Zum Inhalt

Traefik role

Deploy Traefik v3 as a modern HTTP reverse proxy and load balancer with automatic HTTPS certificate management.

Usage

Configure Traefik in your inventory:

1
2
# group_vars/all.yml
caddy_infomaniak_api_token: your_infomaniak_token_here

Include the role in your playbook:

1
2
3
4
# playbooks/proxmox/deploy_docker_base.yml
- hosts: docker_base
  roles:
    - role: traefik

The role provides these tags: - traefik-install - Deploy Traefik with configuration files - traefik-uninstall - Remove Traefik container and configuration - traefik-update - Update Traefik to latest version - traefik-pull - Pull latest Traefik image

Docs

Deploy Traefik to your Docker host:

1
ansible-playbook -i inventory/hosts.yml playbooks/proxmox/deploy_docker_base.yml --tags traefik-install

Update Traefik to the latest version:

1
ansible-playbook -i inventory/hosts.yml playbooks/proxmox/deploy_docker_base.yml --tags traefik-update

Remove Traefik installation:

1
ansible-playbook -i inventory/hosts.yml playbooks/proxmox/deploy_docker_base.yml --tags traefik-uninstall

Configuration Details

The role deploys Traefik v3.6.1 with: - Automatic HTTPS: Uses Cloudflare DNS challenge for Let's Encrypt certificates - Docker Integration: Automatic service discovery via Docker socket - Configuration Files: - traefik.yaml - Main Traefik configuration - config.yaml - Dynamic configuration - acme.yaml - Certificate resolver configuration - Security: no-new-privileges security option enabled - Persistent Logs: Local volume for access and error logs

Network Configuration

  • Ports Exposed:
  • 80 - HTTP entrypoint (with automatic HTTPS redirect)
  • 443 - HTTPS entrypoint
  • Network: Creates and uses external proxy network for service communication

Dashboard Access

The Traefik dashboard is available at: - URL: https://traefik.rwcloud.ch - Authentication: Currently disabled (commented out in labels)

To enable basic authentication, uncomment these labels and set credentials: 

1
2
- "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_DASHBOARD_CREDENTIALS}"
- "traefik.http.routers.traefik-secure.middlewares=traefik-auth"

Certificate Management

Traefik automatically manages Let's Encrypt certificates using: - Cert Resolver: Cloudflare DNS challenge - Wildcard Support: Configured for *.rwcloud.ch - Main Domain: rwcloud.ch - Provider: Infomaniak API token for DNS updates

Files Created

The role creates these files on the host: - /docker/traefik/traefik.yaml - Main configuration - /docker/traefik/config.yaml - Dynamic routing rules - /docker/traefik/acme.yaml - ACME certificate settings