Skip to content

Commit cc420a9

Browse files
11notes11notes
committed
cut: deadline
1 parent b1dc720 commit cc420a9

File tree

4 files changed

+117
-28
lines changed

4 files changed

+117
-28
lines changed

‎arch.dockerfile‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,7 @@
5858
SOCKET_PROXY_UID=${APP_UID} \
5959
SOCKET_PROXY_GID=${APP_GID} \
6060
SOCKET_PROXY_KEEPALIVE="10s" \
61-
SOCKET_PROXY_TIMEOUT="30s" \
62-
SOCKET_PROXY_DEADLINE="60s"
61+
SOCKET_PROXY_TIMEOUT="30s"
6362

6463
# :: multi-stage
6564
COPY --from=distroless / /

‎compose.yaml‎

Lines changed: 107 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,63 +1,146 @@
1-
name: "traefik"
1+
name: "reverse-proxy"
22
services:
33
socket-proxy:
4-
image: "11notes/socket-proxy:2.1.3"
4+
# this image is used to expose the docker socket as read-only to traefik
5+
# you can check https://github.com/11notes/docker-socket-proxy for all details
6+
image: "11notes/socket-proxy:2.1.4"
57
read_only: true
6-
# make sure to use the same UID/GID as the owner of your docker socket!
7-
user: "0:0"
8+
user: "0:108"
9+
environment:
10+
TZ: "Europe/Zurich"
811
volumes:
9-
# mount host docker socket, the :ro does not mean read-only for the socket, just for the actual file
10-
- "/run/docker.sock:/run/docker.sock:ro"
11-
# this socket is run as 1000:1000, not as root!
12-
- "socket-proxy:/run/proxy"
12+
- "/run/docker.sock:/run/docker.sock:ro"
13+
- "socket-proxy.run:/run/proxy"
1314
restart: "always"
1415

1516
traefik:
16-
image: "11notes/traefik:3.2.0"
1717
depends_on:
1818
socket-proxy:
1919
condition: "service_healthy"
2020
restart: true
21+
image: "11notes/traefik:3.5.0"
22+
read_only: true
23+
labels:
24+
- "traefik.enable=true"
25+
26+
# default errors middleware
27+
- "traefik.http.middlewares.default-errors.errors.status=402-599"
28+
- "traefik.http.middlewares.default-errors.errors.query=/{status}"
29+
- "traefik.http.middlewares.default-errors.errors.service=default-errors"
30+
31+
# default ratelimit
32+
- "traefik.http.middlewares.default-ratelimit.ratelimit.average=100"
33+
- "traefik.http.middlewares.default-ratelimit.ratelimit.burst=120"
34+
- "traefik.http.middlewares.default-ratelimit.ratelimit.period=1s"
35+
36+
# default CSP
37+
- "traefik.http.middlewares.default-csp.headers.contentSecurityPolicy=default-src 'self' blob: data: 'unsafe-inline'"
38+
39+
# default allowlist
40+
- "traefik.http.middlewares.default-ipallowlist-RFC1918.ipallowlist.sourcerange=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
41+
42+
# example on how to secure the traefik dashboard and api
43+
- "traefik.http.routers.dashboard.rule=Host(`${TRAEFIK_FQDN}`)"
44+
- "traefik.http.routers.dashboard.service=api@internal"
45+
- "traefik.http.routers.dashboard.middlewares=dashboard-auth"
46+
- "traefik.http.routers.dashboard.entrypoints=https"
47+
# admin / traefik, please change!
48+
- "traefik.http.middlewares.dashboard-auth.basicauth.users=admin:$2a$12$ktgZsFQZ0S1FeQbI1JjS9u36fAJMHDQaY6LNi9EkEp8sKtP5BK43C"
49+
50+
# default catch-all router
51+
- "traefik.http.routers.default.rule=HostRegexp(`.+`)"
52+
- "traefik.http.routers.default.priority=1"
53+
- "traefik.http.routers.default.entrypoints=https"
54+
- "traefik.http.routers.default.service=default-errors"
55+
56+
# default http to https redirection
57+
- "traefik.http.middlewares.default-http.redirectscheme.permanent=true"
58+
- "traefik.http.middlewares.default-http.redirectscheme.scheme=https"
59+
- "traefik.http.routers.default-http.priority=1"
60+
- "traefik.http.routers.default-http.rule=HostRegexp(`.+`)"
61+
- "traefik.http.routers.default-http.entrypoints=http"
62+
- "traefik.http.routers.default-http.middlewares=default-http"
63+
- "traefik.http.routers.default-http.service=default-http"
64+
- "traefik.http.services.default-http.loadbalancer.passhostheader=true"
65+
environment:
66+
TZ: "Europe/Zurich"
2167
command:
68+
# ping is needed for the health check to work!
69+
- "--ping=true"
70+
- "--ping.terminatingStatusCode=204"
2271
- "--global.checkNewVersion=false"
2372
- "--global.sendAnonymousUsage=false"
73+
- "--accesslog=true"
2474
- "--api.dashboard=true"
25-
- "--api.insecure=true"
75+
# disable insecure api and dashboard access
76+
- "--api.insecure=false"
2677
- "--log.level=INFO"
2778
- "--log.format=json"
2879
- "--providers.docker.exposedByDefault=false"
80+
- "--providers.file.directory=/traefik/var"
2981
- "--entrypoints.http.address=:80"
82+
- "--entrypoints.http.http.middlewares=default-errors,default-ratelimit,default-ipallowlist-RFC1918,default-csp"
3083
- "--entrypoints.https.address=:443"
84+
- "--entrypoints.https.http.tls=true"
85+
- "--entrypoints.https.http.middlewares=default-errors,default-ratelimit,default-ipallowlist-RFC1918,default-csp"
86+
# disable upstream HTTPS certificate checks (https > https)
3187
- "--serversTransport.insecureSkipVerify=true"
88+
- "--experimental.plugins.rewriteResponseHeaders.moduleName=github.com/jamesmcroft/traefik-plugin-rewrite-response-headers"
89+
- "--experimental.plugins.rewriteResponseHeaders.version=v1.1.2"
90+
- "--experimental.plugins.geoblock.moduleName=github.com/PascalMinder/geoblock"
91+
- "--experimental.plugins.geoblock.version=v0.3.3"
3292
ports:
3393
- "80:80/tcp"
3494
- "443:443/tcp"
35-
- "8080:8080/tcp"
95+
volumes:
96+
- "var:/traefik/var"
97+
- "plugins:/traefik/plugins"
98+
# access docker socket via proxy read-only
99+
- "socket-proxy.run:/var/run"
36100
networks:
37-
frontend:
38101
backend:
39-
volumes:
40-
- "socket-proxy:/var/run"
102+
frontend:
41103
sysctls:
104+
# allow rootless container to access ports < 1024
42105
net.ipv4.ip_unprivileged_port_start: 80
43106
restart: "always"
44107

