{"id":19645818,"url":"https://github.com/approov/aws-ec2-traefik-setup","last_synced_at":"2025-04-28T14:33:01.319Z","repository":{"id":47960655,"uuid":"275127132","full_name":"approov/aws-ec2-traefik-setup","owner":"approov","description":"Install, setup and run Traefik on AWS EC2 instances to run all docker containers behind the same port 443 and 80, with automated LetsEncrypt certificates creation and renewal.","archived":false,"fork":false,"pushed_at":"2020-06-30T15:32:12.000Z","size":6,"stargazers_count":33,"open_issues_count":0,"forks_count":6,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-04-05T09:11:12.173Z","etag":null,"topics":["approov","approov-backend","aws","aws-ec2","docker","docker-compose","docker-container","docker-containers","traefik","traefik-docker"],"latest_commit_sha":null,"homepage":"https://approov.io","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/approov.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-06-26T10:12:36.000Z","updated_at":"2024-05-19T08:10:00.000Z","dependencies_parsed_at":"2022-08-12T15:20:11.970Z","dependency_job_id":null,"html_url":"https://github.com/approov/aws-ec2-traefik-setup","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Faws-ec2-traefik-setup","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Faws-ec2-traefik-setup/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Faws-ec2-traefik-setup/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Faws-ec2-traefik-setup/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/approov","download_url":"https://codeload.github.com/approov/aws-ec2-traefik-setup/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251330580,"owners_count":21572312,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["approov","approov-backend","aws","aws-ec2","docker","docker-compose","docker-container","docker-containers","traefik","traefik-docker"],"created_at":"2024-11-11T14:35:28.654Z","updated_at":"2025-04-28T14:32:56.287Z","avatar_url":"https://github.com/approov.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# AWS EC2 TRAEFIK SETUP\n\n[Traefik](https://containo.us/traefik/) setup to run all docker containers on AWS EC2 instances behind the same port 80 and 443 with automated LetsEncrypt certificates creation and renewal.\n\n\n## CREATE A NEW AWS EC2 INSTANCE\n\nFirst of all create new AWS EC2 instance, otherwise you need to guarantee that the existing one doesn't have anything listening on port `80` or port `443`.\n\nNow grab the IP address for it in order to point a domain to it.\n\n\n## DOMAIN DNS SETUP\n\nBefore starting the setup a domain needs to be set-ed to point at the EC2 instance.\n\nFor example if the `demo.example.com` is used, then each backend added will use it as their base domain. So when adding a backend for the python shapes api you give it the domain in the likes of `python-shapes.demo.example.com`, and for nodejs `nodejs-shapes.demo.example.com`.\n\nGo ahead and configure a domain at Route53 or at any other provider, and point it to the IP address from the previous step.\n\n\u003e **NOTE:** It's important that you add also a wild-card entry in the DNS record to point any sub-domain to the same IP.\n\n\n## FIREWALL SETUP\n\nEnsure that port `80` and `443` are open.\n\n\n## AWS EC2 INSTANCE SETUP\n\n### Install Git\n\n```\nyum install -y git\n```\n\n### SSH Key\n\nIf the instance already has one, then just `cat ~/.ssh/id_rsa.pub` and add it to your Gitlab/Github account, otherwise create it first.\n\n\n### Instance Setup\n\n#### Cloning this repository\n\nLet's start by cloning this repository:\n\n```\ngit clone https://github.com/approov/aws-ec2-traefik-setup.git \u0026\u0026 cd aws-ec2-traefik-setup\n```\n\n#### The Traefik environment file\n\nCreating the `.env` file for Traefik:\n\n```\nsudo mkdir /opt/traefik \u0026\u0026 sudo cp ./traefik/.env.example /opt/traefik/.env\n```\n\nCustomize the `env.