Take a look at Traefik, even if you don't use containers • Hacker News Board

Re: Take a look at Traefik, even if you don't use containers

#231

Post by engine_y » Mon, May 06, 2024, 4:14 PM UTC

Gormo wrote: post #222

engine_y wrote: post #72

We've been using Traefik in prod for 2 years. While I used NGINX in the past, I decided to migrate to Traefik mainly because of the automatic let's encrypt integration. I am sorry for that decision. Traefik's documentation does not make sense to me or my team. It is finicky and misbehaves without proper logging. As an example - when I want to recreate the certificates - it fails sporadically leaving prod down for an…

You might be happy to know that integration between Let's Encrypt and Nginx is something that's been provided by Certbot for years. The Nginx plugin for Certbot will identify active domains from your Nginx config, create and renew certificates, automating domain validation through the web server in real-time, and will automatically update your config files with both certificate paths and HTTP redirects to HTTPS (if d…

Tnx. That's helpful to know.

Re: Take a look at Traefik, even if you don't use containers

#232

Post by overstay8930 » Mon, May 06, 2024, 4:14 PM UTC

arush15june wrote: post #56

I use caddy rather traefik. It's much easier to manage the Caddyfile compared to the traefik YAML config IMO, and we just keep three separate Caddyfiles for local, production and on-prem deployments. There are a plethora of great plugins, we use the coraza WAF plugin for caddy and it works well.

I love Caddy, I wish the docs were better on production deployments, too many unanswered questions about best practices especially RE: storage and config management. Like how local storage is supposed to be handled when you're using external storage? Allegedly it can be treated as stateless but maybe not?

You basically just have to pray the guy who made the module you need knows what he is doing, because there's no standards for documentation there either. Maintainers really need to put their foot down on random ass modules with 0 documentation providing critical functionality (i.e. S3 storage backend).

Re: Take a look at Traefik, even if you don't use containers

#233

Post by Gormo » Mon, May 06, 2024, 4:16 PM UTC

dlbucci wrote: post #227

Gormo wrote: post #222

Earlier quoted context omitted.

You might be happy to know that integration between Let's Encrypt and Nginx is something that's been provided by Certbot for years. The Nginx plugin for Certbot will identify active domains from your Nginx config, create and renew certificates, automating domain validation through the web server in real-time, and will automatically update your config files with both certificate paths and HTTP redirects to HTTPS (if d…

Which is what I used for years, but recently discovered that Certbot now requires snapd to be installed. I did that and snapd bricked my server: it wouldn't start until I uninstalled it. That's when I switched to Caddy.

That's very definitely not true. Perhaps they're defaulting to Snap for convenience, but Certbot is a cross-platform Python program, and can just be installed via pip: https://certbot.eff.org/instructions?ws=nginx&os=pip

Non-Ubuntu distros also often have standard packages in their repos with no reference to Snap, and EFF also distributes a Docker container with Certbot pre-configured, if Docker is your thing.

Re: Take a look at Traefik, even if you don't use containers

#234

Post by hombre_fatal » Mon, May 06, 2024, 4:21 PM UTC

ornornor wrote: post #114

jethro_tell wrote: post #113

Earlier quoted context omitted.

One of the problems that the yaml interpreter class of languages, or whatever you'd call them, suffer from is the fact that yaml itself is a language and tends to be more or less undocumented in the interpreter docs. It's sort of assumed that you are going to do extremely simple tasks on very flat data structures. That doesn't tend to be the reality that most of us live in. And to really get the most out of these lan…

To illustrate this point, here is how to have a multi line value in yaml: just kidding, it’s so confusing that there is a whole website to help you figure it out: https://yaml-multiline.info/

Those examples don’t look confusing except there being more than one way.

Re: Take a look at Traefik, even if you don't use containers

#235

Post by ornornor » Mon, May 06, 2024, 4:27 PM UTC

hombre_fatal wrote: post #234

ornornor wrote: post #114

Earlier quoted context omitted.

To illustrate this point, here is how to have a multi line value in yaml: just kidding, it’s so confusing that there is a whole website to help you figure it out: https://yaml-multiline.info/

Those examples don’t look confusing except there being more than one way.

Good luck remembering which is which :)

Re: Take a look at Traefik, even if you don't use containers

#236

Post by vundercind » Mon, May 06, 2024, 4:27 PM UTC

tremon wrote: post #225

vundercind wrote: post #152

Earlier quoted context omitted.

It’s insanely better at config. It’s about as bad at being a programming language or data structure serialization format, though.

But then, what is a config file if not a representation of a data structure?

With the restriction that it has to be represented in human-friendly text.

JSON’s a crazy-bad serialization format, too, for that matter. It doesn’t even know what a damn integer is.

