Deploying Your Container with HTTPS Using Traefik as a Reverse Proxy
Tags: webdev, docker, devops, api
Published: 2023-07-29 05:05:32


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u7mpleqxf0wnfaf6nxx1.png)

## Introduction
In the modern landscape of web applications and services, ensuring secure and efficient traffic routing is crucial. Reverse proxies play a pivotal role in handling incoming requests, enabling SSL termination, and load balancing, all while enhancing the overall security and scalability of your infrastructure. One of the most popular and feature-rich reverse proxies is [Traefik](https://doc.traefik.io/traefik/).

In this blog post, we'll delve into the world of Traefik and explore how to set it up as a powerful reverse proxy. Whether you're managing a single service or a complex microservices architecture, Traefik offers an easy-to-configure and flexible solution that can adapt to your requirements.


## What is Traefik?
Traefik is a modern reverse proxy and load balancer that seamlessly integrates with container orchestration platforms like Docker and Kubernetes. It is based on the concept of EntryPoints, Routers, Middlewares, and Services. This modular approach allows Traefik to provide dynamic configuration, automatic service discovery, and support for multiple backends and protocols.

## ⚡ Key Features of Traefik ⚡

- __Dynamic Configuration__: Traefik's dynamic configuration allows changes to your services to trigger automatic updates without manual intervention, making it highly adaptive and easy to manage.

- __Automatic Service Discovery__: Traefik automatically discovers services running in containers without requiring manual configuration, saving you time and effort in managing routing rules.

- __SSL Termination__: Traefik can handle SSL certificates, making it effortless to secure your services with HTTPS. It can automatically request and renew Let's Encrypt certificates for your domains.

- __Load Balancing__: It distributes incoming requests across multiple instances of a service to ensure optimal utilization and high availability.

- __Middleware Support__: Traefik supports middleware plugins, allowing you to add additional functionalities like authentication, rate limiting, and more, directly in the routing pipeline.

- __Web Dashboard and API__: Traefik provides a user-friendly dashboard and API for monitoring and configuration management, making it convenient to keep an eye on the overall system status.

## Traefik Concepts
Traefik operates on the following core concepts:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8uowwt65yolc6e9itop5.png)

- __EntryPoints__: EntryPoints are the network entry points into Traefik. They define the port that will receive the packets and whether to listen for TCP or UDP traffic.

- __Routers__: A router is in charge of connecting incoming requests to the services that can handle them based on defined rules. Routers match incoming requests with specific conditions (such as host, path, or header values) and route them to the appropriate service.

- __Middlewares__: Middlewares are attached to routers and can modify requests or responses before they are sent to your service. They enable you to apply various transformations, authentication, and rate-limiting rules.

- __Services__: Services are responsible for configuring how to reach the actual services that will eventually handle the incoming requests.

## Setting Up Traefik with Docker Compose 🐳
To demonstrate the deployment of Traefik as a reverse proxy, we'll use Docker Compose, which simplifies the process of defining and running multi-container Docker applications.

### Prerequisites:
- Docker installed on your server or development environment.
- A domain name with DNS configured to point to your server's IP address.

