Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Take a look at Traefik, even if you don't use containers

j6b72.de

Post reply on HN
Print view View original

21–30 of 266 posts

Re: Take a look at Traefik, even if you don't use containers

#21

Post by tazjin »

Projectiboga wrote: post #16
silverquiet wrote: post #9

I use Traefik in production (with containers), and my favorite aspect of it is that the configuration is carried via the labels on containers which means I rarely if ever need to make any modifications to the Traefik config itself. I'd say the biggest con is trying to figure out how to pronounce the name - I think it's just regular traffic, but I can't help wanting to call it "trey-feek" or something like that.

ae is closest to y, or hi. So Tryfik, is my guess, otherwise is Trayfik. If it's European fik, might be feek. *Just taking a guess here.

I think its "träfik", i.e. "traffic" with a German accent.

Re: Take a look at Traefik, even if you don't use containers

#22

Post by mholt »

remram wrote: post #14
psYchotic wrote: post #3

I'm considering moving reverse proxying to Traefik for my self-hosted stuff. Unlike the article's author, I'm running containerized workloads with Docker Compose, and currently using Caddy with the excellent caddy-docker-proxy plugin. What that gets me, currently: - Reverse proxying, with Docker labels for configuration. New workloads are picked up automatically (but I do need to attach workloads to Caddy's network b…

Those are giant limitations. This is the first I hear of any reverse proxy that has to restart and drop connections to update configuration. That is usually the first, most fundamental part of any such server's design.

That is absolutely not the case. Caddy config reloads are graceful and lightweight. I have no idea why this person is stopping their server instead of reloading the config.

Re: Take a look at Traefik, even if you don't use containers

#23

Post by pyr0hu »

wg0 wrote: post #17

Side question - what people use to hide (and make accessible) the internal services such as grafana, prometheus, rabbit mq (the web interface) and such? Should they be public behind such a proxy? (seems odd) Or should they be totally internal and then setup a Wireguard VPN to reach them?

We use tailscale for this exact use case and has been working flawlessly so far. You can even set up ACL lists as a firewall.

Re: Take a look at Traefik, even if you don't use containers

#24

Post by baobun »

mkesper wrote: post #6
iansinnott wrote: post #2

> Traefik is more comparable to HAProxy than to nginx/caddy/apache2 Aren't caddy and traefik fairly comparable? I've only used them both lightly so I may be missing the core point of each, but I thought of them as very similar.

Caddy is at the same level as nginx/apache. It is able to do everything a web server is expected to (serving web sites, files and proxying services) plus handling LetsEncrypt automatically. It does not, afaik, do dynamic service discovery like traefik nor load balancing of TCP at the protocol layer, like e.g. haproxy. https://caddyserver.com/features

Just to add on, haproxy does service discovery too.

https://www.haproxy.com/blog/consul-service-discovery-for-ha...

Re: Take a look at Traefik, even if you don't use containers

#25

Post by johnchristopher »

beestripes wrote: post #13

Why traefik over nginx for my modest needs, a couple docker hosts and a few dozen containers. I use https://github.com/NginxProxyManager/nginx-proxy-manager , would traefik provide a benefit on such a small scale?

I like traefik hot reload (among other things). Want to hide a service (the proxied app), a new route (a router in traefik terminology), a middleware (basic auth, https redirection, headers manipulation) ? Just drop the file and it gets automatically picked up, no need to reload traefik or that vhost.

Truth is: I don't like nginx syntax and traefik is/was shiny :]. I went in for the LE renewal and containers, I stayed for the configuration style.

Re: Take a look at Traefik, even if you don't use containers

#26

Post by Cyykratahk »

psYchotic wrote: post #3

I'm considering moving reverse proxying to Traefik for my self-hosted stuff. Unlike the article's author, I'm running containerized workloads with Docker Compose, and currently using Caddy with the excellent caddy-docker-proxy plugin. What that gets me, currently: - Reverse proxying, with Docker labels for configuration. New workloads are picked up automatically (but I do need to attach workloads to Caddy's network b…

I've used caddy-docker-proxy in production and it doesn't cause Caddy to drop connections when loading a new config.

I just tested it locally to check and it works fine.

Re: Take a look at Traefik, even if you don't use containers

#27

Post by mholt »

mkesper wrote: post #6
iansinnott wrote: post #2

> Traefik is more comparable to HAProxy than to nginx/caddy/apache2 Aren't caddy and traefik fairly comparable? I've only used them both lightly so I may be missing the core point of each, but I thought of them as very similar.

Caddy is at the same level as nginx/apache. It is able to do everything a web server is expected to (serving web sites, files and proxying services) plus handling LetsEncrypt automatically. It does not, afaik, do dynamic service discovery like traefik nor load balancing of TCP at the protocol layer, like e.g. haproxy. https://caddyserver.com/features

Caddy can absolutely do both of those things.

- https://caddyserver.com/docs/modules/http.reverse_proxy.upst...

- https://github.com/mholt/caddy-l4

Re: Take a look at Traefik, even if you don't use containers

#28

Post by mholt »

thinkmassive wrote: post #4
iansinnott wrote: post #2

> Traefik is more comparable to HAProxy than to nginx/caddy/apache2 Aren't caddy and traefik fairly comparable? I've only used them both lightly so I may be missing the core point of each, but I thought of them as very similar.

Caddy is primarily a web server like nginx and apache httpd. Traefik and HAproxy are primarily reverse proxies.

Caddy is actually used as a reverse proxy more than a static file server. It's equally excellent and proficient as both! Caddy's functionality is comparable to nginx, apache httpd, and haproxy.

Re: Take a look at Traefik, even if you don't use containers

#29

Post by John23832 »

wg0 wrote: post #17

Side question - what people use to hide (and make accessible) the internal services such as grafana, prometheus, rabbit mq (the web interface) and such? Should they be public behind such a proxy? (seems odd) Or should they be totally internal and then setup a Wireguard VPN to reach them?

From the internet? Drop them at the ingress level (if using kubernetes). You could also do some ip filtering. Then use an internal proxy (or internal ip of some kind) to reach them.

For proof of concepts, I use cloudflare tunnels which allows you to add ACLs to particular routes.

Re: Take a look at Traefik, even if you don't use containers

#30

Post by section_me »

wg0 wrote: post #17

Side question - what people use to hide (and make accessible) the internal services such as grafana, prometheus, rabbit mq (the web interface) and such? Should they be public behind such a proxy? (seems odd) Or should they be totally internal and then setup a Wireguard VPN to reach them?

Auth forwarding[1] is normally the route. This allows you to basically zero auth your services. You can also use wireguard or tailscale[2]

[1] https://doc.traefik.io/traefik/middlewares/http/forwardauth/ [2] https://doc.traefik.io/traefik/master/https/tailscale/

Post reply on HN