How to securely host website with Docker and Traefik?

What is Traefik?

Traefik is a modern reverse proxy and load balancer that was created for dynamic management of network traffic in microservice environments. Unlike traditional tools, Traefik is designed to integrate seamlessly with modern tools and platforms such as Docker and Kubernetes.

Traefik key features

1. Automatic configuration - One of the main features of Traefik is its ability to automatically discover services and configure routes (DNS). Thanks to integration with systems such as Kubernetes or Docker, Traefik automatically updates its settings when new services are added, changed or removed.
2. Support for multiple protocols - Traefik supports both TCP and UDP protocols, so it can be used in a wide range of applications. Additionally, it offers the ability to create middlewares that allow for increased control over applications.
3. Easy SSL setup - Traefik automatically manages SSL certificates using Let's Encrypt. This makes it possible to easily and quickly implement secure HTTPS connections without the need to manually manage certificates.
4. Loadbalancer - Traefik offers advanced load balancing features that enable even distribution of network traffic between different service instances.
5. Label based routing - In order to host the application on our domain, all we need to do is add the appropriate label to the container in the file docker-compose.yml

Why choose Traefik and not e.g. Docker Reverse Proxy?

Traefik, although it may seem difficult to use at first glance, will actually allow us to manage our container applications in a much simpler way than using e.g. Docker Reverse Proxy. If we use Traefik, we do not have to configure SSL certificates ourselves, worry about HTTP to HTTPS redirects, and we can also use Middleware quickly and easily. Additionally, the platform itself offers many advanced plug-ins that are worth considering for selected projects.

How to configure Traefik?

Below is a minimalist compose.yml file containing the basic Traefik configuration for Development.

In the above example, we have defined the Traefik service with the following parameters:

• We have provided ports 80 and 443 for our Traefik Reverse Proxy
• We have created a volume for SSL certificates
• We have provided access to our Docker Socet for the Traefik website (UNSAFE)
• In the commands section, we configured ports and SSL certificates, and additionally launched Traefik Dashboard
• In the labels section, we have assigned access to our Traefik Dashboard at the URL example.domain and

In order to test the above configuration, you must have a purchased domain. If you have one, point it to your VPS server. Below is an example configuration of my domains.

Go to the domain of your choice, if everything works correctly, you will find the Traefik Dashboard here.

Why is the above configuration not safe?

Now that we know the basic configuration of the Traefik website, it would be worth finding out what it should look like in a safe way. The above solution has several problems:

• We provide direct access to the Docker socket, which we should NEVER do unless we know how to do it
• We provide the Traefik API, which is additionally not protected in any way, so the attacker can view all our information
• Traefik Dashboard itself is also available to the public and is not password protected.

Traefik safe configuration example

Below we will configure Traefik to use Docer Socet via proxy and completely disable access to Traefik Dashboard.

Compare the safe example above with the previous one. The current solution does not provide Traefick Dashboard and uses an additional service called Socket-Proxy, which allows for limited communication between our Traefick and the Docker Socket. If necessary, you can additionally make a more restrictive proxy configuration using environment variables.

Traefik Configuration File Structure

As we have noticed in the above examples, Traefik's configuration is not complicated, however, when we start defining our websites, we must meet one important requirement. Analyze the following example carefully...

• image: traefik/whoami - Our Application Image
• container_name: "testing" - Our Container Name
• traefik.enable=true" - Starts Routing for a given container
• traefik.http.routers.SERVICE_NAME.rule=Host(`example.com`)" - Specifies the URL address where the application is to be located
• traefik.http.routers.SERVICE_NAME.entrypoints=websecure" - Tells Traefik to host the application via port 443 (HTTPS)
• traefik.http.routers.SERVICE_NAME.certesolver=myresolver" - Tells Traefik to use our SSL (Let's Encrypt) agent
• traefik.http.routers.SERVICE_NAME.middlewares=waf@docker" - Informs Traefik that the given application should use the specified middleware
• networks: - In this section, let's connect the application to the Traefik-External network (Public network) created by us

The entire Traefik configuration file with the HTTP page connected

Below is the entire configuration file containing the running website.

After switching to the domain of your choice, you should see a simple application that will display information about your query sent to the server. In exactly the same way you will be able to run any web applications.