Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Take a look at Traefik, even if you don't use containers

j6b72.de

Post reply on HN
Print view View original

151–160 of 266 posts

Re: Take a look at Traefik, even if you don't use containers

#151

Post by 2NGINXSUX »

engine_y wrote: post #72

We've been using Traefik in prod for 2 years. While I used NGINX in the past, I decided to migrate to Traefik mainly because of the automatic let's encrypt integration. I am sorry for that decision. Traefik's documentation does not make sense to me or my team. It is finicky and misbehaves without proper logging. As an example - when I want to recreate the certificates - it fails sporadically leaving prod down for an…

We’ve been using Nginx is prod for 3 years. While I used Traefik in the past, I decided to migrate to Nginx mainly because of its scriptability (Traefik plugins suck). I am sorry for that decision. Nginx’s documentation is absolute trash full of non-explanations (far worse than Traefik or Caddy. It’s finicky and misbehaves constantly. Lurking around every corner is a decision from 1995 sticking around in 2024; Nginx can barely function on the modern internet without _significant_ tuning.

On top of it, the OpenResty community must be the rudest, most entitled people in the entire internet. Have a question, “YOURE DOING IT WRONG IDIOT” is the response. Of course every terrible decision they’ve made they justify with “BUT THE PERFORMANCE” as that’s the only thing worth considering.

We’re moving back to Traefik, or Caddy, both still in POC.

Re: Take a look at Traefik, even if you don't use containers

#152

Post by vundercind »

jethro_tell wrote: post #148
cromka wrote: post #134

Earlier quoted context omitted.

Isn’t it why toml is seemingly increasingly used to replace yaml in projects?

I hope not, toml is even worse at complex things and just slightly better at the stuff that isn't confusing. Add a k:v to a mildly complex dict. At this point, I'm pushing into a place where I'm just going to switch to go because its getting to be a mess.

It’s insanely better at config.

It’s about as bad at being a programming language or data structure serialization format, though.

Re: Take a look at Traefik, even if you don't use containers

#153

Post by vundercind »

mardifoufs wrote: post #147
cromka wrote: post #134

Earlier quoted context omitted.

Isn’t it why toml is seemingly increasingly used to replace yaml in projects?

In my experience toml is worse at anything complex. It's nice as an .ini replacement but makes even yaml look sane in comparison if you want to use it for very complex or deeply nested stuff. But it wasn't designed to do that anyways

Am I alone in greatly preferring nesting in toml compared with yaml?

Re: Take a look at Traefik, even if you don't use containers

#154

Post by simonw »

treyd wrote: post #97
simonw wrote: post #15

Earlier quoted context omitted.

If what you've got already works then no, I don't think you would see any benefit from switching. The moment you need a feature which Traefik provides that isn't in Nginx is when I would consider the switch.

But what features does Traefik have that nginx doesn't?

I believe the biggest are automatic Lets Encrypt certificates and the ability to discover services and route to them based on things like Kubernetes labels.

Re: Take a look at Traefik, even if you don't use containers

#155

Post by jethro_tell »

vundercind wrote: post #152
jethro_tell wrote: post #148

Earlier quoted context omitted.

I hope not, toml is even worse at complex things and just slightly better at the stuff that isn't confusing. Add a k:v to a mildly complex dict. At this point, I'm pushing into a place where I'm just going to switch to go because its getting to be a mess.

It’s insanely better at config. It’s about as bad at being a programming language or data structure serialization format, though.

But yaml is fine at config, it sucks at looping, conditionals and data structures, if you aren't fixing that its just another standard we have to learn, so thanks for that

Re: Take a look at Traefik, even if you don't use containers

#156

Post by notoall »

For simple deployments, consider whether you need a reverse proxy at all.

I have IPv6 everywhere, with each service getting its own IPv6 address. Each service is managed in inetd-style (via systemd-socket-proxyd ), and so essentially listens directly.

For services that need to serve IPv4, I have a reverse proxy on my network edge that demuxes on TLS SNI to the corresponding IPv6 address.

The advantage here is never having to deal with complex applications, with their complex and changing configuration.

Re: Take a look at Traefik, even if you don't use containers

#157

Post by notpushkin »

notoall wrote: post #156

For simple deployments, consider whether you need a reverse proxy at all. I have IPv6 everywhere, with each service getting its own IPv6 address. Each service is managed in inetd-style (via systemd-socket-proxyd ), and so essentially listens directly. For services that need to serve IPv4, I have a reverse proxy on my network edge that demuxes on TLS SNI to the corresponding IPv6 address. The advantage here is never h…

I'm using a reverse proxy just to terminate TLS. Pretty sure it is possible to do that at a service level, but don't think it's worth the trouble.

Re: Take a look at Traefik, even if you don't use containers

#158

Post by withinboredom »

aedocw wrote: post #44
beestripes wrote: post #13

Why traefik over nginx for my modest needs, a couple docker hosts and a few dozen containers. I use https://github.com/NginxProxyManager/nginx-proxy-manager , would traefik provide a benefit on such a small scale?

I think https://github.com/caddyserver is the best option here. Automatic handling of SSL certs, it's incredibly lightweight, and has super clear config syntax.

If only the caddy ingress were done. I’ve been waiting years for it.

Re: Take a look at Traefik, even if you don't use containers

#159

Post by withinboredom »

wg0 wrote: post #17

Side question - what people use to hide (and make accessible) the internal services such as grafana, prometheus, rabbit mq (the web interface) and such? Should they be public behind such a proxy? (seems odd) Or should they be totally internal and then setup a Wireguard VPN to reach them?

They are open to the internet but each ingress is using the “external auth” feature of nginx ingress, pointing to our internal login. There’s no vpn or magic ip addresses. Once you’re logged in, you can access whatever you need.

Re: Take a look at Traefik, even if you don't use containers

#160

Post by amne »

dizhn wrote: post #46

I use caddy wherever I can. That it can already handle automatic certificates is a big plus. Plus it's very easy to congiure.

I tried to get caddy to listen to both ports 80 and 443 in a cluster. I failed miserably. The documentation simply dismisses this as a possible scenario.
Post reply on HN