Traefik Docker Lables: Common Practice

Submitted ⁨⁨8⁩ ⁨months⁩ ago⁩ by ⁨Pete90@feddit.de⁩ to ⁨selfhosted@lemmy.world⁩

Hej everyone. My traefik setup has been up and running for a few months now. I love it, a bit scary to switch at first, but I encourage you to look at, if you haven’t. Middelwares are amazing: I mostly use it for CrowdSec and authentication. Theres two things I could use some feedback, though.

I mostly use docker labels to setup routers in traefik. Some people only define on router (HTTP) and some both (+ HTTPS) and I did the latter.

- labels
      - traefik.enable=true
      - traefik.http.routers.jellyfin.entrypoints=web
      - traefik.http.routers.jellyfin.rule=Host(`jellyfin.local.domain.de`)
      - traefik.http.middlewares.jellyfin-https-redirect.redirectscheme.scheme=https
      - traefik.http.routers.jellyfin.middlewares=jellyfin-https-redirect
      - traefik.http.routers.jellyfin-secure.entrypoints=websecure
      - traefik.http.routers.jellyfin-secure.rule=Host(`jellyfin.local.domain.de`)
      - traefik.http.routers.jellyfin-secure.middlewares=local-whitelist@file,default-headers@file
      - traefik.http.routers.jellyfin-secure.tls=true
      - traefik.http.routers.jellyfin-secure.service=jellyfin
      - traefik.http.services.jellyfin.loadbalancer.server.port=8096
      - traefik.docker.network=media

So, I don’t want to serve HTTP at all, all will be redirected to HTTPS anyway. What I don’t know is, if I can skip the HTTP part. Must I define the web entrypoint in order for redirect to work? Or can I define it in the traefik.yml as I did below?

entryPoints:
  ping:
    address: ':88'
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"

I use homepage (from benphelps) as my dashboard and noticed, that when I refresh the page, all those widgets take a long time to load. They did not do that, when I connecte homepage to those services directly using IP:PORT. Now I use URLs provided by traefik, and it’s slow. It’s not really a problem, but I wonder, if I made a mistake somewhere. I’m still a beginner when it comes to this, so any pointers in the right direction are apprecciated. Thank you =)

source

Comments

Sort:hotnew top

lemmyvore@feddit.nl ⁨8⁩ ⁨months⁩ ago
You can skip serving 80 but good practice dictates that you should enable the HSTS header if you do that, so that browsers know to not even try HTTP.

traefik.frontend.headers.STSSeconds: "31536000" traefik.frontend.headers.STSIncludeSubdomains: "true" traefik.frontend.headers.STSPreload: "true"
source
- Pete90@feddit.de ⁨8⁩ ⁨months⁩ ago
  If I do that, can I still connect via HTTP and the browser will then redirect? I don’t think I have a problem with remembering HTTPs, but my family will…
  
  source
  - lemmyvore@feddit.nl ⁨8⁩ ⁨months⁩ ago
    
    If a user types just a domain name in the browser bar (without adding http:// or https://) the browser will try https:// first. If it sees a HSTS header it will refuse to ever access that domain over http://, period, for as long as the header says (this applies to later visits too, the browser will remember that it must not use http://).
    
    If it’s the very first time the user visits your domain and they explicitly type http:// or follow a link that used http://, it depends. If they have a browser setting or addon that automatically upgrades http:// to https:// it will either put them in the first scenario silently, or issue a warning that asks them if they’re sure they want to proceed non-encrypted.
    
    If they get past all these safeguards and attempt to connect to your port 80, again it depends. If they manage to connect to your server it would help if there’s a redirect to https:// there but the damage has already been done…
    
    …because if their ISP (or your ISP, or their company, or the owner of that coffeeshop WiFi they’re using, or someone in their household etc. etc.) is hijacking HTTP connections, the visitor will never reach your port 80. The hijacker will connect to your 443 on their behalf and use their requests to port 80 to relay content pulled from 443, and eavesdrop on everything both ways, obtaining logins and other private info in the process.
    
    So as you can see whether you maintain a redirect on 80 or not is not very important. Ideally your visitors should never attempt unencrypted connections at all. If they do and get hijacked your redirect will be irrelevant.
    
    Redirects on 80 to 443 are relevant if your website is old and gets a significant amount of traffic from http:// links out there, which it cannot afford to miss.
    
    source
    -> View More Comments
Decronym@lemmy.decronym.xyz ⁨8⁩ ⁨months⁩ ago
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters

HTTP Hypertext Transfer Protocol, the Web

HTTPS HTTP over SSL

SSL Secure Sockets Layer, for transparent encryption

[Thread #603 for this sub, first seen 15th Mar 2024, 13:45] [FAQ] [Full list] [Contact] [Source code]

source
chiisana@lemmy.chiisana.net ⁨8⁩ ⁨months⁩ ago
Do you have more than one network in Docker?

If so, you’d want to add a label to tell traefik which network to use; if memory serves, I think it is literally traefik.docker.network=traefik_default or something like that, where traefik_dedault should reflect the network the service is sharing with traefik — I put mine on the traefik default network from docker compose, hence the name but you may have other design.

source
- Pete90@feddit.de ⁨8⁩ ⁨months⁩ ago
  Each service stack (e.g. media, iso downloading) has it’s own network and traefik is in each of those networks as well. It works and seperates the stacks from each other (i don’t want stack a to be able to access stack b, which would be the case with a single traefik network, I think.)
  
  source
  - chiisana@lemmy.chiisana.net ⁨8⁩ ⁨months⁩ ago
    If you don’t mind, can you please try disabling all but one or two stacks and see if your homepage responds faster?
    
    I think although your setup may work, and is definitely better than me dumping everything into the Traefik gateway network, I can’t help but to wonder if Traefik picked up some overhead with each additional network it gets added to…?
    
    source
    -> View More Comments

Fewer Letters	More Letters
HTTP	Hypertext Transfer Protocol, the Web
HTTPS	HTTP over SSL
SSL	Secure Sockets Layer, for transparent encryption