Skip to content

Commit e4c668d

Browse files
tiangolotiangolo
authored
✨ Upgrade Traefik to version 2 (fastapi#199)
* 🔧 Add STACK_NAME to .env for Traefik labels * ✨ Upgrade Docker Compose to use Traefik v2 * ✨ Enable Traefik v2 in Docker Compose override for local development * 🐛 Use internal HTTPS redirect in case the deployment is not through DockerSwarm.rocks
1 parent bdc40a1 commit e4c668d

File tree

3 files changed

+106
-57
lines changed

3 files changed

+106
-57
lines changed

‎{{cookiecutter.project_slug}}/.env‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ DOMAIN=localhost
33
# DOMAIN=localhost.tiangolo.com
44
# DOMAIN=dev.{{cookiecutter.domain_main}}
55

6+
STACK_NAME={{cookiecutter.docker_swarm_stack_name_main}}
7+
68
TRAEFIK_PUBLIC_NETWORK=traefik-public
79
TRAEFIK_TAG={{cookiecutter.traefik_constraint_tag}}
810
TRAEFIK_PUBLIC_TAG={{cookiecutter.traefik_public_constraint_tag}}

‎{{cookiecutter.project_slug}}/docker-compose.override.yml‎

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,28 @@ services:
55
ports:
66
- "80:80"
77
- "8090:8080"
8-
command: --docker \
9-
--docker.watch \
10-
--docker.exposedbydefault=false \
11-
--constraints=tag==${TRAEFIK_TAG} \
12-
--logLevel=DEBUG \
13-
--accessLog \
14-
--web
8+
command:
9+
# Enable Docker in Traefik, so that it reads labels from Docker services
10+
- --providers.docker
11+
# Add a constraint to only use services with the label for this stack
12+
# from the env var TRAEFIK_TAG
13+
- --providers.docker.constraints=Label(`traefik.constraint-label-stack`, `${TRAEFIK_TAG}`)
14+
# Do not expose all Docker services, only the ones explicitly exposed
15+
- --providers.docker.exposedbydefault=false
16+
# Disable Docker Swarm mode for local development
17+
# - --providers.docker.swarmmode
18+
# Enable the access log, with HTTP requests
19+
- --accesslog
20+
# Enable the Traefik log, for configurations and errors
21+
- --log
22+
# Enable the Dashboard and API
23+
- --api
24+
# Enable the Dashboard and API in insecure mode for local development
25+
- --api.insecure=true
1526
labels:
16-
- traefik.frontend.rule=Host:${DOMAIN}
1727
- traefik.enable=true
18-
- traefik.port=80
28+
- traefik.http.routers.${STACK_NAME}-traefik-public-http.rule=Host(`${DOMAIN}`)
29+
- traefik.http.services.${STACK_NAME}-traefik-public.loadbalancer.server.port=80
1930

2031
pgadmin:
2132
ports:
@@ -42,10 +53,10 @@ services:
4253
# command: bash -c "while true; do sleep 1; done" # Infinite loop to keep container live doing nothing
4354
command: /start-reload.sh
4455
labels:
45-
- traefik.frontend.rule=PathPrefix:/api,/docs,/redoc
4656
- traefik.enable=true
47-
- traefik.port=80
48-
- traefik.tags=${TRAEFIK_TAG}
57+
- traefik.constraint-label-stack=${TRAEFIK_TAG}
58+
- traefik.http.routers.${STACK_NAME}-backend-http.rule=PathPrefix(`/api`) || PathPrefix(`/docs`) || PathPrefix(`/redoc`)
59+
- traefik.http.services.${STACK_NAME}-backend.loadbalancer.server.port=80
4960

5061
celeryworker:
5162
volumes:
@@ -67,10 +78,10 @@ services:
6778
args:
6879
FRONTEND_ENV: dev
6980
labels:
70-
- traefik.frontend.rule=PathPrefix:/
7181
- traefik.enable=true
72-
- traefik.port=80
73-
- traefik.tags=${TRAEFIK_TAG}
82+
- traefik.constraint-label-stack=${TRAEFIK_TAG}
83+
- traefik.http.routers.${STACK_NAME}-frontend-http.rule=PathPrefix(`/`)
84+
- traefik.http.services.${STACK_NAME}-frontend.loadbalancer.server.port=80
7485

7586
networks:
7687
traefik-public:

‎{{cookiecutter.project_slug}}/docker-compose.yml‎

Lines changed: 78 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -2,44 +2,72 @@ version: "3.3"
22
services:
33