` file with your values:\n\n```\nsudo nano /opt/traefik/.env\n```\n\n#### Run the setup\n\nTraefik, Docker and Docker Compose will be installed and configured by running the bash script in the root of this repo:\n\n```\n./aws-ec2-setup.sh\n```\n\nThe end of the output will look like this:\n\n```\n---\u003e DOCKER COMPOSE VERSION \u003c---\ndocker-compose version 1.25.5, build 8a1c60f6\n\n\n---\u003e GIT VERSION\u003c---\ngit version 2.23.3\n\n\n---\u003e TRAEFIK installed at: /opt/traefik \u003c---\n\nFrom /opt/traefik folder you can ran any docker-compose command.\n\nSome useful examples:\n\n## Restart Traefik:\nsudo docker-compose restart traefik\n\n## Start Traefik:\nsudo docker-compose up -d traefik\n\n## Destroy Traefik:\nsudo docker-compose down\n\n## Tailing the Traefik logs in realtime:\nsudo docker-compose logs --follow traefik\n\n---\u003e TRAEFIK is now listening for new docker containers \u003c---\n```\n\nThis setup script will let Traefik running and listening for incoming requests on port `80` and `443`, where requests for port `80` will be redirected to port `443`.\n\n\n## TLS CERTIFICATES\n\nTraefik uses LetsEncrypt to automatically generated and renew TLS certificates for all domains is listening on, and the will keep the public key unchanged, thus a mobile app can implement certificate pinning against the public key without the concern of having the pin changed at each renewal of the certificate.\n\n\n## DEPLOY SERVER EXAMPLE\n\nLet's see an example of deploying Python Shapes API backend into an EC2 instance listening at `*.demo.example.com`.\n\n#### Create the folder\n\n```\nmkdir -p ~/backend \u0026\u0026 cd ~/backend\n```\n\n#### Clone the repo\n\n```\ngit clone https://github.com/approov/python-flask_approov-shapes-api-server \u0026\u0026 cd python-flask_approov-shapes-api-server\n```\n\n#### Create the .env file\n\n```\ncp .env.example .env\n```\n\n#### Edit the .env file\n\nReplace the default domain with your own server domain:\n\n```bash\nPYTHON_FLASK_SHAPES_DOMAIN=python-shapes.demo.example.com\n```\n\nReplace the dummy Approov secret on it with the one for your Approov account:\n\n```bash\n# approov secret -get base64\nAPPROOV_BASE64_SECRET=your-secret-here\n```\n\n#### Start the Docker Stack\n\n```\nsudo docker-compose up -d\n```\n\nNow in your browser visit `python-shapes.demo.example.com` to check the server is accepting requests.\n\n#### Tail the logs\n\n```\nsudo docker-compose logs -f\n```\n\n## ADD A CONTAINER TO TRAEFIK\n\n\u003e **NOTE:** No need to follow this for the above Deploy Server Example. You only need to follow this part when your project doesn't have yet Traekik labels in the `docker-compose.yml` file.\n\nTraefik inspects the labels in all running docker containers to know for what ones needs to proxy requests.\n\nSo if your backend does not have yet support for Traefik in the `docker-compose.yml` file you can configure your service like this:\n\n```yml\nservices:\n\n    api:\n        ...\n\n        labels:\n            - \"traefik.enable=true\"\n\n            # The public domain name for your docker container\n            - \"traefik.frontend.rule=Host:api.demo.example.com\"\n\n            # Doesn't need to be exactly the same as the domain name.\n            - \"traefik.backend=api.demo.example.com\"\n\n            # The external docker network that Traefik uses to proxy request to containers.\n            - \"traefik.docker.network=traefik\"\n\n            # This is the internal container port, not the public one.\n            - \"traefik.port=5000\"\n...\n\nnetworks:\n    ...\n\n    traefik:\n        external: true\n\n```\n\nWith this configuration all requests for `https://api.demo.example.com` will be proxy by Traefik to the docker container with the backend label `traefik.backend=api.demo.example.com` on the internal container network port `traefik.port=5000`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapproov%2Faws-ec2-traefik-setup","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fapproov%2Faws-ec2-traefik-setup","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapproov%2Faws-ec2-traefik-setup/lists"}