Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Take a look at Traefik, even if you don't use containers

j6b72.de

Post reply on HN
Print view View original

241–250 of 266 posts

Re: Take a look at Traefik, even if you don't use containers

#241

Post by joshmanders »

nsteel wrote: post #180
joshmanders wrote: post #111

Earlier quoted context omitted.

Customer: I can't find anything I'm looking for in your store. Store: I spent a lot of time arranging things around in the store, if you can't find what you're looking for you can stop complaining and write signs for us. Customer: Or I can just use your competitor who actually cares about their customers. ¯\_(ツ)_/¯

Except the relationship between stores, customers and competitors all revolves around money and doesn't make sense in this context.

The relationship around this is open source, users and alternatives. It may not be money but nobody writes open source for the github stars, they want users and if your users are frustrated they'll go to alternatives.

- Former Traefik user who now uses Caddy.

Re: Take a look at Traefik, even if you don't use containers

#242

Post by renk »

pragma_x wrote: post #240
renk wrote: post #220

Earlier quoted context omitted.

The documentation split is unfortunate and the GUI really just a status page. The other points are a strength. A pattern that works well: Put all Traefik config in your Docker container definitions, as command line flags and labels, plus the dynamic config provided as a volume. That gives you all the flexibility and only one or two places to look for the config (e.g. a Docker compose file and the dynamic config file)

When done right, I appreciate that Traefik's config design meets the container config/run time split pretty well. I also get that we're arguing TIMTOWDI vs YAGNI. So, I want to take a beat to say that I think your take is absolutely valid, but I'm coming at this from a place where flexibility isn't my primary concern. I'm usually more interested in tools that will reliably save me time, and that's a quality typically…

Flexibility sure is one of Traefik's strengths and the CLI arguments seem to be a point of convergence for the more seasoned people on their forums, so that's what I made out to be the happy path. That being said, I think you are spot on that its operation requires awareness of too much nuance and quirks, making it brittle in the long run. I don't get that feeling using Caddy, for example. Also, the "transpilation" problem between everyone's config snippets truly can be a timesink.

Re: Take a look at Traefik, even if you don't use containers

#243

Post by kubanczyk »

meonkeys wrote: post #64
methou wrote: post #40

The only problem I'm having with it is that it doesn't support unix domain socket[0], in a "cloud native" environment you rarely need it but if you are using single node this can be sweet. -- [0]: https://github.com/traefik/traefik/issues/4881

Could you say more about how a non-network socket would be beneficial? I'm guessing simpler code and lower resource usage, but I'm curious what you're interested in. And by "single node", do you mean one server / one user (even if the user is, say, a single API consumer or whatever), or something else?

Any euid can connect to a localhost tcp socket. But a unix socket is protected with filesystem permissions (rwxrwxrwx, etc.).

Re: Take a look at Traefik, even if you don't use containers

#245

Post by JamesSwift »

sharperguy wrote: post #181
engine_y wrote: post #72

We've been using Traefik in prod for 2 years. While I used NGINX in the past, I decided to migrate to Traefik mainly because of the automatic let's encrypt integration. I am sorry for that decision. Traefik's documentation does not make sense to me or my team. It is finicky and misbehaves without proper logging. As an example - when I want to recreate the certificates - it fails sporadically leaving prod down for an…

This is one area where I've found nixos to be really helpful. I can set this up with just adding some lines to the configuration.nix (which uses lego(1) and letsencrypt in the backend): security.acme = { acceptTerms = true; defaults.email = "admin-email@provider.net"; certs."mydomain.example.com" = { domain = "*.mydomain.example.com"; dnsProvider = "cloudflare"; environmentFile = "/path/to/cloudflare/password"; }; };…

Nice, I am about to look into wildcard certs w/ nixos. Looks like it all 'just works' as long as you use a supported DNS provider?

Re: Take a look at Traefik, even if you don't use containers

#246

Post by [deleted] »

joshmanders wrote: post #241
nsteel wrote: post #180

Earlier quoted context omitted.

Except the relationship between stores, customers and competitors all revolves around money and doesn't make sense in this context.

The relationship around this is open source, users and alternatives. It may not be money but nobody writes open source for the github stars, they want users and if your users are frustrated they'll go to alternatives. - Former Traefik user who now uses Caddy.

[deleted]

Re: Take a look at Traefik, even if you don't use containers

#247

Post by itintheory »

tootie wrote: post #217
jethro_tell wrote: post #113

Earlier quoted context omitted.

One of the problems that the yaml interpreter class of languages, or whatever you'd call them, suffer from is the fact that yaml itself is a language and tends to be more or less undocumented in the interpreter docs. It's sort of assumed that you are going to do extremely simple tasks on very flat data structures. That doesn't tend to be the reality that most of us live in. And to really get the most out of these lan…

I honestly wonder why not just write your web server in node or something. It would be traceable and testable and probably performant enough. There's just so much arcana inside platforms like traefik or nginx where they do all this miraculous stuff if you just add the right flags, but also when it doesn't work it's a total black box and there's no way to discover what it thinks it's doing.

The Traefik dashboard is pretty helpful for visualizing what's happening. Also their error message are usually pretty clear about what's wrong.

Re: Take a look at Traefik, even if you don't use containers

#248

Post by rglullis »

arccy wrote: post #175
rglullis wrote: post #102

Earlier quoted context omitted.

You got it, but your solution won't work because of one detail: I can not use the DNS challenge because I am running a managed service provider, and my customers are the ones who own the domain. All I can do is ask them "please add a CNAME to my gateway", and I need to figure out everything else on my side.

ACME supports Delegated Domains for DNS01: _acme-challenge.customer.com IN CNAME _acme-challenge.your-automated-domain.org.

That sounds interesting. Do you literally mean that I should use _acme_challenge or were you giving an example?

In concrete terms: to set up an instance for a customer, I've been asking them to set their domain with a CNAME to "gateway.communick.host", where I have traefik already configured with one TLS HTTP resolver and one DNS resolver. and I've been using the HTTP resolver one. Are you saying that I can just configure to use the DNS resolver and it will work, or do I need to tell my customers to add another record for the delegation to work?

Re: Take a look at Traefik, even if you don't use containers

#249

Post by juangacovas »

ofrzeta wrote: post #98

Is it any better than HAProxy? HAProxy has served me well for at least a decade and has also been modernized for the cloud age with the runtime API that allows dynamic configuration.

Same here, we've been using HAProxy for years now and only gets to improve

Re: Take a look at Traefik, even if you don't use containers

#250

Post by dizhn »

jspdown wrote: post #122
dizhn wrote: post #46

I use caddy wherever I can. That it can already handle automatic certificates is a big plus. Plus it's very easy to congiure.

If you like Caddy for it's ACME capabilities, then you might enjoy Traefik as well. It supports HTTP, TLS ALPN and DNS challenges and can be configured in one line as well.

I already use it as a web server and reverse proxy so it's a better match. I've tried traefik in the past and it wasn't as simple as caddy to configure. Caddy has some well thought out magic (like creating a sane modern php config with just one line).
Post reply on HN