraints:
          - node.role == manager

I've also created a new overlay network (instead of the regular bridge mode network you used, called proxy) and modify the docker-compose accordingly.

Besides, it seems that the labels must be nested one level deeper, under the deploy tag, thus:

[...]
    deploy:
      placement:
        constraints:
          - node.role == manager
      labels:
        - traefik.enable=true
        - traefik.docker.network=proxy-overlay
        [more labels here]
networks:
  proxy-overlay:
    external: true

I've also modified the data/traefiik.yml file to include:

providers:
  docker:
    swarmMode: true
    endpoint: "unix:///var/run/docker.sock"
    watch: true
    exposedByDefault: false

I'm using your file as template, tried every possible combination but I still cannot make it work:

techno-tim.github.io/reference_files/traefik-portainer-ssl/traefik/docker-compose.yml

Lines 1 to 45 in ef6b8c9

	version: '3'
	services:
	traefik:
	image: traefik:latest
	container_name: traefik
	restart: unless-stopped
	security_opt:
	- no-new-privileges:true
	networks:
	- proxy
	ports:
	- 80:80
	- 443:443
	environment:
	- CF_API_EMAIL=user@example.com
	- CF_DNS_API_TOKEN=YOU_API_TOKEN
	# - CF_API_KEY=YOU_API_KEY
	# be sure to use the correct one depending on if you are using a token or key
	volumes:
	- /etc/localtime:/etc/localtime:ro
	- /var/run/docker.sock:/var/run/docker.sock:ro
	- /home/username/traefik/data/traefik.yml:/traefik.yml:ro
	- /home/username/traefik/data/acme.json:/acme.json
	- /home/username/traefik/data/config.yml:/config.yml:ro
	labels:
	- "traefik.enable=true"
	- "traefik.http.routers.traefik.entrypoints=http"
	- "traefik.http.routers.traefik.rule=Host(`traefik-dashboard.local.example.com`)"
	- "traefik.http.middlewares.traefik-auth.basicauth.users=USER:BASIC_AUTH_PASSWORD"
	- "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
	- "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
	- "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
	- "traefik.http.routers.traefik-secure.entrypoints=https"
	- "traefik.http.routers.traefik-secure.rule=Host(`traefik-dashboard.local.example.com`)"
	- "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
	- "traefik.http.routers.traefik-secure.tls=true"
	- "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare"
	- "traefik.http.routers.traefik-secure.tls.domains[0].main=local.example.com"
	- "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.local.example.com"
	- "traefik.http.routers.traefik-secure.service=api@internal"
	networks:
	proxy:
	external: true

Everytime, every possible change that has come to my mind leads me to a 404 File not found error page when the docker-compose file is deployed.

Can you shed some light on what changes would be needed in your template to make it work on a swarm mode cluster?

Thank you.

[timothystewart6]

I don't have much experience with swam so I moved it to discussions so maybe others can help out too!

[jagbarcelo]

As I said, I took your initial configuration and made a variation of it, trying to make it work on a Swarm:

version: '3'

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy-overlay
    ports:
      - 80:80
      - 443:443
    environment:
      - CF_API_EMAIL=user@example.com
      - CF_DNS_API_TOKEN=YOU_API_TOKEN
      # - CF_API_KEY=YOU_API_KEY
      # be sure to use the correct one depending on if you are using a token or key
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/ubuntu/traefik/data/traefik.yml:/traefik.yml:ro
      - /home/ubuntu/traefik/data/acme.json:/acme.json
      - /home/ubuntu/traefik/data/config.yml:/config.yml:ro
      - traefik-logs:/var/log/traefik
    deploy:
      placement:
        constraints: [node.role==manager]
      update_config:
        delay: 60s
        monitor: 30s
        order: stop-first
        failure_action: rollback
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.traefik.entrypoints=http"
        - "traefik.http.routers.traefik.rule=Host(`traefik-dashboard.local.example.com`)"
        - "traefik.http.middlewares.traefik-auth.basicauth.users=USER:BASIC_AUTH_PASSWORD"
        - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
        - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
        - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
        - "traefik.http.routers.traefik-secure.entrypoints=https"
        - "traefik.http.routers.traefik-secure.rule=Host(`traefik-dashboard.local.example.com`)"
        - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
        - "traefik.http.routers.traefik-secure.tls=true"
        - "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare"
        - "traefik.http.routers.traefik-secure.tls.domains[0].main=local.example.com"
        - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.local.example.com"
        - "traefik.http.routers.traefik-secure.service=api@internal"

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=http"
      - "traefik.http.routers.traefik.rule=Host(`traefik-dashboard.local.example.com`)"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=USER:BASIC_AUTH_PASSWORD"
      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik-dashboard.local.example.com`)"
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare"
      - "traefik.http.routers.traefik-secure.tls.domains[0].main=local.example.com"
      - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.local.example.com"
      - "traefik.http.routers.traefik-secure.service=api@internal"

networks:
  proxy-overlay:
    external: true

volumes:
  traefik-logs:

In my 'data/traefik.yml' added the following:

[...]
providers:
  docker:
    swarmMode: true
    endpoint: "unix:///var/run/docker.sock"
    watch: true
    exposedByDefault: false
  file:
    filename: /config.yml
    watch: true
[...]

Then I tried to redeploy it in one of the nodes of the Swarm, with docker-compose up -d --force-recreate which ends fine (without any error). However, when I try to browse to the url https://traefik-dashboard.local.example.com it raises a 404 Not found error.

If I revert back to the old docker-compose file and remove the line swarmMode: true from 'data/traefik.yml', everything works fine. The dasboard runs too. However, Traefik is not able to detect and act as a proxy for any cointainer running on other nodes. I want a single instance of Traefik running on one node of a Swarm to detect and proxy requests for other containers in the whole swarm, not only its own node.

Can anyone help?

[sirBreezy]

You need to run "docker stack deploy -c docker-compose.yml traefik" on the swarm master. Docker compose is not for swarm.