Traefik v2.6 - dynamic configuration

copolycube · March 12, 2022, 12:02am

Hello,

I am struggling with traeffik, trying to keep everything in my docker-compose file and trying to allow the discovery of my other running containers

traefik dashboard works and shows some containers routers beeing ok, but besides the whoami service nothing else is routed correctly (nothing works besides whoami).
this is my current configuration of traefik :

version: '3'

networks:
  web:
    external: true
  internal:
    external: false

volumes:
   netdataconfig:
   netdatalib:
   netdatacache:
   # Volume to store traefik certificates
   traefik-letsencrypt:

services:
  traefik:
    image: "traefik:v2.6"
    container_name: "traefik"
    command:
      - "--log.level=DEBUG"
      # http://ud2.mydomain.com:8080/dashboard/#/
      - "--api.dashboard=true"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.network=internal"
        # Redirect http to https
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.web.http.redirections.entrypoint.permanent=true"
        # Https : port 443, with letsencrypt certificates
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
        # staging letsencrypt, to move to
      - "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.myresolver.acme.email=postmaster@${DOMAIN}"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
        # Expose prometheus metrics : KO - not working
        # logs :
        # level=error msg="entryPoint \"metrics\" doesn't exist" routerName=prometheus@internal entryPointName=metrics
        # level=error msg="no valid entryPoint for this router" routerName=prometheus@internal
        #- "--metrics.prometheus=true"
        #- '--metrics.prometheus.buckets=0.1,0.3,1.2,5.0'
        #- "--metrics.prometheus.entrypoint=metrics"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - traefik-letsencrypt:/letsencrypt
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

This service works correctly both https (http rerouted to https)

  whoami:
    image: "traefik/whoami"
    container_name: "whoami"
    labels:
      - traefik.enable=true
      - traefik.http.routers.whoami.rule=Host(`whoami.${DOMAIN}`)
      - traefik.http.routers.whoami.entrypoints=websecure
      - traefik.http.routers.whoami.tls.certresolver=myresolver
      - traefik.http.services.whoami.loadbalancer.server.port=80

netdata : Gateway Timeout

  netdata:
    container_name: netdata
    image: netdata/netdata
    #ports:
    #  - 19999:19999
    networks:
      - internal
    cap_add:
      - SYS_PTRACE
    security_opt:
      - apparmor:unconfined
    volumes:
      - /etc/passwd:/host/etc/passwd:ro
      - /etc/os-release:/host/etc/os-release:ro
      - /etc/group:/host/etc/group:ro
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
    labels:
      - traefik.enable=true
      - traefik.http.routers.netdata.rule=Host(`netdata.${DOMAIN}`)
      - traefik.http.routers.netdata.entrypoints=websecure
      - traefik.http.routers.netdata.tls.certresolver=myresolver
      - traefik.http.services.netdata.loadbalancer.server.port=19999

cadvisor 404 page not found

        # Container Advisor : mesures of docker containers
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.43.0
    container_name: cadvisor
    privileged: true
    devices:
      - /dev/kmsg:/dev/kmsg
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      #- /var/snap/docker/common/var-lib-docker:/var/lib/docker:ro # for ubuntu snap installation of docker
      - /var/lib/docker:/var/lib/docker:ro # does not exist for ubuntu snap installation of docker
      #- /cgroup:/cgroup:ro #doesn't work on MacOS only for Linux
      - /sys/fs/cgroup/:/cgroup:ro # where I found it on ubuntu 18.04
      - /etc/machine-id:/etc/machine-id:ro
      - /var/lib/dbus/machine-id:/var/lib/dbus/machine-id:ro
        #network_mode: host
    command:
      - '--docker_only=true'
      - '--housekeeping_interval=10s'
    restart: always
    environment:
      - CADVISOR_HEALTHCHECK_URL=http://localhost:8080/cadvisor/healthz
    labels:
            #- org.label-schema.group="monitoring"
      - traefik.enable=true
      - traefik.http.routers.cadvisor.rule=Host(`cadvisor.${DOMAIN}`)
      - traefik.http.routers.cadvisor.entrypoints=websecure
      - traefik.http.routers.cadvisor.tls.certresolver=myresolver
      - traefik.http.services.cadvisor.loadbalancer.server.port=8080
        #ports:
        #    - 9090:8080
    networks:
      - internal

I actually don't even understand why netdata and cadvisor result in different error messages.

Thanks in advance for any clue that might help !

cakiwi · March 15, 2022, 6:04pm

Traefik and whoami share the same network, none is defined so they have ${PROJECT_NAME}_default.

Netdata is only on the internal network. Traefik and Netdata need a common network. Add netdata to default or vice versa. If netdata uses two network you will need to add another label traefik.docker.network.

