Traefik - Revision history

Leo: /* Certificates with intermediate signing certificates */

2025-07-02T16:44:28Z

Certificates with intermediate signing certificates

← Older revision		Revision as of 16:44, 2 July 2025
Line 297:		Line 297:

	Restart Traefik if you didn't previously have the dynamic config file defined in the traefik.conf previously. Traefik will automatically determine what domains it has certificates for and use it as required.		Restart Traefik if you didn't previously have the dynamic config file defined in the traefik.conf previously. Traefik will automatically determine what domains it has certificates for and use it as required.

			Your certificates must be set to mode 0600 (that is, it cannot be readable to anyone else) for them to be loaded properly.

	==== Certificates with intermediate signing certificates ====		==== Certificates with intermediate signing certificates ====
	If your certificate is signed by one or more intermediate certificates, you will likely want to include them within the certificate file you pass to Traefik. ~~Do this~~ by concatenating certificates furthest from the root certificate first. That is: your certificate, followed by the intermediates furthest from root first, then the root certificate.		If your certificate is signed by one or more intermediate certificates, you will likely want to include them within the certificate file you pass to Traefik. The certificate file containing the full set of intermediate and root certificates is called a fullchain certificate. This fullchain cert file can be generated by concatenating certificates furthest from the root certificate first. That is: your certificate, followed by the intermediates furthest from root first, then the root certificate.

	For example, if I have an Entrust certificate, concatenate the files together:		For example, if I have an Entrust certificate, concatenate the files together:
	{{Highlight		{{Highlight
	\| code = # cat ServerCertificate.crt Intermediate1.crt Intermediate2.crt Root.crt > ~~certificate~~.crt		\| code = # cat ServerCertificate.crt Intermediate1.crt Intermediate2.crt Root.crt > fullchain.crt

			## If your certs don't end on a new line...
			# for i in ServerCertificate.crt Intermediate1.crt Intermediate2.crt Root.crt ; do cat $i ; echo ; done > fullchain.crt
	\| lang = terminal		\| lang = terminal
	}}		}}Remember to set the mode to 0600 when using the fullchain certificate.{{Navbox Linux}}
	{{Navbox Linux}}
	{{Navbox Web}}		{{Navbox Web}}
	[[Category:WebApp]]		[[Category:WebApp]]
	[[Category:Linux]]		[[Category:Linux]]

Leo: Certificates with intermediate certs

2025-07-02T16:36:17Z

Certificates with intermediate certs

← Older revision		Revision as of 16:36, 2 July 2025
Line 298:		Line 298:
	Restart Traefik if you didn't previously have the dynamic config file defined in the traefik.conf previously. Traefik will automatically determine what domains it has certificates for and use it as required.		Restart Traefik if you didn't previously have the dynamic config file defined in the traefik.conf previously. Traefik will automatically determine what domains it has certificates for and use it as required.

			==== Certificates with intermediate signing certificates ====
			If your certificate is signed by one or more intermediate certificates, you will likely want to include them within the certificate file you pass to Traefik. Do this by concatenating certificates furthest from the root certificate first. That is: your certificate, followed by the intermediates furthest from root first, then the root certificate.

			For example, if I have an Entrust certificate, concatenate the files together:
			{{Highlight
			\| code = # cat ServerCertificate.crt Intermediate1.crt Intermediate2.crt Root.crt > certificate.crt
			\| lang = terminal
			}}
	{{Navbox Linux}}		{{Navbox Linux}}
	{{Navbox Web}}		{{Navbox Web}}
	[[Category:WebApp]]		[[Category:WebApp]]
	[[Category:Linux]]		[[Category:Linux]]

Leo at 18:39, 15 November 2022

2022-11-15T18:39:52Z

@@ Line 136: / Line 136: @@
        - "8080"
      restart: always
 | lang = terminal
 }}

Leo: /* Install a custom certificate */

2022-09-08T22:53:27Z

Install a custom certificate

← Older revision		Revision as of 22:53, 8 September 2022
Line 204:		Line 204:
	Installing a custom certificate and private key in Traefik is simple:		Installing a custom certificate and private key in Traefik is simple:

	# Edit the traefik.conf and ensure that it has a dynamic configuration set.		# Edit the traefik.conf and ensure that it has a dynamic configuration set. {{Highlight
	{{Highlight
	\| code = providers:		\| code = providers:
	file:		file:
Line 212:		Line 211:
	\| lang = yaml		\| lang = yaml
	}}		}}
	# In the dynamic configuration file, specify the certificate and key files. For example, here is what I would place for a *.example.com wildcard certificate:		# In the dynamic configuration file, specify the certificate and key files. For example, here is what I would place for a *.example.com wildcard certificate: {{Highlight
	{{Highlight
	\| code = tls:		\| code = tls:
	certificates:		certificates:
Line 222:		Line 220:
	# Place the certificates in the /config/ssl directory.		# Place the certificates in the /config/ssl directory.

