Traefik

# 启动
# 配置文件支持 yaml、toml、json
# 人为配置推荐 yaml
traefik --configfile traefik.yaml

providers:
  file:
    # 自动监听该目录配置
    directory: traefik.d
    watch: true

entryPoints:
  http:
    address: ':8080'
  https:
    address: ':8443'

# 全局配置
global:
  checkNewVersion: false
  sendAnonymousUsage: false
# 服务端传输配置
serversTransport:
  insecureSkipVerify: false
  rootCAs: ['foobar', 'foobar']
  maxIdleConnsPerHost: 42
  forwardingTimeouts:
    dialTimeout: 42
    responseHeaderTimeout: 42
    idleConnTimeout: 42

# 默认
entryPoints:
  web:
    address: ':80'
  websecure:
    address: ':443'
# 配置发现
providers:
  providersThrottleDuration: 42
  file:
    directory: traefik.d
    watch: true
    filename: traefik.yaml
    debugLogGeneratedTemplate: true
# 启用 API
api:
  # 不安全模式可以直接访问
  # 安全模式会定义 api@internal 内部服务，需要自行配置路由
  insecure: true
  dashboard: true
  # 添加 /debug 端口
  debug: true
# 指标监控
metrics:
  prometheus:
    buckets: []
    addEntryPointsLabels: true
    addServicesLabels: true
    entryPoint: traefik
# 启用 PING - 用于健康检查 - 端口为 /ping
ping:
  entryPoint: traefik
# 日志配置
log:
  level: INFO
  filePath: traefik.log
  # common/json
  format: common
# 访问日志配置
accessLog:
  filePath: access.log
  format: json
  # 在内存缓冲的行数
  bufferingSize: 100
  # 落日志的条件 - 或 关系
  filters:
    statusCodes: [400, 401]
    # 重试
    retryAttempts: true
    # 至少 10ms
    minDuration: 10
  # 字段控制
  fields:
    # 保留字段
    defaultMode: keep
    names:
      # 丢弃字段
      ClientUsername: drop
      name1: foobar
    headers:
      # 将字段值替换为 redacted
      'User-Agent': 'redact'

# 调用跟踪
tracing:
  serviceName: foobar
  spanNameLimit: 42
  zipkin:
    httpEndpoint: foobar
    sameSpan: true
    id128Bit: true
    sampleRate: 42
# 主机域名解析
hostResolver:
  cnameFlattening: true
  resolvConfig: foobar
  resolvDepth: 5
# 证书解析
certificatesResolvers:
  CertificateResolver0:
    # let‘s encrypt
    acme:
      email: foobar
      caServer: foobar
      storage: foobar
      keyType: foobar
      dnsChallenge:
        provider: foobar
        delayBeforeCheck: 42
        resolvers:
          - foobar
          - foobar
        disablePropagationCheck: true
      httpChallenge:
        entryPoint: foobar
      tlsChallenge: {}

certificatesResolvers:
  pdns:
    acme:
      dnsChallenge:
        # 通过环境变量配置链接信息 PDNS_API_KEY, PDNS_API_URL
        # 环境变量也可以使用 *_FILE 指向文件来配置
        provider: pdns

http:
  routers:
    traefik:
      entryPoints: [https]
      rule: Host(`traefik.example.com`)
      service: api@internal
      tls:
        # 引用定义
        certResolver: pdns
        # 使用通配符证书
        domains:
          - main: example.com
            sans:
              - '*.example.com'

# 运行 docker 添加 -v /var/run/docker.sock:/var/run/docker.sock
providers:
  docker:
    endpoint: 'unix:///var/run/docker.sock'
    # 是否默认暴露服务 - 正常需要 traefik.enable=true
    exposedByDefault: false
    # 默认的映射规则
    # 支持 https://masterminds.github.io/sprig 函数
    # defaultRule: "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"

docker run --rm -it \
  -l traefik.enable=true \
  -l traefik.http.routers.my-container.rule=Host(`mydomain.com`) \
  -l traefik.http.services.my-container-service.loadbalancer.server.port=80
  --name web nginx

# 指定端口 - 多个逗号分割
# traefik.http.routers.my-container.entrypoints=https
# 启用 tls
# traefik.http.routers.my-container.tls=true