{"id":19645821,"url":"https://github.com/approov/debian-traefik-setup","last_synced_at":"2025-04-28T14:33:04.163Z","repository":{"id":96185829,"uuid":"289303114","full_name":"approov/debian-traefik-setup","owner":"approov","description":"Install, setup and run Traefik on a Debian server in order to run all docker containers behind the same port 443 and 80, with automated LetsEncrypt certificates creation and renewal. ","archived":false,"fork":false,"pushed_at":"2021-02-13T18:45:25.000Z","size":8,"stargazers_count":11,"open_issues_count":0,"forks_count":3,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-04-05T09:11:21.319Z","etag":null,"topics":["approov","approov-backend","traefik","traefik-docker"],"latest_commit_sha":null,"homepage":"https://approov.io","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/approov.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-08-21T15:28:20.000Z","updated_at":"2024-04-04T16:07:09.000Z","dependencies_parsed_at":"2023-03-23T08:48:05.161Z","dependency_job_id":null,"html_url":"https://github.com/approov/debian-traefik-setup","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fdebian-traefik-setup","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fdebian-traefik-setup/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fdebian-traefik-setup/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fdebian-traefik-setup/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/approov","download_url":"https://codeload.github.com/approov/debian-traefik-setup/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251330597,"owners_count":21572317,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["approov","approov-backend","traefik","traefik-docker"],"created_at":"2024-11-11T14:35:28.772Z","updated_at":"2025-04-28T14:33:04.154Z","avatar_url":"https://github.com/approov.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# DEBIAN TRAEFIK SETUP\n\n[Traefik](https://containo.us/traefik/) setup to run all docker containers on a Debian server behind the same port 80 and 443 with automated LetsEncrypt certificates creation and renewal.\n\n\n## CREATE A NEW DEBIAN SERVER\n\nFirst of all create new Debian server in your provider of choice, but if you prefer to use an existing one, then you need to guarantee that the existing server doesn't have anything listening on port `80` or port `443`.\n\n### Update the New Server\n\nAssuming that you have a new brand server you should have now a shell as the `root` user, thus let's get it up to date with:\n\n```\napt update \u0026\u0026 apt -y upgrade\n```\n\n### Create an Unprivileged User\n\nWe will not run the demo as `root`, because it's a best security practice to not run as `root`.\n\nCheck if the server already have an unprivileged user:\n\n```\ngrep -irn :1000: /etc/passwd\n```\n\nOutput example for a server that already has one:\n\n```\n28:debian:x:1000:1000:Cloud-init-user,,,:/home/debian:/bin/bash\n```\n\nIf you don't get any output, then it means it doesn't exist yet, thus you can add a new unprivileged user with:\n\n```\nadduser debian\n```\n\u003e **NOTE**: Type you password and reply to all other questions with just hitting `enter`.\n\nAdd the user to `sudo` with:\n\n```\nusermod -aG sudo debian\n```\n\nSwitch to the `debian` user with:\n\n```\nsu - debian\n```\n\n### The Server Public IP Address\n\nIn the next step to setup the Domain DNS will need the public IP address for the server.\n\nFirst we need to install the `dnsutils` utils package:\n\n```txt\nsudo apt install -y dnsutils\n```\n\nNow you can get the public IP address for the server with:\n\n```txt\ndig +short myip.opendns.com @resolver1.opendns.com\n```\n\n## DOMAIN DNS SETUP\n\nBefore starting the setup a domain needs to be set-ed to point at the Debian server.\n\nFor example if the `demo.example.com` is used, then each backend added will use it as their base domain.\n\nSo when adding a backend for the [python shapes api](https://github.com/approov/quickstart-python-flask_shapes-api) you give it the domain in the likes of `python-shapes.demo.example.com`, and for the [nodejs shapes api](https://github.com/approov/quickstart-nodejs-express_shapes-api) you maybe name it like `nodejs-shapes.demo.example.com`.\n\nGo ahead and configure a domain at the DNS provider of your choice that points to the IP address from the previous step.\n\n\u003e **NOTE:** It's important that you add also a wild-card entry in the DNS record to point any sub-domain to the same IP.\n\n\n## FIREWALL SETUP\n\nEnsure that port `80` and `443` are open.\n\n\n## DEBIAN SERVER SETUP\n\n### Install Git\n\nWe will need `git` to clone this repository in order to install and setup Traefik:\n\n```\nsudo apt install -y git\n```\n\n### SSH Key\n\nIf the server already has one provisioned, then just `cat ~/.ssh/id_rsa.pub` and add it to your Gitlab/Github account, otherwise create it first. This step is only necessary when you need to clone repositories via SSH.