Re: Take a look at Traefik, even if you don't use containers

#237

Post by renk » Mon, May 06, 2024, 4:32 PM UTC

evtothedev wrote: post #208

The 37Signals/Basecamp team has been working on a small, opinionated replacement for Traefik called Thruster: https://github.com/basecamp/thruster Would be worth checking out, if you're currently considering options.

Re: Take a look at Traefik, even if you don't use containers

#238

Post by all2 » Mon, May 06, 2024, 5:13 PM UTC

freedomben wrote: post #74

san-fran wrote: post #71

Earlier quoted context omitted.

This might be an additional way to quickly iterate on the content of the documentation itself. If I were the one writing, an easy test is passing the documentation to a lay person and asking them if they have what they need to perform X by following the documentation. Perhaps having a focused LLM generate the steps could help catch some documentation deficiencies.

> If I were the one writing, an easy test is passing the documentation to a lay person and asking them if they have what they need to perform X by following the documentation. What kind of documentation is this though? Is this how to bake a cake or tie a necktie, or is it how to setup a reverse proxy for the services in your k8s cluster? If it's something a lay-person could do then I think this is a good strategy (th…

If we push this into the software development domain, my expectation would be something like "documentation should allow a software developer to do this thing without knowing the underlying tooling".

> how to setup a reverse proxy for the services in your k8s cluster

Going off this specifically. I don't know how to do this. I actually have a k8s cluster on a home server waiting for me to do exactly this. Ideally there would be a doc that would start with ingress selection, and then guide a user through how to get it set up with common use-cases. Or something like that. Like others in this conversation, I've been leveraging LLMs with varying degrees of success to try and navigate this.

Re: Take a look at Traefik, even if you don't use containers

#239

Post by dlbucci » Mon, May 06, 2024, 5:30 PM UTC

Gormo wrote: post #233

dlbucci wrote: post #227

Earlier quoted context omitted.

Which is what I used for years, but recently discovered that Certbot now requires snapd to be installed. I did that and snapd bricked my server: it wouldn't start until I uninstalled it. That's when I switched to Caddy.

That's very definitely not true. Perhaps they're defaulting to Snap for convenience, but Certbot is a cross-platform Python program, and can just be installed via pip: https://certbot.eff.org/instructions?ws=nginx&os=pip Non-Ubuntu distros also often have standard packages in their repos with no reference to Snap, and EFF also distributes a Docker container with Certbot pre-configured, if Docker is your thing.

I wasn't aware of that. It was true for my version of Ubuntu (18), according to the website: https://certbot.eff.org/instructions?ws=nginx&os=ubuntubioni...

Perhaps I had other options the website didn't make me aware of, but it seemed like enough of a hassle that I just dropped it.

Re: Take a look at Traefik, even if you don't use containers

#240

Post by pragma_x » Mon, May 06, 2024, 6:31 PM UTC

renk wrote: post #220

pragma_x wrote: post #214

Earlier quoted context omitted.

Possibly unpopular opinions to follow. This is made even worse by: - Having documentation split between v1 and v2, that is similar yet different enough to yield half-baked configurations before you realize what you did wrong. The website itself provides the barest of subtle changes to distinguish the two. Edit: I learned all this prior to v3. - Supporting multiple config formats (TOML and YAML) which makes it that mu…

The documentation split is unfortunate and the GUI really just a status page. The other points are a strength. A pattern that works well: Put all Traefik config in your Docker container definitions, as command line flags and labels, plus the dynamic config provided as a volume. That gives you all the flexibility and only one or two places to look for the config (e.g. a Docker compose file and the dynamic config file)

When done right, I appreciate that Traefik's config design meets the container config/run time split pretty well.

I also get that we're arguing TIMTOWDI vs YAGNI. So, I want to take a beat to say that I think your take is absolutely valid, but I'm coming at this from a place where flexibility isn't my primary concern. I'm usually more interested in tools that will reliably save me time, and that's a quality typically in opposition to flexibility.

For me, any tool that requires or permits multiple configuration planes to get off the ground threatens to be a time sink and a tax for an already packed schedule. This complexity usually requires the operator to absorb a lot of nuance, quirks, and idioms, which is something that's difficult to do quickly. Troubleshooting also grows in scope , again due to the complex design and multiple ways to set things up. Meanwhile, the most inflexible tools in my stack cause me the least trouble due to their simplicity: there's one way to do it, and if it's a common mistake, the answer is easily searched online.

In practice, looking to the Traefik community for support required decoding everyone's different take with varying degrees of CLI and config file involvement, sometimes fragmented across entire discussion threads (not to mention the v1/v2 problem). It made for a very time consuming troubleshooting run - something that would have been avoided by a more simple design like other tools use.