How to enable proxyprotocol on a service declared from docker swarm?

Traefik Traefik v2
,
1

Hi,

The symptom

My issue is this log line: level=error msg="field not found, node: proxyprotocol" providerName=docker container=...

My setup

I try to enable proxyprotocol for a service that I am running in a docker service/task/... but it doesn't seems to work. I use "docker stack deploy -c docker-compose.yml" with this file (cleared a bit):

version: "3.8"                                                                                                                     
                                                                                                                                 
services:                                                                                                                          
  blah:                                                                                                                           
    image: blah:latest                                                                                                     
    volumes:                                                                                                                                                                                                                             
      - ./data:/data                                                                                                               
    deploy:                                                                                                                        
      labels:                                                                                                                      
        traefik.enable: "true"                                                                                                     
        traefik.tcp.routers.tcp-587.entrypoints: "smtp"                                                                            
        traefik.tcp.routers.tcp-587.rule: "HostSNI(`*`)"                                                                           
        traefik.tcp.routers.tcp-587.service: "tcp-587"                                                                             
        traefik.tcp.services.tcp-587.loadbalancer.server.port: "587"                                                               
        traefik.tcp.services.tcp-587.loadbalancer.proxyprotocol.version: "2"

Some investigations

  1. I found the documentation: Docker - Traefik
    With "traefik.tcp.services.mytcpservice.loadbalancer.proxyprotocol.version=1".

  2. In the code repo GitHub - traefik/traefik: The Cloud Native Application Proxy I had no match with this: ag proxyprotocol | grep docker and I have no match for golang files while have some with ag proxyprotocol | grep kubernetes.

So I'm asking if the feature is implemented for the docker provider.

Do I miss something?

2

ProxyProtocol should be declared at the EntryPoint in the Traefik static configuration (docs).

entrypoints.websecure.proxyProtocol.trustedIPs=1.2.3.4

3

By my understanding @bluepuma77 ‘s answer is contradicting the v2 docs.

Traefik supports PROXY Protocol version 1 and 2 on TCP Services. It can be enabled by setting proxyProtocol on the load balancer.

## Dynamic configuration
[tcp.services]
  [tcp.services.my-service.loadBalancer]
    [tcp.services.my-service.loadBalancer.proxyProtocol]
      version = 1

The section you are citing - https://doc.traefik.io/traefik/v2.11/routing/entrypoints/#proxyprotocol is about having Traefik accept the proxyProtocol which is by my understanding not what op wants.

I’m currently experiencing the same issue with a traefik.http.service.

4

You can use ProxyProtocol on entrypoints (reference) and TCP services (reference). It's seems not to be implemented for HTTP services, probably because the original IP is already included in the HTTP headers.

5

Thanks for confirming my suspicions. Did a bit more research after the post yesterday and it seems like the service (Stalwart Mail Server) expects the proxy header to be present if the global default trusted proxy is configured. → I’ll have to configure trusted proxies for each entrypoint individually independently from Traefik.