Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Take a look at Traefik, even if you don't use containers

j6b72.de

Post reply on HN
Print view View original

31–40 of 266 posts

Re: Take a look at Traefik, even if you don't use containers

#31

Post by waldrews »

wg0 wrote: post #17

Side question - what people use to hide (and make accessible) the internal services such as grafana, prometheus, rabbit mq (the web interface) and such? Should they be public behind such a proxy? (seems odd) Or should they be totally internal and then setup a Wireguard VPN to reach them?

Serve them on a firewalled port, then: 1) VPN if you need to expose them to multiple trusted users, 2) firewall rules to make them accessible to your IP range, or (probably easiest), 3) access them by ssh tunnel.

Re: Take a look at Traefik, even if you don't use containers

#32

Post by cagenut »

In a mirror/reverse of the OPs premise - I always wondered why so many of these open source http reverse proxies sprung up in the container era, like what did they offer that varnish or a vmod to varnish wasn't already doing or capable of? somehow varnish almost completely missed the container era, despite seemingly being the exact type of tool a bunch of teams would go on to create.

Re: Take a look at Traefik, even if you don't use containers

#33

Post by Hrun0 »

wg0 wrote: post #17

Side question - what people use to hide (and make accessible) the internal services such as grafana, prometheus, rabbit mq (the web interface) and such? Should they be public behind such a proxy? (seems odd) Or should they be totally internal and then setup a Wireguard VPN to reach them?

> what people use to hide (and make accessible) the internal services such as grafana, prometheus, rabbit mq (the web interface) and such?

Proxies or VPNs like you mentioned. You usually don't expose things if you don't have to.

Re: Take a look at Traefik, even if you don't use containers

#34

Post by Starlevel004 »

cagenut wrote: post #32

In a mirror/reverse of the OPs premise - I always wondered why so many of these open source http reverse proxies sprung up in the container era, like what did they offer that varnish or a vmod to varnish wasn't already doing or capable of? somehow varnish almost completely missed the container era, despite seemingly being the exact type of tool a bunch of teams would go on to create.

Devops guys are mostly incapable of using any service that isn't a) written in Go and b) configured using a YAML-based DSL.

Re: Take a look at Traefik, even if you don't use containers

#35

Post by aaomidi »

beestripes wrote: post #13

Why traefik over nginx for my modest needs, a couple docker hosts and a few dozen containers. I use https://github.com/NginxProxyManager/nginx-proxy-manager , would traefik provide a benefit on such a small scale?

Traefik does certificate management for you

Re: Take a look at Traefik, even if you don't use containers

#36

Post by IggleSniggle »

justusthane wrote: post #5
iansinnott wrote: post #2

> Traefik is more comparable to HAProxy than to nginx/caddy/apache2 Aren't caddy and traefik fairly comparable? I've only used them both lightly so I may be missing the core point of each, but I thought of them as very similar.

The rest of the sentence you quoted explains that nginx, Caddy, and Apache are all webservers (which can also reverse proxy). Traefik and HAproxy are only reverse proxies and not webservers.

HAProxy can be a web server though, albeit it is not designed to operate this way and thus requires some goofy configuration to make happen. I only know this because it was useful for me while working on a HAProxy extension.

Re: Take a look at Traefik, even if you don't use containers

#37

Post by m_sahaf »

IggleSniggle wrote: post #19
remram wrote: post #14

Earlier quoted context omitted.

Those are giant limitations. This is the first I hear of any reverse proxy that has to restart and drop connections to update configuration. That is usually the first, most fundamental part of any such server's design.

Caddy doesn't have to restart, I think it's related to the specifics of their setup. The simple/easy path that gets a lot of people into caddy has a workflow that's more like, run caddy, job done. The next level is, give caddy super simple configuration file, reload caddy with "caddy reload --config /etc/caddy/Caddyfile". After that, you use the REST API to make changes to the server while it is running, which uses a…

> After that, you use the REST API to make changes to the server while it is running, which uses a JSON configuration definition instead of a Caddyfile, so it ends up being a jump for users.

You can, in fact, use any configuration format with the API as long as Caddy has its adapter compiled-in; you just have to use the correct value in the `Content-Type` header. For instance, you can use Caddyfile format using the `text/caddyfile` value in `Content-Type`. This is documented[0].

[0] https://caddyserver.com/docs/api#post-load

Re: Take a look at Traefik, even if you don't use containers

#38

Post by fidotron »

silverquiet wrote: post #9

I use Traefik in production (with containers), and my favorite aspect of it is that the configuration is carried via the labels on containers which means I rarely if ever need to make any modifications to the Traefik config itself. I'd say the biggest con is trying to figure out how to pronounce the name - I think it's just regular traffic, but I can't help wanting to call it "trey-feek" or something like that.

Heavy +1 on the labels thing. Reduces the scope of things to keep track of massively, even if writing them the first time is slightly harder because of the escaping and verbosity.

I think a combination of traefik and docker compose are in the sweet spot for small scale self hosters that haven't reached the point where k8s will pay off. i.e. if you have less servers than a k8s HA control plane would use.

Re: Take a look at Traefik, even if you don't use containers

#39

Post by TNorthover »

Starlevel004 wrote: post #34
cagenut wrote: post #32

In a mirror/reverse of the OPs premise - I always wondered why so many of these open source http reverse proxies sprung up in the container era, like what did they offer that varnish or a vmod to varnish wasn't already doing or capable of? somehow varnish almost completely missed the container era, despite seemingly being the exact type of tool a bunch of teams would go on to create.

Devops guys are mostly incapable of using any service that isn't a) written in Go and b) configured using a YAML-based DSL.

Traefik's YAML does a particularly bad job at keeping syntax (such as it is) separate from user-defined labels, I feel.

Very difficult to just look at a file and see which bits are labels for the sake of it, and which bits are direct instructions to builtin features.

Post reply on HN