Traefik用Swarm怎么玩?

• 编写traefik配置文件

# traefik.toml
################################################################
# 全局配置
################################################################
[global]
  checkNewVersion = true
  sendAnonymousUsage = true

[log]
  level = "DEBUG"

#自带的API与dashboard面板
[api]
    insecure = true

# 启用压缩中间件
[http.middlewares]
  [http.middlewares.test-compress.compress]
################################################################
# 入口点定义
################################################################
[entryPoints]
  [entryPoints.http]
    address = ":80"

  [entryPoints.https]
    address = ":443"

# 提供给ssh用的端口，为防止占用服务器22端口，映射为8022
  [entryPoints.ssh]
    address = ":8022"

# 自带prometheus用的端口
  [entryPoints.metrics]
    address = ":8082"

#使用自带prometheus收集数据
[metrics]
  [metrics.prometheus]
    entryPoint = "metrics"
    addEntryPointsLabels = true
    addServicesLabels = true

################################################################
# Docker 后端配置
################################################################
[providers.docker]
    endpoint = "unix:///var/run/docker.sock"
    defaultRule = "Host(`{{ normalize .Name }}.docker.localhost`)"
    watch = true
    exposedByDefault = false
    useBindPortIP = true
    swarmMode = true
    #你用的是哪个overlay网桥这里就设哪个
    network = "staging"

################################################################
# ACME (Let's Encrypt) 配置
################################################################
[certificatesResolvers.certbot.acme]
# 用于注册SSL证书的邮箱地址
#
# 必需
#
    email = "[email protected]"

# 证书存储使用的文件或键。
# 警告，如果你在Docker中使用Traefik你有两种选择：
#  - 在你的服务器上创建一个文件并作为一个卷挂载
#      storageFile = "acme.json"
#      $ docker run -v "/my/host/acme.json:/acme.json" traefik
#  - 将包含这个文件的目录作为一个卷挂载
#      storageFile = "/etc/traefik/acme.json"
#      $ docker run -v "/my/host/traefik:/etc/traefik" traefik
#
# 必需
#
    storage = "/etc/traefik/acme.json"

# 所使用的CA服务器
# 注释这行来使其运行在正式环境的Let's Encrypt证书服务器上
#
# 可选
# Default: "https://acme-v02.api.letsencrypt.org/directory"
#
    caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"

#使用一个基于DNS的acme challenge
#泛域名必须使用DNS challenge
#具体定义可查阅 https://docs.traefik.io/v2.0/https/acme/#wildcard-domains
#
    [certificatesResolvers.certbot.acme.dnsChallenge]
        provider = "alidns"
        resolvers = ["223.5.5.5:53", "114.114.114.114:53"]

---

• 运行traefik实例

docker service create \
--name traefik \
--network staging \
-p 8080:8080 -p 80:80 -p 443:443 \
--secret ali_access \
--secret ali_secret \
-e ALICLOUD_ACCESS_KEY_FILE=/run/secrets/ali_access \
-e ALICLOUD_SECRET_KEY_FILE=/run/secrets/ali_secret \
-e TZ=Asia/Shanghai \
--mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock \
--mount type=bind,source=$PWD/traefik,target=/etc/traefik \
traefik

#以下为可选参数
# 重定向中间件
--label traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https \
# 全局重定向到HTTPS
--label traefik.http.routers.http-catchall.rule="hostregexp(\`{host:.+}\`)" \
--label traefik.http.routers.http-catchall.entrypoints=http \
--label traefik.http.routers.http-catchall.middlewares=redirect-to-https \


#不带www转到www
--label traefik.http.middlewares.https-force-www.redirectregex.regex=^https://([^www](?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9])(.+)
--label traefik.http.middlewares.https-force-www.redirectregex.replacement=https://www.$${1}$${2}
--label traefik.http.middlewares.https-force-www.redirectregex.permanent=true

浏览器打开http://localhost:8080 即能看到Traefik的DashBoard

---

• 运行一个gogs实例

docker service create --replicas 1 \
--name gogs \
--network staging \
--mount type=bind,src=$PWD/data/gogs,dst=/data \
--label traefik.enable=true \
--label traefik.http.routers.gogs.rule="Host(\`git.xxxx.com\`)" \
--label traefik.http.routers.gogs.service=gogs \
--label traefik.http.routers.gogs.entrypoints=http,https \
--label traefik.http.routers.gogs.tls.certresolver=certbot \
--label traefik.http.services.gogs.loadbalancer.server.port=3000 \
--label traefik.tcp.routers.gogs.rule="Host(\`git.xxxx.com\`)" \
--label traefik.tcp.routers.gogs.service=gogs \
--label traefik.tcp.routers.gogs.entrypoints=ssh \
--label traefik.tcp.services.gogs.loadbalancer.server.port=22 \
--label traefik.tcp.routers.gogs.tls.certresolver=certbot \
gogs/gogs

Traefik会通过Swarm的网桥发现并与容器通讯，容器无需使用-p参数开放端口

---

• 全部完工，赶紧试一下吧

curl -H Host:git.xxxx.com http://127.0.0.1:80

---

• 避坑指南

1. 官方文档虽然是英文的，但非常详细，多查阅很有帮助
2. 网上文章多是v1版的Traefik配置文件，与v2有较大差异，需仔细分辨
3. ACME在到期30天内会根据容器实例Host指定的参数自动申请SSL证书，所以泛域名非必要
4. 已运行的容器无需重启，修改Label即后生效