[Request] Traefik as a service in a LXC Container

[Uzurka]

This... This request can be weird.
For years now, i use Traefik as a reverse proxy & load-balancer for all my services exposed to the WEB
Recently, for security purposes, i decided to put traefik container in an isolated virtual machine, but it requires a VM with :

• Debian
• Docker
• Traefik
• All the stuff i deploy using Ansible to monitor, secure, and access to this VM

This is heavy

Even if it's not documented by Traefik themselves, traefik can be installed as a service on Debian, in a simple way tho
Wonder if someone could do a script here that handles that in a LXC Container :)

[Uzurka]

Scripts & merge done.
0758565
This installs a very basic traefik service.
Things to edit :
/etc/traefik/config.yaml :

certificatesResolvers:
  letsencrypt:
    acme:
      email: "foo@bar.com"
      storage: /etc/traefik/ssl/acme.json
      tlsChallenge: {}

Replace your email address here

For those who wants to use OVH/Cloudflare/Other registrar DNS challenge for TLS :
Add to /etc/systemd/system/traefik.service the variables like :

[Unit]
Description=Traefik

[Service]
Type=notify
ExecStart=/usr/bin/traefik --configFile=/etc/traefik/traefik.yaml
Restart=on-failure
ExecReload=/bin/kill -USR1 $MAINPID
Environment="CF_API_EMAIL=REDACTED"
Environment="CF_API_KEY=REDACTED"
Environment="OVH_ENDPOINT=REDACTED"
Environment="OVH_APPLICATION_KEY=REDACTED"
Environment="OVH_APPLICATION_SECRET=REDACTED"
Environment="OVH_CONSUMER_KEY=REDACTED"

[Install]
WantedBy=multi-user.target

This line in the service :
ExecReload=/bin/kill -USR1 $MAINPID
Permit logrotate postrotate (Traefik will close and reopen the logs files when receive USR1 kill signal)

By default, access logs will be in JSON format, which is parseable by Crowdsec-bouncer using the crowdsecurity/traefik-logs parser

Here's an exemple of a router configuration (stored in /etc/traefik/conf.d/router_name.yml) :

http:
  routers:
    gitea:
      entryPoints:
        - "websecure"
      rule: "Host(`git.foo.bar`)"
      tls:
        certresolver: letsencrypt
      service: gitea

  services:
    gitea:
      loadBalancer:
        servers:
          - url: "http://192.168.1.11:8186"
        passHostHeader: true

conf.d folder contains dynamic configuration, which means that Traefik don't need a restart nor a reload to use those files.
For more examples, like middlewares, refer to traefik documentation, make sure to select "yaml" instead of docker labels.
toml also works

[di5cord20]

Just finished setting up my Traefik LXC - worked perfectly! Thanks for the great script.

[info-path]

Can variables be defined in another way? For example in an .env file? I'm trying to define the variable TRAEFIK_DASHBOARD_CREDENTIALS in file /etc/systemd/system/traefik.service:

[Service]
Environment="TRAEFIK_DASHBOARD_CREDENTIALS=admin:$$2v$$05$$T.7NADpWqYcsVtiq0pSbXeXABxprzol9/eZ7iM08nnVVYNXVroGAa"

but I keep getting an error with this entry:

middlewares:
traefik-auth:
  basicAuth:
    users: 
      - "${TRAEFIK_DASHBOARD_CREDENTIALS}"

Error:

{"level":"error","entryPointName":"https","routerName":"traefik-secure@file","error":"error parsing BasicUser: ${TRAEFIK_DASHBOARD_CREDENTIALS}","time":"2024-06-25T00:01:17+02:00"}

[Uzurka]

Yes you can :

[Service]
EnvironmentFile=/path/to/some/file

And put your env in that file.

[info-path]

Yes, I started with this setup, but I wasn't sure if it worked:

[Service]
EnvironmentFile=/etc/traefik/.env

Even with this setting, it's giving me an error:
{"level": "error", "entryPointName": "https", "routerName": "traefik-secure@file", "error": "error parsing BasicUser: ${TRAEFIK_DASHBOARD_CREDENTIALS}", "time": "2024-06-25T10:25:21+02:00"}

My /etc/traefik/.env file contains:
TRAEFIK_DASHBOARD_CREDENTIALS=admin:$$2y$$05$weS2EnUtgMGjZp1FIoSFWeKjcJqdhbnE97EUOx/UE18Q76k5vsNOi

I have an error somewhere...

[Uzurka]

Maybe try to quote the value of the variable Le 25 juin 2024 à 10:33, info-path ***@***.***> a écrit : Yes, I started with this setup, but I wasn't sure if it worked: [Service] EnvironmentFile=/etc/traefik/.env Even with this setting, it's giving me an error: {"level": "error", "entryPointName": "https", "routerName": ***@***.***", "error": "error parsing BasicUser: ${TRAEFIK_DASHBOARD_CREDENTIALS}", "time": "2024-06-25T10:25:21+02:00"} My /etc/traefik/.env file contains: TRAEFIK_DASHBOARD_CREDENTIALS=admin:$$2y$$05$weS2EnUtgMGjZp1FIoSFWeKjcJqdhbnE97EUOx/UE18Q76k5vsNOi I have an error somewhere... —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***>

[info-path]

@Uzurka: Are you sure the EnvironmentFile directive really works? I tried writing with apostrophe and quotes and nothing helped. Now I tried inserting a different variable and nothing came through.

[Uzurka]

Tbh I don’t know. Maybe give a look at Systemd documentation ;)Le 25 juin 2024 à 14:19, info-path ***@***.***> a écrit : @Uzurka: Are you sure the EnvironmentFile directive really works? I tried writing with apostrophe and quotes and nothing helped. Now I tried inserting a different variable and nothing came through. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>

[di5cord20]

The syntax is different when passing env variables to yml files. The below works for my.

traefik.service:
Environment="ENV_VARIABLE_NAME=your_value"

yml file reference:
{{ env ENV_VARIABLE_NAME }}

Edit: after restarting Traefik, I got errors. Looks like I was serving cached sites. The above didn't work for me.