6 ms·

I run some (20+) services using docker compose on my home server, and Traefik is great. Cloudflare manages my domain and it allows Traefik to get letsencrypt c

by Jnr 3y ago

I run some (20+) services using docker compose on my home server, and Traefik is great. Cloudflare manages my domain and it allows Traefik to get letsencrypt certificates even for internal services not exposed to the outside world. I also have multiple Traefik entrypoints for internal and external services. And cloudflared tunnel container set up to manage access to the public resources. Then on the home router level I set/override DNS entries for internal services so they would connect directly to Traefik, instead of going through Cloudflare. Incredibly these Cloudflare services cost exactly 0$ for now. But I do not use compose overrides, don't really see the benefits.

6LLvveMx2koXfwn 3y ago
As per the article I guess the benefit is specifically for managing compose files across teams through git.
slig 3y ago
I thought that the Cloudflare tunnel was the very expensive pay-per-gb "argo route". Really nice to know that they offer a simple and free reverse proxy, thanks!
- apitman 3y ago
  They made it free a couple years ago and rebranded as Cloudflare Tunnel. Currently an excellent free option though technically you're not supposed to use it for anything other than basic HTML sites.
  - jmpavlec 3y ago
    I recently set it up with a variety of apps (frontend/backend) behind it. Where did you see it should only be a basic html app? Don't recall reading that in their documentation.
    - apitman 3y ago
      I just did a bit of research. They updated[0] their ToS a while back. At the time I asked[1] if people thought this change would apply to tunnels. Based on the answer to that I would say it's no longer prohibited, which is great. See also this interaction I had with Cloudlfare's CEO a couple years ago on this topic: https://news.ycombinator.com/item?id=30285554 https://news.ycombinator.com/item?id=30285554 [0]: https://blog.cloudflare.com/updated-tos/ https://blog.cloudflare.com/updated-tos/ [1]: https://news.ycombinator.com/item?id=35963143 https://news.ycombinator.com/item?id=35963143
  - slig 3y ago
    Just looked up and the Argo thing still exists and the pricing looks the same, couldn't find anything related to basic HTML sites on tunnel, though.
INTPenis 3y ago
I recently realized the value of Traefik, been avoiding learning about it for years because I'm a skeptic about new stuff. But the first thing that struck me was "ok, cool auto-discovery", and then "wait, it needs access to all my containers?". Maybe I'm from the old school but we used to separate services into their own service users so that if one service falls it can't take others with it as easy. Now we just accept that all services are under the same user because we use containerization. Well I'm still separating them so I really can't take advantage of the amazing auto-discovery.
- Jnr 3y ago
  Seems like Docker doesn't support fine grained permissions out of the box, but it should be possible to write a proxy for docker unix socket so it would limit what information gets shared and what commands are available. This way it would allow the use of Traefik and similar services which depend on reading/writing labels while severely minimizing attack surface. EDIT: Found this on Github https://github.com/Tecnativa/docker-socket-proxy https://github.com/Tecnativa/docker-socket-proxy
mobilemidget 3y ago
"it allows Traefik to get letsencrypt certificates even for internal services not exposed to the outside world" But something has to be exposed to get these certs to the internal services?
- Jnr 3y ago
  You don't have to expose any ports. It uses ACME DNS challenge, which is supported by Cloudflare and other large nameserver providers. https://doc.traefik.io/traefik/https/acme/#dnschallenge https://doc.traefik.io/traefik/https/acme/#dnschallenge
  - benkillin 3y ago
    you can also use your home router to do this if you run something like OPNSense (there is also pfsense but that uses a much older freebsd kernel that does not support newer NICs)

by Jnr 3y ago

6LLvveMx2koXfwn 3y ago

As per the article I guess the benefit is specifically for managing compose files across teams through git.

slig 3y ago

I thought that the Cloudflare tunnel was the very expensive pay-per-gb "argo route". Really nice to know that they offer a simple and free reverse proxy, thanks!

apitman 3y ago
They made it free a couple years ago and rebranded as Cloudflare Tunnel. Currently an excellent free option though technically you're not supposed to use it for anything other than basic HTML sites.
- jmpavlec 3y ago
  I recently set it up with a variety of apps (frontend/backend) behind it. Where did you see it should only be a basic html app? Don't recall reading that in their documentation.
  - apitman 3y ago
    I just did a bit of research. They updated[0] their ToS a while back. At the time I asked[1] if people thought this change would apply to tunnels. Based on the answer to that I would say it's no longer prohibited, which is great. See also this interaction I had with Cloudlfare's CEO a couple years ago on this topic: https://news.ycombinator.com/item?id=30285554 https://news.ycombinator.com/item?id=30285554 [0]: https://blog.cloudflare.com/updated-tos/ https://blog.cloudflare.com/updated-tos/ [1]: https://news.ycombinator.com/item?id=35963143 https://news.ycombinator.com/item?id=35963143
- slig 3y ago
  Just looked up and the Argo thing still exists and the pricing looks the same, couldn't find anything related to basic HTML sites on tunnel, though.

INTPenis 3y ago

I recently realized the value of Traefik, been avoiding learning about it for years because I'm a skeptic about new stuff. But the first thing that struck me was "ok, cool auto-discovery", and then "wait, it needs access to all my containers?". Maybe I'm from the old school but we used to separate services into their own service users so that if one service falls it can't take others with it as easy. Now we just accept that all services are under the same user because we use containerization. Well I'm still separating them so I really can't take advantage of the amazing auto-discovery.

Jnr 3y ago
Seems like Docker doesn't support fine grained permissions out of the box, but it should be possible to write a proxy for docker unix socket so it would limit what information gets shared and what commands are available. This way it would allow the use of Traefik and similar services which depend on reading/writing labels while severely minimizing attack surface. EDIT: Found this on Github https://github.com/Tecnativa/docker-socket-proxy https://github.com/Tecnativa/docker-socket-proxy

mobilemidget 3y ago

"it allows Traefik to get letsencrypt certificates even for internal services not exposed to the outside world" But something has to be exposed to get these certs to the internal services?

Jnr 3y ago
You don't have to expose any ports. It uses ACME DNS challenge, which is supported by Cloudflare and other large nameserver providers. https://doc.traefik.io/traefik/https/acme/#dnschallenge https://doc.traefik.io/traefik/https/acme/#dnschallenge
- benkillin 3y ago
  you can also use your home router to do this if you run something like OPNSense (there is also pfsense but that uses a much older freebsd kernel that does not support newer NICs)