mirror of
https://github.com/bluepuma77/traefik-best-practice.git
synced 2025-12-21 13:23:10 +01:00
47 lines
1.9 KiB
Markdown
47 lines
1.9 KiB
Markdown
# docker-traefik-proxyprotocol
|
|
|
|
Example of using ProxyProtocol between Traefik and target service.
|
|
|
|
Traefik will proxy/forward all (encrypted) TCP traffic on `entrypoints` 8000, 8001, 8002 untouched to a target service. Port 8000 uses no proxy protocol, port 8001 uses proxy protocol v1 and port 8002 uses proxy protocol v2 to target.
|
|
|
|
The target service is a simple NodeJS echo service showing the headers and optional proxy protocol and optional TLS. It will use a simple custom TLS certificate, which can be created with
|
|
```
|
|
openssl req -x509 -newkey rsa:4096 -keyout private-key.pem -out certificate.pem -days 365 -nodes
|
|
```
|
|
|
|
Then you can use something like `curl -k https://echo.example.com:<port>` for requests to the target service with end-to-end TLS encryption, without Traefik having access to the TLS certs. Of course this limits to one target service per port.
|
|
|
|
## Deployment:
|
|
- Adapt all domain names in `Host()`
|
|
- Adapt `acme.email`
|
|
- Adapt dashboard username/password
|
|
- For production: write logs files to mounted folder on host
|
|
- Run `docker compose -p proxyprotocol up -d --build --force-recreate`
|
|
- For logs `docker compose -p proxyprotocol logs -f`
|
|
|
|
## Little NodeJS echo service
|
|
- accepts http request with and without proxy protocol (v1/v2)
|
|
- accepts http request with and without TLS encryption
|
|
- responds with connection information and echos http headers:
|
|
```
|
|
{
|
|
"proxyProtocolVersion": "v2",
|
|
"connectionSourceIp": "::ffff:172.19.0.2",
|
|
"proxyProtocolSourceIp": "8.7.6.5",
|
|
"isTLS": true,
|
|
"http": {
|
|
"method": "GET",
|
|
"path": "/",
|
|
"version": "HTTP/1.1"
|
|
},
|
|
"httpHeaders": {
|
|
"host": "echo.example.com:8002",
|
|
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15) Gecko/20100101 Firefox/134.0",
|
|
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
|
|
"accept-encoding": "gzip, deflate, br, zstd",
|
|
...
|
|
}
|
|
}
|
|
```
|
|
|