Traefik is an open source reverse proxy and load balancer that makes setting up microservices easy. It uses a static configuration file or dynamic configuration through integrations with Docker, Kubernetes, and other orchestrators. Traefik automatically configures itself based on the backends it discovers, providing load balancing, SSL/TLS termination, monitoring, and more. It supports features like Let's Encrypt integration, health checks, rate limiting, and sticky sessions to route and monitor traffic to containerized applications.

1. Introduction to Traefik
#ContainerDay 2018 Verona
Giovanni Toraldo @gionn

2. ➔ Open Source enthusiast
➔ software developer / devops
➔ writer
➔ speaker
➔ aiming 2 euro coin at 36
meters with medieval
crossbow
➔ lead developer/co-founder at
@ClouDesire

5. https://demo.cloudesire.com

6. Why ANOTHER reverse-proxy?

7. Static configuration in a
dynamic environment
infrastructure and microservices

8. HTTPS everywhere
rsync certificates and pkey everywhere

9. Metrics & Monitoring

10. Lack of API

11. modern HTTP reverse proxy and load balancer

12. Project overview

15. Architecture

17. Static configuration
(TOML syntax)

18. Basic configuration - Entrypoints
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[[entryPoints.https.tls.certificates]]
certFile = "https/snitest.com.cert"
keyFile = "https/snitest.com.key"
[[entryPoints.https.tls.certificates]]
certFile = "https/snitest.org.cert"
keyFile = "https/snitest.org.key"

19. Basic configuration - Frontends
[frontends]
[frontends.frontend1]
backend = "backend2"
[frontends.frontend1.routes.test_1]
rule = "Host:test.localhost,test2.localhost"
[frontends.frontend2]
backend = "backend1"
[frontends.frontend2.routes.test_1]
rule = "HostRegexp:localhost,{subdomain:[a-z]+}.localhost"
[frontends.frontend3]
backend = "backend2"
[frontends.frontend3.routes.test_1]
rule = "Host:test3.localhost;Path:/test"

20. Basic configuration - Backends
[backends]
[backends.backend1]
[backends.backend1.servers.server1]
url = "http://172.17.0.2:80"
weight = 10
[backends.backend1.servers.server2]
url = "http://172.17.0.3:80"
weight = 1
[backends.backend2]
[backends.backend2.servers.server1]
url = "https://172.17.0.4:443"
weight = 1
[backends.backend2.servers.server2]
url = "https://172.17.0.5:443"
weight = 2

21. docker run -p 80:80 -p 443:443
-v ./traefik.toml:/traefik.toml
traefik:latest -c /traefik.toml

22. Dynamic configuration
Let magic happen

23. Backends real-time discovery
● Docker / Docker Swarm
● Kubernetes / Rancher
● Mesos / Marathon
● Consul Catalog
● Eureka (Netflix)
● Amazon ECS
● Azure Service Fabric
● Rest API
● Plain File

24. Docker backend
# Enable Docker Provider.
[docker]
# Docker server endpoint. Can be a tcp or a unix socket endpoint.
#
# Required
#
endpoint = "unix:///var/run/docker.sock"
# Default base domain used for the frontend rules.
#
# Required
#
domain = "docker.localhost"

25. Shared configuration
(cluster mode)
K/V store: Consul / Etcd / Zookeeper / BoltDB / DynamoDB

26. Traefik storeconfig
-c traefik.toml

27. traefik --consul
--consul.endpoint=127.0.0.1:8500
Cluster mode enabled

28. Real-life example
OwnCloud + Docker-compose + Letsencrypt
https://github.com/gionn/owncloud-traefik-example

29. Real-life example - traefik.toml
logLevel = "INFO"
defaultEntryPoints = ["https","http"]
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[acme]
email = "me@gionn.net"
storage = "acme.json"
entryPoint = "https"
onHostRule = true
[acme.httpChallenge]
entryPoint = "http"

30. Real-life example - docker-compose.yml
services:
reverse-proxy:
image: traefik
command: --api --docker -c /etc/traefik.toml
ports:
- "80:80"
- "443:443"
- "8080:8080" # The Web UI (enabled by --api)
volumes:
- /var/run/docker.sock:/var/run/docker.sock # Listen on Docker events
- ./traefik.toml:/etc/traefik.toml
- ./acme.json:/acme.json

31. Real-life example - docker-compose.yml (2)
services:
owncloud:
image: owncloud/server:${OWNCLOUD_VERSION}
...
labels:
- "traefik.frontend.rule=Host:owncloud.gionn.net"
db:
image: webhippie/mariadb:latest
...
labels:
- "traefik.enable=false"

32. Docker-compose up -d
profit

33. Native status & monitoring UI

36. Prometheus/InfluxDB/Statsd

38. Load balancing
wrr: Weighted Round Robin
drr: Dynamic Round Robin

39. Dynamic Round Robin examples
[backends]
[backends.backend1]
[backends.backend1.circuitbreaker]
expression = "NetworkErrorRatio() > 0.5"
#expression = "ResponseCodeRatio(500, 600, 0, 600) > 0.5"
#expression = "LatencyAtQuantileMS(50.0) > 50"
[backends.backend1.servers.server1]
url = "http://172.17.0.2:80"
weight = 10
[backends.backend1.servers.server2]
url = "http://172.17.0.3:80"
weight = 1

40. Health checks
GET /endpoint to validate backend

41. Health check example
[backends]
[backends.backend1]
[backends.backend1.healthcheck]
path = "/ping"
interval = "10s"
scheme = "http"

42. Rate limiter
429 Too Many Requests
Client ip, host header or custom header

43. Rate limiter example
[backends]
[backends.backend1]
[backends.backend1.maxconn]
amount = 10
extractorfunc = "client.ip"

44. Sticky sessions
Via cookie

45. Recap
● Configuration auto-reload
● Dynamic backend discovery and expose
● Letsencrypt HTTPS with autopilot
○ HTTP token challenge
○ DNS challenge (wildcard certificates)
● First-class load balancing with circuit-breakers, active health checks
● Cluster mode with K/V store
● Native metrics
● Status UI
● Distributed as alpine-based docker image (22 MB!)

46. THANKS