Cadvisor would have the same issue with networking, but as a guess the container isn't starting correctly, thus the labels are not detected.

copolycube · March 15, 2022, 11:05pm

Thanks a lot !

Full working example if anyone passes by here later

docker-compose.yml with:

service	version
`docker-compose`	`3`
`traefik`	`v2.6`
`cadvisor`	`v0.43.0`
`whoami`	n/a

version: '3'

networks:
  web:
    external: true
  internal:
    external: false

volumes:
   # Volume to store traefik certificates
   traefik-letsencrypt:

  traefik:
    image: "traefik:v2.6"
    container_name: "traefik"
    command:
      - "--log.level=DEBUG"
	  # http://HOSTNAME:8080/dashboard/#/ 
      - "--api.dashboard=true"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.network=internal"
        # Redirect http to https
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.web.http.redirections.entrypoint.permanent=true"
        # Https : port 443, with letsencrypt certificates
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
        # staging letsencrypt, to move to
        #- "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.myresolver.acme.email=postmaster@${DOMAIN}"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
        # Expose prometheus metrics : KO - not working
        # logs :
        # level=error msg="entryPoint \"metrics\" doesn't exist" routerName=prometheus@internal entryPointName=metrics
        # level=error msg="no valid entryPoint for this router" routerName=prometheus@internal
      - "--metrics.prometheus=true"
      - '--metrics.prometheus.buckets=0.1,0.3,1.2,5.0'
      #- "--metrics.prometheus.entrypoint=metrics"
      #- "--accesslog=true"
        #- "--tracing=true"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - traefik-letsencrypt:/letsencrypt
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    networks:
      - web
      - internal

  whoami:
    image: "traefik/whoami"
    container_name: "whoami"
    networks:
      - internal
    labels:
      - traefik.enable=true
      - traefik.docker.network=internal
      - traefik.http.routers.whoami.rule=Host(`whoami.${DOMAIN}`)
      - traefik.http.routers.whoami.entrypoints=websecure
      - traefik.http.routers.whoami.tls.certresolver=myresolver
      - traefik.http.services.whoami.loadbalancer.server.port=80

  # Container Advisor : mesures of docker containers
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.43.0
    container_name: cadvisor
    privileged: true
    devices:
      - /dev/kmsg:/dev/kmsg
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      #- /var/snap/docker/common/var-lib-docker:/var/lib/docker:ro # for ubuntu snap installation of docker
      - /var/lib/docker:/var/lib/docker:ro # does not exist for ubuntu snap installation of docker
      #- /cgroup:/cgroup:ro #doesn't work on MacOS only for Linux
      - /sys/fs/cgroup/:/cgroup:ro # where I found it on ubuntu 18.04
      - /etc/machine-id:/etc/machine-id:ro
      - /var/lib/dbus/machine-id:/var/lib/dbus/machine-id:ro
        #network_mode: host
    command:
      - '--docker_only=true'
      - '--housekeeping_interval=10s'
    restart: always
    expose:
      - 8080
    networks:
      - internal
    healthcheck:
      test: ["CMD", "wget", "--tries=1", "--spider", "http://localhost:8080/healthz"]
      interval: 10s
      timeout: 5s
    environment:
      - CADVISOR_HEALTHCHECK_URL=http://localhost:8080/cadvisor/healthz
    labels:
      - org.label-schema.group="monitoring"
      - traefik.enable=true
      - traefik.docker.network=internal
      - traefik.http.services.cadvisor.loadbalancer.server.port=8080
        #- traefik.http.routers.cadvisor.rule=PathPrefix(`/cadvisor`)
      - traefik.http.routers.cadvisor.rule=Host(`cadvisor.${DOMAIN}`)
      - traefik.http.routers.cadvisor.entrypoints=websecure
      - traefik.http.routers.cadvisor.tls.certresolver=myresolver

        # https://stackoverflow.com/questions/65020158/google-cadvisor-with-traefik

copolycube · March 16, 2022, 9:25pm

also saved here : Traefik v2 + monitoring (cadvisor, node-exporter, netdata, whoami) dynamic routing · GitHub

system · March 19, 2022, 9:26pm

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Traefik returns me a 404 with HTTPS Traefik v2 docker , file , dashboard-api , cli	3	428	May 16, 2022
Some problems with traefik and docker Traefik v2 docker	1	360	January 8, 2021
Working example of traefikv2 setup with whoami and secure dashboard Traefik v2 docker	2	2243	August 13, 2021
Routing dont working Traefik v2 docker	3	146	February 7, 2024
Does this docker-compose allow access to the traefik dashboard? If so, on which url? Traefik v2 docker , dashboard-api , letsencrypt-acme	2	1580	April 16, 2023

Traefik v2.6 - dynamic configuration

Related Topics