45-
nginx: # example container
46-
image: "11notes/nginx:1.26.2"
108+
errors:
109+
# this image can be used to display a simple error message since Traefik can’t serve content
110+
image: "11notes/traefik:errors"
111+
read_only: true
47112
labels:
48113
- "traefik.enable=true"
49-
- "traefik.http.routers.default.priority=1"
50-
- "traefik.http.routers.default.rule=PathPrefix(`/`)"
51-
- "traefik.http.routers.default.entrypoints=http"
52-
- "traefik.http.routers.default.service=default"
53-
- "traefik.http.services.default.loadbalancer.server.port=8443"
54-
- "traefik.http.services.default.loadbalancer.server.scheme=https" # proxy from http to https since this image runs by default on https
114+
- "traefik.http.services.default-errors.loadbalancer.server.port=8080"
115+
environment:
116+
TZ: "Europe/Zurich"
55117
networks:
56-
backend: # allow container only to be accessed via traefik
118+
backend:
119+
restart: "always"
120+
121+
# example container
122+
nginx:
123+
image: "11notes/nginx:stable"
124+
read_only: true
125+
labels:
126+
- "traefik.enable=true"
127+
- "traefik.http.routers.nginx-example.rule=Host(`${NGINX_FQDN}`)"
128+
- "traefik.http.routers.nginx-example.entrypoints=https"
129+
- "traefik.http.routers.nginx-example.service=nginx-example"
130+
ports:
131+
- "3000:3000/tcp"
132+
tmpfs:
133+
# needed for read_only: true
134+
- "/nginx/cache:uid=1000,gid=1000"
135+
- "/nginx/run:uid=1000,gid=1000"
136+
networks:
137+
backend:
57138
restart: "always"
58139

59140
volumes:
60-
socket-proxy:
141+
var:
142+
plugins:
143+
socket-proxy.run:
61144

62145
networks:
63146
frontend:

‎go/socket-proxy/main.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,15 @@ func main(){
130130
signals()
131131

132132
// setup proxy to docker socket as root
133-
docketSockerDialer := &net.Dialer{KeepAlive: time.ParseDuration(os.Getenv("SOCKET_PROXY_KEEPALIVE")), Timeout: time.ParseDuration(os.Getenv("SOCKET_PROXY_TIMEOUT")), Deadline: time.ParseDuration(os.Getenv("SOCKET_PROXY_DEADLINE"))}
133+
keepAlive, err := time.ParseDuration(os.Getenv("SOCKET_PROXY_KEEPALIVE"))
134+
if err != nil {
135+
log.Fatalf("%s not a valid time format: %s", os.Getenv("SOCKET_PROXY_KEEPALIVE"), err)
136+
}
137+
timeout, err := time.ParseDuration(os.Getenv("SOCKET_PROXY_TIMEOUT"))
138+
if err != nil {
139+
log.Fatalf("%s not a valid time format: %s", os.Getenv("SOCKET_PROXY_TIMEOUT"), err)
140+
}
141+
docketSockerDialer := &net.Dialer{KeepAlive: keepAlive, Timeout: timeout}
134142
dockerSocket, err := docketSockerDialer.Dial("unix", os.Getenv("SOCKET_PROXY_DOCKER_SOCKET"))
135143
if err != nil {
136144
log.Fatalf("could not access docker socket %v", err)

‎project.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ ${{ content_environment }}
3333
| `SOCKET_PROXY_GID` | the GID used to run the proxy parts | 1000 |
3434
| `SOCKET_PROXY_KEEPALIVE` | connection keep alive interval to SOCKET_PROXY_DOCKER_SOCKET | 10s |
3535
| `SOCKET_PROXY_TIMEOUT` | connection max. timeout to SOCKET_PROXY_DOCKER_SOCKET | 30s |
36-
| `SOCKET_PROXY_DEADLINE` | connection max. deadline to SOCKET_PROXY_DOCKER_SOCKET | 60s |
3736

3837
${{ content_source }}
3938

0 commit comments

Comments
 (0)