Traefik: Moderner Reverse Proxy für Docker

Traefik ist ein Cloud-nativer Reverse Proxy, der sich automatisch mit Docker integriert. Neue Container werden automatisch erkannt, SSL-Zertifikate via Let's Encrypt generiert.

Vorteile von Traefik

• Auto-Discovery: Erkennt Docker-Container automatisch
• Auto-SSL: Let's Encrypt Zertifikate automatisch
• Dashboard: Web-UI für Monitoring
• Modern: HTTP/2, gRPC, WebSocket Support

Basis-Setup mit Docker Compose

# docker-compose.yml
version: '3.8'

services:
  traefik:
    image: traefik:v3.0
    container_name: traefik
    restart: unless-stopped
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@example.com"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt:/letsencrypt
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$..."

volumes:
  letsencrypt:

Container mit Traefik verbinden

services:
  myapp:
    image: nginx
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.myapp.rule=Host(`app.example.com`)"
      - "traefik.http.routers.myapp.entrypoints=websecure"
      - "traefik.http.routers.myapp.tls.certresolver=letsencrypt"
      - "traefik.http.services.myapp.loadbalancer.server.port=80"

HTTP zu HTTPS Redirect

labels:
  - "traefik.http.routers.myapp-http.rule=Host(`app.example.com`)"
  - "traefik.http.routers.myapp-http.entrypoints=web"
  - "traefik.http.routers.myapp-http.middlewares=redirect-https"
  - "traefik.http.middlewares.redirect-https.redirectscheme.scheme=https"

Mehrere Container

version: '3.8'

services:
  traefik:
    # ... (wie oben)

  wordpress:
    image: wordpress
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.wordpress.rule=Host(`blog.example.com`)"
      - "traefik.http.routers.wordpress.tls.certresolver=letsencrypt"

  nextcloud:
    image: nextcloud
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nextcloud.rule=Host(`cloud.example.com`)"
      - "traefik.http.routers.nextcloud.tls.certresolver=letsencrypt"

Passwort für BasicAuth generieren

# htpasswd installieren
sudo apt install apache2-utils -y

# Passwort generieren ($ muss escaped werden: $$)
echo $(htpasswd -nB admin) | sed -e s/\\$/\\$\\$/g

Weitere Hilfe

• 📖 Traefik Dokumentation
• 📧 E-Mail: support@enjyn.de