Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Traefik's 10-year anniversary

traefik.io

Post reply on HN
Print view View original

81–90 of 154 posts

Re: Traefik's 10-year anniversary

#81

Post by Jnr »

gethly wrote: post #36

I use Traefik for local development on daily basis, where I have to run double digit https services. It works, but it was a pain to set up. The documentation sucks ** and the config is confusing AF. I would never recommend this to anyone. If i will have to reinstall my computer one day, Traefik will not be welcomed back.

I wonder how you are using it. I am mainly using Traefik with docker compose labels and it was not that hard to set up once you understand the concepts of routers, middlewares and services. I would use it for any homelab that has to host more than one service.

I also recently started playing around with web UI layer that generates traefik json config. Currently it is quite basic since it was initially made to provide limited time access to development instances but it could in theory manage most important aspects of proxy config and replace something like nginx-proxy-manager. https://github.com/Janhouse/traefik-proxy-admin

Re: Traefik's 10-year anniversary

#82

Post by rirze »

nokun7 wrote: post #14
satvikpendem wrote: post #11

Anyone know of a Traefik alternative but in Rust? I'm looking to oxidize a lot of my stack so just curious.

While there is pingora https://blog.cloudflare.com/how-we-built-pingora-the-proxy-t... , I would recommend checking out envoy. Although not rust based, envoy has gained quite the repute for being extremely versatile and robust.

There's a handful but not mature IMO: https://github.com/sadoyan/aralez https://github.com/junkurihara/rust-rpxy

I'm interested in the space, but until they have automatic certificate management and middleware for managing DNS records in Cloudflare (for example), then I'm reluctant to switch over.

Re: Traefik's 10-year anniversary

#83

Post by chrisandchris »

drnick1 wrote: post #79

I host a couple of web services like Nextcloud and Overleaf instances (Docker) and I use nginx as a reverse proxy. What would be the benefit of using Traefik instead? Traefik can handle things such as TLS certificates automatically, but that seems a rather weak reason to move away from a robust and modular setup where each component complies with the Unix philosophy or doing one thing well.

I use nginx as Gateway (Reverse Proxy) and have several VMs with services deployed using Docker Stack. Traefik acts as reverse proxy on the VMs. Main benefit IMHO: configuring services/routing using docker labes and because they run in dedicated networks, no need to expose any port (Internet -> Nginx -> Traefik -[> Service ] ; wheras [ ] indicates a docker overlay network.

Re: Traefik's 10-year anniversary

#84

Post by gh02t »

chrisandchris wrote: post #83
drnick1 wrote: post #79

I host a couple of web services like Nextcloud and Overleaf instances (Docker) and I use nginx as a reverse proxy. What would be the benefit of using Traefik instead? Traefik can handle things such as TLS certificates automatically, but that seems a rather weak reason to move away from a robust and modular setup where each component complies with the Unix philosophy or doing one thing well.

I use nginx as Gateway (Reverse Proxy) and have several VMs with services deployed using Docker Stack. Traefik acts as reverse proxy on the VMs. Main benefit IMHO: configuring services/routing using docker labes and because they run in dedicated networks, no need to expose any port (Internet -> Nginx -> Traefik -[> Service ] ; wheras [ ] indicates a docker overlay network.

Yeah, I don't use Traefik I use Caddy with https://github.com/lucaslorentz/caddy-docker-proxy to achieve configurations by labels, but that is really a killer feature. All the config to set up an app can go in a docker-compose file and I just have one point of configuration for it. Editing or deleting it doesn't involve editing configurations in 3-4 places.

Re: Traefik's 10-year anniversary

#85

Post by Jnr »

Vaslo wrote: post #66

When I wanted to move to something besides NGINX proxy manager, it was caddy or traefik. At the time, tutorials for the clueless like myself were way more abundant for Traefik. Thats the way I went. Now I also have Authentik up in front and it works great.

I am actually playing around with something similar to nginx proxy manager but for Traefik. It's quite early version but already now it's nice for quickly sharing some services with people temporarily. https://github.com/Janhouse/traefik-proxy-admin I personally use it in homelab together with docker label based configuration. Adding headscale in the mix allows easily serving my development services with outside world.

Re: Traefik's 10-year anniversary

#86

Post by eurekin »

gethly wrote: post #36

I use Traefik for local development on daily basis, where I have to run double digit https services. It works, but it was a pain to set up. The documentation sucks ** and the config is confusing AF. I would never recommend this to anyone. If i will have to reinstall my computer one day, Traefik will not be welcomed back.

Oh, the static/dynamic split is brutal (and I believe some options have been moved around)...

Once you referenced routers, middleware and services simply by name, but that changed into per-source scoped versions (e.g. service1@file, middleware@docker).

I kept bumping into those edge cases (custom SSL cert set-up was really confusing), but thanks to chatgpt, I at least ended up with workable solutions.

Re: Traefik's 10-year anniversary

#88

Post by miiiiiike »

andrewstuart2 wrote: post #73
miiiiiike wrote: post #45

Earlier quoted context omitted.

With JWTs I don't do anything at the proxy beyond "This is a protected route. Is there a JWT? Is it valid? No to either? 403." This is one of the primary use cases for JWTs and it takes a majority of the load off of my application servers. The route is open to the public for authenticated and authorized users. You wouldn't use a VPN here.

That's really just added work, IMO, and likely room for security misconfiguration between backend and proxy. You should still be validating and everything on the application server to inspect identity and possibly attributes like roles, so in the cases where you have invalid tokens you do the work once, just in the proxy instead of the backend, and with valid tokens you will do the signature validation work twice.

Security starts at the edge.

Have you used JWTs in production? Better to bounce a bad JWT with a server written in C/C++/Rust/Go at the edge than to pass it back and have it tie up a Python or Node process.

Even in Python the time to validate a small JWT is negligible. At the edge it's nearly imperceptible.

Re: Traefik's 10-year anniversary

#90

Post by therein »

tecleandor wrote: post #62

There's a lot of mentions to Caddy here. Haven't used it as, back in the day, there was something funny about its license and binary distribution. AFAIK that's not a problem anymore, isn't it? From people that migrated from Traefik to Caddy... What are the main differences? Anything you really miss? I use Traefik in a bunch of small deployments, sometimes pointing to Docker stuff, sometimes outside of Docker, Kuberne…

Maybe you're thinking of the drama involving Caddy putting sponsorships into its Server header. They walked that back relatively quickly and hasn't been a problem since then.

Back when they both were on the rise, they felt equivalent. I haven't deployed Traefik in a long time but as far as I remember, Traefik's configuration is more service-discovery oriented. While they both are capable of working with a static set of hosts, it felt like Traefik made it harder to configure for a static set of upstream servers while Caddy made it much easier. Traefik almost started off with the assumption that you would have some service discovery of some sort.

Post reply on HN