Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Traefik's 10-year anniversary

traefik.io

Post reply on HN
Print view View original

71–80 of 154 posts

Re: Traefik's 10-year anniversary

#71

Post by sph »

Ajedi32 wrote: post #70
aborsy wrote: post #68

Earlier quoted context omitted.

Caddy is dead simple. Like, send https://example.com to 1.2.3.4:5000. That’s it! Certificate provisioning, TLS configs, TLS termination, mTLS and client certificates, sticking in middlewares, … are all simple. The config is a straightforward text file. Really good webserver! Traefik is docker centric, and had various obscure labels. Too much text for a simple proxy. The debugging can be an issue if it doesn’t work. I…

Does Caddy automatically detect when you deploy a new Docker service and reconfigure itself to route traffic to that service? That's pretty much the main value preposition of Traefik for me. I don't want to be messing with config files when I'm deploying.

Caddy is a webserver like Apache or nginx. Integration with Docker is a higher-level layer. There’s caddy-docker-proxy but I haven’t tried it.

Re: Traefik's 10-year anniversary

#73

Post by andrewstuart2 »

miiiiiike wrote: post #45
andrewstuart2 wrote: post #29

Earlier quoted context omitted.

> It's current year, why are JWTs only supported in the closed source/enterprise versions of Varnish, NGINX, and Traefik? I've found auth at the proxy to be a major antipattern. It adds a semblance of your backend being secure without adding the real user authentication and authorization it should have directly. VPN is the better tool if you want to keep certain projects hidden from the general public and your applic…

With JWTs I don't do anything at the proxy beyond "This is a protected route. Is there a JWT? Is it valid? No to either? 403." This is one of the primary use cases for JWTs and it takes a majority of the load off of my application servers. The route is open to the public for authenticated and authorized users. You wouldn't use a VPN here.

That's really just added work, IMO, and likely room for security misconfiguration between backend and proxy. You should still be validating and everything on the application server to inspect identity and possibly attributes like roles, so in the cases where you have invalid tokens you do the work once, just in the proxy instead of the backend, and with valid tokens you will do the signature validation work twice.

Re: Traefik's 10-year anniversary

#74

Post by cmckn »

kachapopopow wrote: post #56

The first this I ever do when setting up k3s is pass --disable-traefik I don't know what it is, I never used it, never had the motivation to look into what I am losing out because everything else I am familiar with already works and I don't have many complains. I do not remember why I have this opinion, but I usually only treat software like this when they're trying to sell themselves too hard.

Traefik is used by k3s for ingress.

Re: Traefik's 10-year anniversary

#76

Post by tecleandor »

aborsy wrote: post #68
tecleandor wrote: post #62

There's a lot of mentions to Caddy here. Haven't used it as, back in the day, there was something funny about its license and binary distribution. AFAIK that's not a problem anymore, isn't it? From people that migrated from Traefik to Caddy... What are the main differences? Anything you really miss? I use Traefik in a bunch of small deployments, sometimes pointing to Docker stuff, sometimes outside of Docker, Kuberne…

Caddy is dead simple. Like, send https://example.com to 1.2.3.4:5000. That’s it! Certificate provisioning, TLS configs, TLS termination, mTLS and client certificates, sticking in middlewares, … are all simple. The config is a straightforward text file. Really good webserver! Traefik is docker centric, and had various obscure labels. Too much text for a simple proxy. The debugging can be an issue if it doesn’t work. I…

Yeah, don't know exactly why, but when I've had problems, debugging Traefik has been kinda frustrating.

Also, I feel like they've slowly moved focus to Docker during the years, and I find the file based configuration more and more difficult (or worse documentation maybe) every time I go back to the docs.

Thanks for sharing!

Re: Traefik's 10-year anniversary

#77

Post by trenchpilgrim »

gethly wrote: post #36

I use Traefik for local development on daily basis, where I have to run double digit https services. It works, but it was a pain to set up. The documentation sucks ** and the config is confusing AF. I would never recommend this to anyone. If i will have to reinstall my computer one day, Traefik will not be welcomed back.

I was once tasked with looking into using Traefik and yeah the documentation at the time was so bad I couldn't figure it out. Ended up using Envoy IIRC.

Re: Traefik's 10-year anniversary

#78

Post by Ajedi32 »

sph wrote: post #71
Ajedi32 wrote: post #70

Earlier quoted context omitted.

Does Caddy automatically detect when you deploy a new Docker service and reconfigure itself to route traffic to that service? That's pretty much the main value preposition of Traefik for me. I don't want to be messing with config files when I'm deploying.

Caddy is a webserver like Apache or nginx. Integration with Docker is a higher-level layer. There’s caddy-docker-proxy but I haven’t tried it.

Traefik is also a web server like Apache or Nginx and it does integrate with Docker. I thought that feature was like the entire reason to use Trafik, so I guess I just find the comparison a bit strange.

Re: Traefik's 10-year anniversary

#79

Post by drnick1 »

I host a couple of web services like Nextcloud and Overleaf instances (Docker) and I use nginx as a reverse proxy. What would be the benefit of using Traefik instead? Traefik can handle things such as TLS certificates automatically, but that seems a rather weak reason to move away from a robust and modular setup where each component complies with the Unix philosophy or doing one thing well.

Re: Traefik's 10-year anniversary

#80

Post by rirze »

Ajedi32 wrote: post #70
aborsy wrote: post #68

Earlier quoted context omitted.

Caddy is dead simple. Like, send https://example.com to 1.2.3.4:5000. That’s it! Certificate provisioning, TLS configs, TLS termination, mTLS and client certificates, sticking in middlewares, … are all simple. The config is a straightforward text file. Really good webserver! Traefik is docker centric, and had various obscure labels. Too much text for a simple proxy. The debugging can be an issue if it doesn’t work. I…

Does Caddy automatically detect when you deploy a new Docker service and reconfigure itself to route traffic to that service? That's pretty much the main value preposition of Traefik for me. I don't want to be messing with config files when I'm deploying.

Yes, there's [caddy-docker-proxy](https://github.com/lucaslorentz/caddy-docker-proxy) which I personally use in my homelab. It will read and update on docker compose labels to configure the route. Highly recommend.
Post reply on HN