	Restart Traefik if you didn't previously have the dynamic config file ~~set~~ previously~~. And that's all there is to it~~. Traefik will automatically determine what domains it has certificates for and use it as required.{{Navbox Linux}}		Restart Traefik if you didn't previously have the dynamic config file defined in the traefik.conf previously. Traefik will automatically determine what domains it has certificates for and use it as required.

			{{Navbox Linux}}
	{{Navbox Web}}		{{Navbox Web}}
	[[Category:WebApp]]		[[Category:WebApp]]
	[[Category:Linux]]		[[Category:Linux]]

Leo: /* Tasks */

2022-09-08T22:50:36Z

Tasks

@@ Line 200: / Line 200: @@
 | lang = terminal
 }}
 {{Navbox Linux}}
 {{Navbox Web}}
 [[Category:WebApp]]
 [[Category:Linux]]

Leo: /* Add a path prefix */

2022-01-11T01:08:39Z

Add a path prefix

Leo at 01:07, 11 January 2022

2022-01-11T01:07:26Z

@@ Line 141: / Line 141: @@
 ==Tasks==
-===Reverse proxy to a server using virtual hosts===
+===Add host header on requests to the backend===
 You can specify custom request headers by injecting a middleware. For example, when reverse proxying HTTP traffic for a website, you may wish to have the reverse proxy provide the 'Host' header. To do this, we can add the following dynamic config.
 {{Highlight
@@ Line 166: / Line 166: @@
            Host: "public.example.com"
 | lang = text
 }}
 {{Navbox Linux}}

Leo at 22:29, 31 December 2021

2021-12-31T22:29:02Z

Show changes

Leo: Updated categories

2021-12-30T01:42:49Z

Updated categories

← Older revision		Revision as of 01:42, 30 December 2021
Line 61:		Line 61:
	}}		}}
	{{Navbox Linux}}		{{Navbox Linux}}
			{{Navbox Web}}[[Category:WebApp]]
	[[Category:Linux]]		[[Category:Linux]]

Leo: Added categories and navbox

2021-12-30T01:23:18Z

Added categories and navbox

← Older revision		Revision as of 01:23, 30 December 2021
Line 60:		Line 60:
	\| lang = text		\| lang = text
	}}		}}
			{{Navbox Linux}}
			[[Category:Linux]]

← Older revision		Revision as of 01:08, 11 January 2022
Line 169:		Line 169:

	=== Add a path prefix ===		=== Add a path prefix ===
	To serve content under a specific path (eg. /downloads) using another container, create the service as you would normally but specify the router rule to include a <code>PathPrefix</code>. Traefik can also strip out this path prefix so that the underlying server sees only the root path. (eg. /downloads/file ~~becomes~~ /file).		To serve content under a specific path (eg. /downloads) using another container, create the service as you would normally but specify the router rule to include a <code>PathPrefix</code>. Traefik can also strip out this path prefix so that the underlying server sees only the root path (eg. have /downloads/file become /file) using the stripprefix middleware.

	Here is an example <code>docker-compose.yml</code> definition:		Here is an example <code>docker-compose.yml</code> definition:
Line 182:		Line 182:
	# http		# http
	- traefik.http.routers.downloads.entrypoints=http		- traefik.http.routers.downloads.entrypoints=http
	- 'traefik.http.routers.downloads.rule=(Host(`~~hpcdocs~~.~~ucalgary.ca~~`) && PathPrefix(`/downloads/`))'		- 'traefik.http.routers.downloads.rule=(Host(`example.com`) && PathPrefix(`/downloads/`))'
	- traefik.http.routers.downloads.middlewares=downloads-https-redirect		- traefik.http.routers.downloads.middlewares=downloads-https-redirect
	- traefik.http.middlewares.downloads-https-redirect.redirectscheme.scheme=https		- traefik.http.middlewares.downloads-https-redirect.redirectscheme.scheme=https
	# https		# https
	- traefik.http.routers.downloads-https.entrypoints=https		- traefik.http.routers.downloads-https.entrypoints=https
	- 'traefik.http.routers.downloads-https.rule=(Host(`~~hpcdocs~~.~~ucalgary.ca~~`) && PathPrefix(`/downloads/`))'		- 'traefik.http.routers.downloads-https.rule=(Host(`example.com`) && PathPrefix(`/downloads/`))'
	- traefik.http.routers.downloads-https.tls=true		- traefik.http.routers.downloads-https.tls=true
	- traefik.http.routers.downloads-https.tls.certresolver=letsencrypt		- traefik.http.routers.downloads-https.tls.certresolver=letsencrypt