44
proxy:
5-
image: traefik:v1.7
5+
image: traefik:v2.2
66
networks:
77
- ${TRAEFIK_PUBLIC_NETWORK}
88
- default
99
volumes:
1010
- /var/run/docker.sock:/var/run/docker.sock
11-
command: --docker \
12-
--docker.swarmmode \
13-
--docker.watch \
14-
--docker.exposedbydefault=false \
15-
--constraints=tag==${TRAEFIK_TAG} \
16-
--logLevel=INFO \
17-
--accessLog \
18-
--web
11+
command:
12+
# Enable Docker in Traefik, so that it reads labels from Docker services
13+
- --providers.docker
14+
# Add a constraint to only use services with the label for this stack
15+
# from the env var TRAEFIK_TAG
16+
- --providers.docker.constraints=Label(`traefik.constraint-label-stack`, `${TRAEFIK_TAG}`)
17+
# Do not expose all Docker services, only the ones explicitly exposed
18+
- --providers.docker.exposedbydefault=false
19+
# Enable Docker Swarm mode
20+
- --providers.docker.swarmmode
21+
# Enable the access log, with HTTP requests
22+
- --accesslog
23+
# Enable the Traefik log, for configurations and errors
24+
- --log
25+
# Enable the Dashboard and API
26+
- --api
1927
deploy:
2028
placement:
2129
constraints:
2230
- node.role == manager
2331
labels:
24-
# For the configured domain
25-
- traefik.frontend.rule=Host:${DOMAIN}
26-
# For a domain with and without 'www'
27-
# Comment the previous line above and un-comment the line below
28-
# - "traefik.frontend.rule=Host:www.${DOMAIN},${DOMAIN}"
32+
# Enable Traefik for this service, to make it available in the public network
2933
- traefik.enable=true
30-
- traefik.port=80
31-
- traefik.tags=${TRAEFIK_PUBLIC_TAG}
34+
# Use the traefik-public network (declared below)
3235
- traefik.docker.network=${TRAEFIK_PUBLIC_NETWORK}
33-
- traefik.frontend.entryPoints=http,https
34-
- traefik.frontend.redirect.entryPoint=https
35-
# Uncomment the config line below to detect and redirect www to non-www (or the contrary)
36-
# The lines above for traefik.frontend.rule are needed too
37-
# - "traefik.frontend.redirect.regex=^https?://(www.)?(${DOMAIN})/(.*)"
38-
# To redirect from non-www to www un-comment the line below
39-
# - "traefik.frontend.redirect.replacement=https://www.${DOMAIN}/$$3"
40-
# To redirect from www to non-www un-comment the line below
41-
# - "traefik.frontend.redirect.replacement=https://${DOMAIN}/$$3"
42-
36+
# Use the custom label "traefik.constraint-label=traefik-public"
37+
# This public Traefik will only use services with this label
38+
- traefik.constraint-label=${TRAEFIK_PUBLIC_TAG}
39+
# traefik-http set up only to use the middleware to redirect to https
40+
- traefik.http.middlewares.${STACK_NAME}-https-redirect.redirectscheme.scheme=https
41+
- traefik.http.middlewares.${STACK_NAME}-https-redirect.redirectscheme.permanent=true
42+
# Handle host with and without "www" to redirect to only one of them
43+
# Uses environment variable DOMAIN
44+
# To disable www redirection remove the Host() you want to discard, here and
45+
# below for HTTPS
46+
- traefik.http.routers.${STACK_NAME}-proxy-http.rule=Host(`${DOMAIN}`) || Host(`www.${DOMAIN}`)
47+
- traefik.http.routers.${STACK_NAME}-proxy-http.entrypoints=http
48+
# traefik-https the actual router using HTTPS
49+
- traefik.http.routers.${STACK_NAME}-proxy-https.rule=Host(`${DOMAIN}`) || Host(`www.${DOMAIN}`)
50+
- traefik.http.routers.${STACK_NAME}-proxy-https.entrypoints=https
51+
- traefik.http.routers.${STACK_NAME}-proxy-https.tls=true
52+
# Use the "le" (Let's Encrypt) resolver created below
53+
- traefik.http.routers.${STACK_NAME}-proxy-https.tls.certresolver=le
54+
# Define the port inside of the Docker service to use
55+
- traefik.http.services.${STACK_NAME}-proxy.loadbalancer.server.port=80
56+
# Handle domain with and without "www" to redirect to only one
57+
# To disable www redirection remove the next line
58+
- traefik.http.middlewares.${STACK_NAME}-www-redirect.redirectregex.regex=^https?://(www.)?(${DOMAIN})/(.*)
59+
# Redirect a domain with www to non-www
60+
# To disable it remove the next line
61+
- traefik.http.middlewares.${STACK_NAME}-www-redirect.redirectregex.replacement=https://${DOMAIN}/$${3}
62+
# Redirect a domain without www to www
63+
# To enable it remove the previous line and uncomment the next
64+
# - traefik.http.middlewares.${STACK_NAME}-www-redirect.redirectregex.replacement=https://www.${DOMAIN}/$${3}
65+
# Middleware to redirect www, to disable it remove the next line
66+
- traefik.http.routers.${STACK_NAME}-proxy-https.middlewares=${STACK_NAME}-www-redirect
67+
# Middleware to redirect www, and redirect HTTP to HTTPS
68+
# to disable www redirection remove the section: ${STACK_NAME}-www-redirect,
69+
- traefik.http.routers.${STACK_NAME}-proxy-http.middlewares=${STACK_NAME}-www-redirect,${STACK_NAME}-https-redirect
70+
4371
db:
4472
image: postgres:12
4573
volumes:
@@ -64,13 +92,17 @@ services:
6492
- .env
6593
deploy:
6694
labels:
67-
- traefik.frontend.rule=Host:pgadmin.${DOMAIN}
6895
- traefik.enable=true
69-
- traefik.port=5050
70-
- traefik.tags=${TRAEFIK_PUBLIC_TAG}
7196
- traefik.docker.network=${TRAEFIK_PUBLIC_NETWORK}
72-
- traefik.frontend.entryPoints=http,https
73-
- traefik.frontend.redirect.entryPoint=https
97+
- traefik.constraint-label=${TRAEFIK_PUBLIC_TAG}
98+
- traefik.http.routers.${STACK_NAME}-pgadmin-http.rule=Host(`pgadmin.${DOMAIN}`)
99+
- traefik.http.routers.${STACK_NAME}-pgadmin-http.entrypoints=http
100+
- traefik.http.routers.${STACK_NAME}-pgadmin-http.middlewares=${STACK_NAME}-https-redirect
101+
- traefik.http.routers.${STACK_NAME}-pgadmin-https.rule=Host(`pgadmin.${DOMAIN}`)
102+
- traefik.http.routers.${STACK_NAME}-pgadmin-https.entrypoints=https
103+
- traefik.http.routers.${STACK_NAME}-pgadmin-https.tls=true
104+
- traefik.http.routers.${STACK_NAME}-pgadmin-https.tls.certresolver=le
105+
- traefik.http.services.${STACK_NAME}-pgadmin.loadbalancer.server.port=5050
74106

