Skip to content
This repository has been archived by the owner on May 6, 2021. It is now read-only.

✨ Docker Swarm mode with Traefik v2 #127

Merged
merged 2 commits into from
May 26, 2020
Merged

✨ Docker Swarm mode with Traefik v2 #127

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
da28691
⬆️ Upgrade Docker Compose for Docker Swarm to use Traefik v2
tiangolo May 24, 2020
86b009d
📝 Update README for Traefik v2
tiangolo May 24, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 1 addition & 7 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ These instructions assume you already have Traefik set up following that guide a

* With automatic HTTPS certificate generation.
* A Docker Swarm network `traefik-public`.
* Filtering to only serve containers with a tag `traefik-public`.
* Filtering to only serve containers with a label `traefik.constraint-label=traefik-public`.

### Instructions

Expand Down Expand Up @@ -112,12 +112,6 @@ and make sure that the following sub-domains point to your Docker Swarm cluster

**Note**: You can also use a subdomain, like `swarmprom.example.com`. Just make sure that the subdomains point to (at least one of) your cluster IPs. Or set up a wildcard subdomain (`*`).

* Set and export an environment variable with the tag used by Traefik public to filter services (by default, it's `traefik-public`):

```bash
export TRAEFIK_PUBLIC_TAG=traefik-public
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have never used this to override the Traefik tag, I don't know anyone that has. And I'm making it "fixed" by default, in DockerSwarm.rocks and in the project generators (for FastAPI), so it's easier to simplify that and remove the optional env var to reduce complexity/noise.