### Step 1: Create a Docker Compose File 👩‍💻 
Create a new file named `docker-compose.yaml` and open it in a text editor. We'll define our Traefik service with the necessary configurations in this file.
```yaml
version: "3"

services:
  traefik:
    image: traefik:v2.10
    command:
      - --api
      - --providers.docker
      - --entrypoints.web.address=:80
      - --entrypoints.traefikapi.address=:8080
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --certificatesresolvers.myresolver.acme.tlschallenge=true
      - --certificatesresolvers.myresolver.acme.email=your_email@email.com
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
    ports:
      # The HTTP port
      - "80:80"
      # The HTTPS port
      - "443:443"
      # The Traefik Dashboard & API port
      - "8080:8080"
    restart: unless-stopped
    volumes:
      # Traefik can listen to the Docker events
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      # acme.json should be created on host instance
      - "./acme.json:/letsencrypt/acme.json"
    labels:
      # Traefik Dashboard HTTP with BasicAuth
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`your_domain.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      - "traefik.http.routers.traefik.entrypoints=traefikapi"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=your_admin_user:your_hashed_admin_password"

  user-api-backend:
    image: your_user_api_image:latest
    labels:
      #  HTTPS YOUR APP
      - "traefik.enable=true"
      - "traefik.http.routers.user-api-backend.rule=Host(`your_domain.com`)"
      - "traefik.http.routers.user-api-backend.entrypoints=websecure"
      - "traefik.http.routers.user-api-backend.tls=true"
      - "traefik.http.routers.user-api-backend.tls.certresolver=myresolver"
      - "traefik.http.services.user-api-backend.loadbalancer.server.port=3000" # YOUR APP PORT
```
### Explanation
__Traefik Service:__ We define a service named **traefik** using the official Traefik image with version 2.10 (you can replace this with the latest version available).
- **command**: The command section configures Traefik with necessary options, including enabling the API, using the Docker provider for dynamic service discovery, and defining entry points for HTTP, HTTPS, and the Traefik dashboard.
- **ports**: The ports section maps the ports 80, 443, and 8080 from the host to the corresponding ports in the Traefik container, allowing external access to these ports.
- **volumes**: The volumes section includes two volume mounts. The first one (`/var/run/docker.sock:/var/run/docker.sock:ro`) allows Traefik to listen to Docker events and dynamically update its configuration when new services are created or removed. The second volume (`./acme.json:/letsencrypt/acme.json`) mounts an acme.json file from the host to store SSL certificates obtained from Let's Encrypt for HTTPS termination.
- **labels**:The labels section contains additional configurations for Traefik:
  - `traefik.enable=true` enables Traefik for this service, allowing it to handle incoming traffic.
  - `traefik.http.routers.traefik.rule=Host('your_domain.com') && (PathPrefix('/api') || PathPrefix('/dashboard'))` defines the routing rule for this service. Requests with the host **your_domain.com** and paths starting with **/api** or **/dashboard** will be routed to Traefik, allowing access to the Traefik dashboard and API.
  - `traefik.http.routers.traefik.entrypoints=traefikapi` specifies that the Traefik dashboard and API should be accessible through the **traefikapi entrypoint**, which is configured in the global entrypoints section.
  - `traefik.http.routers.traefik.service=api@internal` designates the service api@internal for this router, which points to Traefik's internal API service.
  - `traefik.http.routers.traefik.middlewares=auth` associates the auth middleware with this router.
 
 - `traefik.http.middlewares.auth.basicauth.users=your_admin_user:your_hashed_admin_password` [sets up Basic Authentication](https://doc.traefik.io/traefik/middlewares/http/basicauth/) for the Traefik dashboard. Replace **your_admin_user** with the desired admin username and **your_hashed_admin_password** with the hashed password (generated using a tool like htpasswd).


__user-api-backend Service:__ We've added a service named user-api-backend, which represents your user API backend running in a separate container.

- **image**: In this section, replace **your_user_api_image** with the actual name of the image containing your user API backend.

- **labels**: The labels section configures Traefik to handle incoming traffic for the user API backend service.
  - `traefik.enable=true` enables Traefik for this service, allowing it to handle incoming traffic for this container.
  - `traefik.http.routers.user-api-backend.rule=Host('your_domain.com')` defines the routing rule for this service. Requests with the host **your_domain.com** will be routed to this user API backend service.
  - `traefik.http.routers.user-api-backend.entrypoints=websecure` specifies that this service should be accessible through the **websecure entrypoint**, which handles HTTPS traffic.
  - `traefik.http.routers.user-api-backend.tls=true` enables TLS/SSL termination for this service, allowing secure HTTPS communication.
  - `traefik.http.routers.user-api-backend.tls.certresolver=myresolver` specifies the certificate resolver to use for this service, which is the same myresolver used for Traefik itself.
  - `traefik.http.services.user-api-backend.loadbalancer.server.port=3000` indicates that the user API backend service listens on port 3000 within the container. Adjust this port number based on your application's configuration.

> Remember to replace placeholders like `your_domain.com`, `your_email@email.com`, `your_admin_user`, `your_hashed_admin_password`, and `your_user_api_image` with your actual values for a fully functional and secure Traefik setup.

### Step 2: Deploy Traefik 🚀
Save the docker-compose.yaml file and deploy Traefik using Docker Compose:
```bash
docker-compose up -d
```
🚀 Traefik will start running as a reverse proxy, ready to handle incoming requests and provide SSL termination for your services. 🚀

###  Accessing the Traefik Dashboard

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mwpytayv6q7hleapvqei.png)

To access the Traefik dashboard and monitor its activity, visit `http://your_domain.com:8080/dashboard/#/` in your web browser. You'll be prompted to enter the admin credentials you set in the `docker-compose.yaml` file.

## Conclusion
Traefik is a versatile and powerful reverse proxy that simplifies traffic routing, SSL termination, and load balancing for your services. By setting up Traefik with Docker Compose, you can easily manage and scale your infrastructure, ensuring seamless access and security for your applications.