Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:traefik_-_un_reverse_proxy_pour_docker [2025/11/11 18:49] – Jean-Baptiste
+++ tech:traefik_-_un_reverse_proxy_pour_docker [2026/06/07 19:12] (Version actuelle) – modification externe 127.0.0.1
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Brouillon Proxy Docker}}
+# Traefik - un reverse proxy pour Docker
+Voir aussi :
+* https://www.grottedubarbu.fr/kubernetes-portainer-traefik/
+* https://www.grottedubarbu.fr/securiser-socket-docker/
+`traefik.yml`
+~~~yaml
+entryPoints:
+  web:
+    address: ":80"
+  websecure:
+    address: ":443"
+serversTransport:
+  insecureSkipVerify: true
+#  rootCAs:
+#    - certs/inter-chain.pem
+providers:
+  file:
+    filename: dynamic_conf.yml
+    watch: true
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    exposedByDefault: false
+log:
+  #level: DEBUG
+  level: INFO
+api:
+  dashboard: true
+  #debug: true
+  #insecure: true
+~~~
+`dynamic_conf.yml`
+~~~yaml
+tls:
+  certificates:
+    - certFile: certs/registry.docker.local.crt
+      keyFile: certs/registry.docker.local.key
+    - certFile: certs/wildcard.docker.local.crt
+      keyFile: certs/wildcard.docker.local.key
+      stores:
+        - default
+  stores:
+    default:
+      defaultCertificate:
+        certFile: certs/wildcard.docker.local.crt
+        keyFile: certs/wildcard.docker.local.key
+  options:
+    default:
+      minVersion: VersionTLS12
+      sniStrict: true
+~~~
+`docker-compose.yml`
+~~~yaml
+version: '3.7'
+services:
+  traefik:
+    image: traefik
+    #restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+      - $PWD/traefik.yml:/traefik.yml:ro
+      - $PWD/dynamic_conf.yml:/dynamic_conf.yml:ro
+      - $PWD/certs:/certs:ro
+#    environment:
+#      PUID: ${PUID}
+#      PGID: ${PGID}
+#      TZ: ${TZ}
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.dashboard.entrypoints=web
+      - traefik.http.routers.dashboard.rule=Host(`traefik.docker.local`)
+      #- traefik.http.services.s-dashboard.loadbalancer.server.port=8080
+      - traefik.port=8080
+      - traefik.http.routers.s-dashboard.entrypoints=websecure
+      - traefik.http.routers.s-dashboard.rule=Host(`traefik.docker.local`)
+      - traefik.http.routers.s-dashboard.service=api@internal
+      - traefik.http.routers.s-dashboard.middlewares=auth@docker
+      # mkpasswd -m md5 |sed -e 's/\$/$$/g'
+      - traefik.http.middlewares.auth.basicauth.users=jean:$$1$$qvbVKuOn$$qKZpjcMQuMFWNgC9vtycL1
+      - traefik.http.routers.s-dashboard.tls=true
+      - traefik.http.routers.dashboard.middlewares=https-redirect@docker
+      - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
+      - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
+#  hello:
+#    image: osones/helloworld
+#    labels:
+#      - traefik.enable=true
+#      - traefik.http.routers.hw.entrypoints=web
+#      - traefik.http.routers.hw.rule=Host(`hw.docker.local`)
+#      - traefik.http.routers.s-hw.entrypoints=websecure
+#      - traefik.http.routers.s-hw.rule=Host(`hw.docker.local`)
+#      - traefik.http.routers.s-hw.tls=true
+#      - traefik.http.routers.hw.middlewares=https-redirect@docker
+#      - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
+#      - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
+#      #- "traefik.port=80"
+#      #- "traefik.backend=hello"
+  redis:
+    image: redis
+    #restart: unless-stopped
+    restart: always
+  registry:
+    image: registry:2
+    depends_on:
+      - redis
+    environment:
+    environment:
+      - REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/data
+      - REGISTRY_STORAGE_CACHE_BLOBDESCRIPTOR=redis
+      - REGISTRY_REDIS_ADDR=redis:6379
+    volumes:
+      - $PWD/data:/data
+    labels:
+      - traefik.enable=true
+      - traefik.port=5000
+      - traefik.http.routers.s-registry.rule=Host(`registry.docker.local`)
+      - traefik.http.routers.s-registry.entrypoints=websecure
+      - traefik.http.routers.s-registry.tls=true
+  registry-ui:
+    image: konradkleine/docker-registry-frontend:v2
+    #restart: unless-stopped
+    depends_on:
+      - registry
+    environment:
+      ENV_DOCKER_REGISTRY_HOST: 'registry'
+      ENV_DOCKER_REGISTRY_PORT: 5000
+      #ENV_DOCKER_REGISTRY_USE_SSL: 1
+      ENV_DEFAULT_REPOSITORIES_PER_PAGE: 50
+    labels:
+      - traefik.enable=true
+      - traefik.port=80
+      - traefik.http.routers.s-registry-ui.rule=Host(`registry-ui.docker.local`)
+      - traefik.http.routers.s-registry-ui.entrypoints=websecure
+      - traefik.http.routers.s-registry-ui.tls=true
+      - traefik.http.routers.s-registry-ui.middlewares=auth@docker
+      - traefik.http.middlewares.auth.basicauth.users=jean:$$1$$qvbVKuOn$$qKZpjcMQuMFWNgC9vtycL1
+~~~
+Exemple de génération de certificats. Notez que Traefik est capable d'utiliser **Let's Encrypt**
+~~~bash
+mkdir certs
+openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/wildcard.docker.local.key -x509 -days 365 -out certs/wildcard.docker.local.crt
+~~~
+~~~bash
+docker-compose up -d
+~~~