75107
queue:
76108
image: rabbitmq:3
@@ -93,13 +125,17 @@ services:
93125
# - "--broker_api=http://guest:guest@queue:15672/api//"
94126
deploy:
95127
labels:
96-
- traefik.frontend.rule=Host:flower.${DOMAIN}
97128
- traefik.enable=true
98-
- traefik.port=5555
99-
- traefik.tags=${TRAEFIK_PUBLIC_TAG}
100129
- traefik.docker.network=${TRAEFIK_PUBLIC_NETWORK}
101-
- traefik.frontend.entryPoints=http,https
102-
- traefik.frontend.redirect.entryPoint=https
130+
- traefik.constraint-label=${TRAEFIK_PUBLIC_TAG}
131+
- traefik.http.routers.${STACK_NAME}-flower-http.rule=Host(`flower.${DOMAIN}`)
132+
- traefik.http.routers.${STACK_NAME}-flower-http.entrypoints=http
133+
- traefik.http.routers.${STACK_NAME}-flower-http.middlewares=${STACK_NAME}-https-redirect
134+
- traefik.http.routers.${STACK_NAME}-flower-https.rule=Host(`flower.${DOMAIN}`)
135+
- traefik.http.routers.${STACK_NAME}-flower-https.entrypoints=https
136+
- traefik.http.routers.${STACK_NAME}-flower-https.tls=true
137+
- traefik.http.routers.${STACK_NAME}-flower-https.tls.certresolver=le
138+
- traefik.http.services.${STACK_NAME}-flower.loadbalancer.server.port=5555
103139

104140
backend:
105141
image: '${DOCKER_IMAGE_BACKEND}:${TAG-latest}'
@@ -119,10 +155,10 @@ services:
119155
INSTALL_DEV: ${INSTALL_DEV-false}
120156
deploy:
121157
labels:
122-
- traefik.frontend.rule=PathPrefix:/api,/docs,/redoc
123158
- traefik.enable=true
124-
- traefik.port=80
125-
- traefik.tags=${TRAEFIK_TAG}
159+
- traefik.constraint-label-stack=${TRAEFIK_TAG}
160+
- traefik.http.routers.${STACK_NAME}-backend-http.rule=PathPrefix(`/api`) || PathPrefix(`/docs`) || PathPrefix(`/redoc`)
161+
- traefik.http.services.${STACK_NAME}-backend.loadbalancer.server.port=80
126162

127163
celeryworker:
128164
image: '${DOCKER_IMAGE_CELERYWORKER}:${TAG-latest}'
@@ -150,10 +186,10 @@ services:
150186
FRONTEND_ENV: ${FRONTEND_ENV-production}
151187
deploy:
152188
labels:
153-
- traefik.frontend.rule=PathPrefix:/
154189
- traefik.enable=true
155-
- traefik.port=80
156-
- traefik.tags=${TRAEFIK_TAG}
190+
- traefik.constraint-label-stack=${TRAEFIK_TAG}
191+
- traefik.http.routers.${STACK_NAME}-frontend-http.rule=PathPrefix(`/`)
192+
- traefik.http.services.${STACK_NAME}-frontend.loadbalancer.server.port=80
157193

158194
volumes:
159195
app-db-data:

0 commit comments

Comments
 (0)