「Traefik」一脚踢开Nginx啦

记录反向代理 Traefik 使用技巧。

简介

Traefik 是一个开源的边缘路由器，常用于反向代理、负载均衡等。因为其优秀的服务发现能力，非常适合于在集群中作为大量微服务的代理。

可以去官方文档或中文文档查看更详细准确的技术说明。

用例

Docker Compose

家庭服务代理

配置参考苏洋博客

以 Docker Compose 方式启动 Traefik 服务，并配置自动管理 Let's Encrypt 证书。

• docker-compose.yml

  services:
    traefik:
      image: traefik:v3
      container_name: traefik
      restart: unless-stopped
      ports:
        # - "8080:8080"
        - "80:80"
        - "443:443"
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock:ro
        - /path/to/your/certs:/certs
        - ./config/traefik.yml:/traefik.yml
        - ./config/dynamic.yml:/dynamic.yml
      environment:
        - CF_API_EMAIL=${CF_DNS_EMAIL}
        - CLOUDFLARE_DNS_API_TOKEN=${CF_API_TOKEN}
        - CLOUDFLARE_ZONE_API_TOKEN=${CF_API_TOKEN}
      labels:
        - "traefik.enable=true"
      deploy:
        resources:
          limits:
            cpus: '0.5'
            memory: 256M
      healthcheck:
        test: ["CMD-SHELL", "wget -qO- http://localhost:8080/api/rawdata"]
        interval: 3s
        retries: 10

• traefik.yml

  api:
    dashboard: true
    insecure: true  # 关闭该配置无法访问仪表板，原因未知，因此停止相关端口映射来替  代
  
  entryPoints:
    http:
      address: ":80"
    https:
      address: ":443"
  
  providers:
    docker:
      endpoint: "unix:///var/run/docker.sock"
      exposedByDefault: false
    file:
      filename: /dynamic.yml
      watch: true
  
  certificatesResolvers:
    le:
      acme:
        email: ${CF_DNS_EMAIL}
        storage: /certs/acme.json
        dnsChallenge:
          provider: cloudflare
          delayBeforeCheck: 30
          resolvers:
            - "1.1.1.1:53"
            - "8.8.8.8:53"
  
  global:
    sendAnonymousUsage: false
    checkNewVersion: false

• dynamic.yml

  http:
    routers:
      traefik-dashboard:
        entryPoints: [web]
        rule: Host(`aio.traefik.yirami.xyz`)
        service: dashboard@internal
  
      traefik-dashboard-api:
        entryPoints: [web]
        rule: "Host(`aio.traefik.yirami.xyz`) && PathPrefix(`/api`)"
        service: api@internal
  
      traefik-dashboard-secure:
        entryPoints: [websecure]
        rule: "Host(`aio.traefik.yirami.xyz`)"
        service: dashboard@internal
        tls:
          certResolver: le
          domains:
            - main: aio.traefik.yirami.xyz
            - main: yirami.xyz
              sans:
                - "*.aio.yirami.xyz"
  
      traefik-dashboard-api-secure:
        entryPoints: [websecure]
        rule: "Host(`aio.traefik.yirami.xyz`) && PathPrefix(`/api`)"
        service: api@internal
        tls:
          certResolver: le
  
      nas-aio:
        entryPoints:
          - https
        rule: "Host(`nas.aio.yirami.xyz`)"
        service: nas-aio-service
        tls:
          certResolver: le
  
    services:
      nas-aio-service:
        loadBalancer:
          servers:
            - url: "http://aio.nas.yirami.xyz:19080"