```

* If you are using Slack and want to integrate it, set the following environment variables:

```bash
Expand Down
77 changes: 42 additions & 35 deletions docker-compose.traefik.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,16 +88,17 @@ services:
reservations:
memory: 64M
labels:
- traefik.frontend.rule=Host:grafana.${DOMAIN}
- traefik.enable=true
- traefik.port=3000
- traefik.tags=${TRAEFIK_PUBLIC_TAG:-traefik-public}
- traefik.docker.network=traefik-public
# Traefik service that listens to HTTP
- traefik.redirectorservice.frontend.entryPoints=http
- traefik.redirectorservice.frontend.redirect.entryPoint=https
# Traefik service that listens to HTTPS
- traefik.webservice.frontend.entryPoints=https
- traefik.constraint-label=traefik-public
- traefik.http.routers.swarmprom-grafana-http.rule=Host(`grafana.${DOMAIN?Variable DOMAIN not set}`)
- traefik.http.routers.swarmprom-grafana-http.entrypoints=http
- traefik.http.routers.swarmprom-grafana-http.middlewares=https-redirect
- traefik.http.routers.swarmprom-grafana-https.rule=Host(`grafana.${DOMAIN?Variable DOMAIN not set}`)
- traefik.http.routers.swarmprom-grafana-https.entrypoints=https
- traefik.http.routers.swarmprom-grafana-https.tls=true
- traefik.http.routers.swarmprom-grafana-https.tls.certresolver=le
- traefik.http.services.swarmprom-grafana.loadbalancer.server.port=3000

alertmanager:
image: stefanprodan/swarmprom-alertmanager:v0.14.0
Expand Down Expand Up @@ -126,17 +127,19 @@ services:
reservations:
memory: 64M
labels:
- traefik.frontend.rule=Host:alertmanager.${DOMAIN}
- traefik.enable=true
- traefik.port=9093
- traefik.tags=${TRAEFIK_PUBLIC_TAG:-traefik-public}
- traefik.docker.network=traefik-public
# Traefik service that listens to HTTP
- traefik.redirectorservice.frontend.entryPoints=http
- traefik.redirectorservice.frontend.redirect.entryPoint=https
# Traefik service that listens to HTTPS
- traefik.webservice.frontend.entryPoints=https
- traefik.frontend.auth.basic.users=${ADMIN_USER}:${HASHED_PASSWORD}
- traefik.constraint-label=traefik-public
- traefik.http.routers.swarmprom-alertmanager-http.rule=Host(`alertmanager.${DOMAIN?Variable DOMAIN not set}`)
- traefik.http.routers.swarmprom-alertmanager-http.entrypoints=http
- traefik.http.routers.swarmprom-alertmanager-http.middlewares=https-redirect
- traefik.http.routers.swarmprom-alertmanager-https.rule=Host(`alertmanager.${DOMAIN?Variable DOMAIN not set}`)
- traefik.http.routers.swarmprom-alertmanager-https.entrypoints=https
- traefik.http.routers.swarmprom-alertmanager-https.tls=true
- traefik.http.routers.swarmprom-alertmanager-https.tls.certresolver=le
- traefik.http.services.swarmprom-alertmanager.loadbalancer.server.port=9093
- traefik.http.middlewares.swarmprom-alertmanager-auth.basicauth.users=${ADMIN_USER?Variable ADMIN_USER not set}:${HASHED_PASSWORD?Variable HASHED_PASSWORD not set}
- traefik.http.routers.swarmprom-alertmanager-https.middlewares=swarmprom-alertmanager-auth

unsee:
image: cloudflare/unsee:v0.8.0
Expand All @@ -150,17 +153,19 @@ services:
mode: replicated
replicas: 1
labels:
- traefik.frontend.rule=Host:unsee.${DOMAIN}
- traefik.enable=true
- traefik.port=8080
- traefik.tags=${TRAEFIK_PUBLIC_TAG:-traefik-public}
- traefik.docker.network=traefik-public
# Traefik service that listens to HTTP
- traefik.redirectorservice.frontend.entryPoints=http
- traefik.redirectorservice.frontend.redirect.entryPoint=https
# Traefik service that listens to HTTPS
- traefik.webservice.frontend.entryPoints=https
- traefik.frontend.auth.basic.users=${ADMIN_USER}:${HASHED_PASSWORD}
- traefik.constraint-label=traefik-public
- traefik.http.routers.swarmprom-unsee-http.rule=Host(`unsee.${DOMAIN?Variable DOMAIN not set}`)
- traefik.http.routers.swarmprom-unsee-http.entrypoints=http
- traefik.http.routers.swarmprom-unsee-http.middlewares=https-redirect
- traefik.http.routers.swarmprom-unsee-https.rule=Host(`unsee.${DOMAIN?Variable DOMAIN not set}`)
- traefik.http.routers.swarmprom-unsee-https.entrypoints=https
- traefik.http.routers.swarmprom-unsee-https.tls=true
- traefik.http.routers.swarmprom-unsee-https.tls.certresolver=le
- traefik.http.services.swarmprom-unsee.loadbalancer.server.port=8080
- traefik.http.middlewares.swarmprom-unsee-auth.basicauth.users=${ADMIN_USER?Variable ADMIN_USER not set}:${HASHED_PASSWORD?Variable HASHED_PASSWORD not set}
- traefik.http.routers.swarmprom-unsee-https.middlewares=swarmprom-unsee-auth

node-exporter:
image: stefanprodan/swarmprom-node-exporter:v0.16.0
Expand Down Expand Up @@ -216,14 +221,16 @@ services:
reservations:
memory: 128M
labels:
- traefik.frontend.rule=Host:prometheus.${DOMAIN}
- traefik.enable=true
- traefik.port=9090
- traefik.tags=${TRAEFIK_PUBLIC_TAG:-traefik-public}
- traefik.docker.network=traefik-public
# Traefik service that listens to HTTP
- traefik.redirectorservice.frontend.entryPoints=http
- traefik.redirectorservice.frontend.redirect.entryPoint=https
# Traefik service that listens to HTTPS
- traefik.webservice.frontend.entryPoints=https
- traefik.frontend.auth.basic.users=${ADMIN_USER}:${HASHED_PASSWORD}
- traefik.constraint-label=traefik-public
- traefik.http.routers.swarmprom-prometheus-http.rule=Host(`prometheus.${DOMAIN?Variable DOMAIN not set}`)
- traefik.http.routers.swarmprom-prometheus-http.entrypoints=http
- traefik.http.routers.swarmprom-prometheus-http.middlewares=https-redirect
- traefik.http.routers.swarmprom-prometheus-https.rule=Host(`prometheus.${DOMAIN?Variable DOMAIN not set}`)
- traefik.http.routers.swarmprom-prometheus-https.entrypoints=https
- traefik.http.routers.swarmprom-prometheus-https.tls=true
- traefik.http.routers.swarmprom-prometheus-https.tls.certresolver=le
- traefik.http.services.swarmprom-prometheus.loadbalancer.server.port=9090
- traefik.http.middlewares.swarmprom-prometheus-auth.basicauth.users=${ADMIN_USER?Variable ADMIN_USER not set}:${HASHED_PASSWORD?Variable HASHED_PASSWORD not set}
- traefik.http.routers.swarmprom-prometheus-https.middlewares=swarmprom-prometheus-auth