Connecting to mysql/mariadb from outside

Traefik Traefik v2
1

Hi there,

I want to be able to access from my network to different mysql/mariadb databases managed by Docker. Example of a service package for:

version: '3.5'
services:
  dc_mysql:
    image: mysql:latest
    container_name: dc_mysql
    command: --default-authentication-plugin=mysql_native_password --secure-file-priv=/tmp
    environment:
      MYSQL_ROOT_PASSWORD: xxxxxx
    security_opt:
       - seccomp:unconfined
    volumes:
      - "/sql/portail/dev:/var/lib/mysql"
      - "./conf.d:/etc/mysql/mysql.conf.d"
    labels:
      - "traefik.enable=true"
      - "traefik.tcp.routers.dc_mysql.entrypoints=mysql"
      - "traefik.tcp.routers.dc_mysql.rule=HostSNI(`dc_mysql.mondomain.fr`)"
      - "traefik.tcp.routers.dc_mysql.tls=true"
      - "traefik.tcp.routers.dc_mysql.tls.certresolver=le"
      - "traefik.tcp.routers.dc_mysql.tls.passthrough=true"
      - "traefik.tcp.services.dc_mysql.loadbalancer.server.port=3306"
    networks:
      - backend
      - traefik

  pma:
    image: phpmyadmin/phpmyadmin:latest
    container_name: pma
    depends_on:
      - dc_mysql
    environment:
      MYSQL_ROOT_PASSWORD: xxxx
      PMA_USER: root
      PMA_PASSWORD: xxxx
      PMA_HOST: dc_mysql
      UPLOAD_LIMIT: 16384M
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pma.entrypoints=web"
      - "traefik.http.routers.pma.rule=Host(`pma.mondomain.fr`)"
    networks:
      - backend
      - traefik

  # use a Dockerfile
  `www-dev
    depends_on:
      - dc_mysql
    build: .
    container_name: `www-dev
    volumes:
      - "/www/dev/extranet/html:/var/www/html"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.`www-dev.entrypoints=web"
      - "traefik.http.routers.`www-dev.rule=Host(`www-dev.mondomain.fr`)"
    networks:
      - backend
      - traefik

networks:
  backend:
    name: portail_dev_backend
  traefik:
    external: true

As I have several mysql/mariadb containers I don't want to use port mapping but HostSNI rules. Unfortunately with this configuration, when I want to connect from the mysql client:

mysql -h dc_mysql.mondomain.fr -u root -p

I have the message

ERROR 2013 (HY000): Lost connection to MySQL server at 'handshake: reading initial communication packet', system error: 11

Docker-compose.yml off traefik

version: '3.3'
services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: always
    ports:
      - "80:80"     # The HTTP port
      - "8080:8080" # The Web UI (enabled by --api)
      - "443:443"
      - "3306:3306" # Mysql
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /etc/traefik/traefik2.yml:/etc/traefik/traefik.yml:ro
      - /etc/traefik/dynamic/:/etc/traefik/dynamic:ro
      - /etc/traefik/letsencrypt/:/letsencrypt/
    secrets:
      - "ovh_endpoint"
      - "ovh_application_key"
      - "ovh_application_secret"
      - "ovh_consumer_key"
    environment:
      - "OVH_ENDPOINT_FILE=/run/secrets/ovh_endpoint"
      - "OVH_APPLICATION_KEY_FILE=/run/secrets/ovh_application_key"
      - "OVH_APPLICATION_SECRET_FILE=/run/secrets/ovh_application_secret"
      - "OVH_CONSUMER_KEY_FILE=/run/secrets/ovh_consumer_key"
      - "OVH_PROPAGATION_TIMEOUT=300"
      - "OVH_POLLING_INTERVAL=10"
    networks:
      - traefik

secrets:
  ovh_endpoint:
    file: "./secrets/ovh_endpoint.secret"
  ovh_application_key:
    file: "./secrets/ovh_application_key.secret"
  ovh_application_secret:
    file: "./secrets/ovh_application_secret.secret"
  ovh_consumer_key:
    file: "./secrets/ovh_consumer_key.secret"

networks:
  traefik:
    external: true

Config /etc/traefik/traefik.yml

global:
  sendAnonymousUsage: false
  checkNewVersion: false

api:
  insecure: true
  dashboard: true
  debug: true

log:
  level: DEBUG

providers:
  docker:
    endpoint: unix:///var/run/docker.sock
    exposedByDefault: false
    network: traefik
  file:
    directory: /etc/traefik/dynamic
    watch: true

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
  mysql:
    address: ":3306/tcp"

certificatesResolvers:
  le:
    acme:
      email: contact@xxxxx.fr
      caServer: https://acme-v02.api.letsencrypt.org/directory
      storage: /letsencrypt/acme.json
      dnsChallenge:
       provider: ovh
       delayBeforecheck: 5
       resolvers:
         - 8.8.8.8
         - 8.8.4.4

Access to the container www-dev.mondomain.fr works perfectly from firefox. To test I tried with the port mapping on the container dc_mysql and I manage to connect to the database. I can't find documentation that explains how to set up the TCP connection by HostSNI in the case of several databases.