Lesson 4.2: Traefik Configuration

Traefik Configuration Deep Dive

Configuration Methods

Traefik supports multiple configuration methods:

1. Static Configuration

Defines Traefik startup behavior:

• Entry points (ports)
• Providers (Docker, file, etc.)
• API settings
• Certificate resolvers

2. Dynamic Configuration

Defines routing rules and services:

• Routers and rules
• Services and load balancers
• Middlewares
• TLS certificates

MCT Services Traefik Setup

Docker Compose Configuration

traefik:
  image: traefik:v3.0
  container_name: traefik
  restart: unless-stopped
  command:
    - --api.dashboard=true
    - --ping=true
    - --log.level=INFO
    - --providers.docker=true
    - --providers.docker.exposedbydefault=false
    - --providers.docker.network=mct_public
    - --providers.file.filename=/config/dynamic.mct.yml
    - --providers.file.watch=true
    - --entrypoints.web.address=:80
    - --entrypoints.websecure.address=:443
  ports:
    - "80:80"
    - "443:443"
    - "8080:8080"
  volumes:
    - /var/run/docker.sock:/var/run/docker.sock:ro,z
    - ./traefik/dynamic-complete.yml:/config/dynamic.mct.yml:ro
    - ./certs:/certs:ro
  networks:
    - mct_public
    - mct_private

Key Configuration Elements

Docker Provider

• --providers.docker=true - Enable Docker provider
• --providers.docker.exposedbydefault=false - Require explicit labels
• --providers.docker.network=mct_public - Use specific network

File Provider

• --providers.file.filename=/config/dynamic.mct.yml - Dynamic config file
• --providers.file.watch=true - Watch for changes

Dynamic Configuration File

Our dynamic-complete.yml defines all service routes:

Router Configuration

http:
  routers:
    metube-https:
      rule: "Host(`metube.mct.lan`)"
      entryPoints:
        - websecure
      tls: true
      service: metube
      middlewares:
        - security-headers

Service Configuration

  services:
    metube:
      loadBalancer:
        servers:
          - url: "http://metube:8081"

Middleware Configuration

  middlewares:
    security-headers:
      headers:
        sslRedirect: false
        forceSTSHeader: false
        stsIncludeSubdomains: true
        browserXssFilter: true
        contentTypeNosniff: true
        frameDeny: false
        customFrameOptionsValue: "SAMEORIGIN"

Docker Labels Method

Alternative to file configuration - define routes in Docker Compose:

metube:
  image: alexta69/metube
  labels:
    - "traefik.enable=true"
    - "traefik.docker.network=mct_public"
    - "traefik.http.routers.metube.rule=Host(`metube.mct.lan`)"
    - "traefik.http.routers.metube.entrypoints=websecure"
    - "traefik.http.routers.metube.tls=true"
    - "traefik.http.services.metube.loadbalancer.server.port=8081"

Network Architecture

Network Separation

• mct_public - Web-facing services + Traefik
• mct_private - Databases and internal services
• mct_macvlan - Pi-hole with direct network access

Security Benefits

• Databases not exposed to public network
• Traefik can route to both networks
• Services only expose necessary ports

Health Checks

Traefik can monitor service health:

services:
  captive-portal:
    loadBalancer:
      servers:
        - url: "http://captive-portal-web:80"
      healthCheck:
        path: /health
        interval: 30s
        timeout: 10s

Advanced Routing

Path-Based Routing

rule: "Host(`api.mct.lan`) && PathPrefix(`/v1`)"

Header-Based Routing

rule: "Host(`api.mct.lan`) && Headers(`X-API-Version`, `v2`)"

Priority Routing

priority: 100  # Higher priority routes match first

Monitoring and Debugging

Traefik Dashboard

Access at https://edge.mct.lan to see:

• Active routers and services
• Health status
• Request metrics
• Configuration errors

Logs

docker logs traefik --tail 100

Common Configuration Patterns

HTTP to HTTPS Redirect

middlewares:
  https-redirect:
    redirectScheme:
      scheme: https
      permanent: true

Rate Limiting

middlewares:
  rate-limit:
    rateLimit:
      average: 100
      burst: 200

Authentication

middlewares:
  basic-auth:
    basicAuth:
      users:
        - "admin:$2y$10$..."

Best Practices

Security

• Use HTTPS for all services
• Implement security headers
• Enable rate limiting
• Use strong TLS configuration

Performance

• Enable compression
• Use HTTP/2
• Configure appropriate timeouts
• Implement health checks

Maintenance

• Monitor logs regularly
• Keep certificates updated
• Test configuration changes
• Document custom rules

Next Steps

In the next lesson, we will focus on SSL/TLS certificates and how to generate and manage them for your local domain.