\n\n\n### Instance Setup\n\n#### Cloning this repository\n\nLet's start by cloning this repository:\n\n```\ngit clone https://github.com/approov/debian-traefik-setup.git \u0026\u0026 cd debian-traefik-setup\n```\n\n#### The Traefik environment file\n\nCreating the `.env` file for Traefik:\n\n```\nsudo mkdir /opt/traefik \u0026\u0026 sudo cp ./traefik/.env.example /opt/traefik/.env\n```\n\nCustomize the `env.` file with your values:\n\n```\nsudo nano /opt/traefik/.env\n```\n\n#### Run the setup\n\nTraefik, Docker and Docker Compose will be installed and configured by running the bash script in the root of this repo:\n\n```\n./traefik-setup\n```\n\nThe end of the output will look like this:\n\n```\n---\u003e DOCKER COMPOSE VERSION \u003c---\ndocker-compose version 1.25.5, build 8a1c60f6\n\n\n---\u003e GIT VERSION\u003c---\ngit version 2.23.3\n\n\n---\u003e TRAEFIK installed at: /opt/traefik \u003c---\n\nFrom /opt/traefik folder you can ran any docker-compose command.\n\nSome useful examples:\n\n## Restart Traefik:\nsudo docker-compose restart traefik\n\n## Start Traefik:\nsudo docker-compose up -d traefik\n\n## Destroy Traefik:\nsudo docker-compose down\n\n## Tailing the Traefik logs in realtime:\nsudo docker-compose logs --follow traefik\n\n---\u003e TRAEFIK is now listening for new docker containers \u003c---\n```\n\nThis setup script will let Traefik running and listening for incoming requests on port `80` and `443`, where requests for port `80` will be redirected to port `443`.\n\n\n## TLS CERTIFICATES\n\nTraefik uses LetsEncrypt to automatically generated and renew TLS certificates for all domains is listening on, and the will keep the public key unchanged, thus a mobile app can implement certificate pinning against the public key without the concern of having the pin changed at each renewal of the certificate.\n\n\n## DEPLOY SERVER EXAMPLE\n\nLet's see an example of deploying the Python Shapes API backend into an Debian server listening at `*.demo.example.com`.\n\n#### Create the folder\n\n```\nmkdir -p ~/backend \u0026\u0026 cd ~/backend\n```\n\n#### Clone the repo\n\n```\ngit clone https://github.com/approov/quickstart-python-flask_shapes-api \u0026\u0026 cd quickstart-python-flask_shapes-api\n```\n\n#### Create the .env file\n\n```\ncp .env.example .env\n```\n\n#### Edit the .env file\n\nReplace the default domain with your own server domain:\n\n```bash\nPYTHON_FLASK_SHAPES_DOMAIN=python-shapes.demo.example.com\n```\n\nReplace the dummy Approov secret on it with the one for your Approov account:\n\n```bash\n# approov secret -get base64\nAPPROOV_BASE64_SECRET=your-secret-here\n```\n\n#### Build the Docker Stack\n\n```\nsudo docker-compose build\n```\n\n#### Start the Docker Stack\n\n```\nsudo docker-compose up -d\n```\n\nNow in your browser visit `python-shapes.demo.example.com` to check that the server is accepting requests.\n\n#### Tail the logs\n\n```\nsudo docker-compose logs -f\n```\n\n## ADD A CONTAINER TO TRAEFIK\n\n\u003e **NOTE:** No need to follow this for the above Deploy Server Example. You only need to follow this part when your project doesn't have yet Traefik labels in the `docker-compose.yml` file.\n\nTraefik inspects the labels in all running docker containers to know what ones it needs to proxy requests for.\n\nSo if your backend does not have yet support for Traefik in the `docker-compose.yml` file you can configure your service like this:\n\n```yml\nservices:\n\n    api:\n        ...\n\n        labels:\n            - \"traefik.enable=true\"\n\n            # The public domain name for your docker container\n            - \"traefik.frontend.rule=Host:api.demo.example.com\"\n\n            # Doesn't need to be exactly the same as the domain name.\n            - \"traefik.backend=api.demo.example.com\"\n\n            # The external docker network that Traefik uses to proxy request to containers.\n            - \"traefik.docker.network=traefik\"\n\n            # This is the internal container port, not the public one.\n            - \"traefik.port=5000\"\n...\n\nnetworks:\n    ...\n\n    traefik:\n        external: true\n\n```\n\nWith this configuration all requests for `https://api.demo.example.com` will be proxy by Traefik to the docker container with the backend label `traefik.backend=api.demo.example.com` on the internal container network port `traefik.port=5000`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapproov%2Fdebian-traefik-setup","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fapproov%2Fdebian-traefik-setup","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapproov%2Fdebian-traefik-setup/lists"}