Traefik Reverse Proxy: Moderner Load Balancer für Docker und Kubernetes

Traefik ist ein moderner Edge Router und Reverse Proxy, der für Microservice-Architekturen entwickelt wurde. Dank seiner tiefen Integration mit Docker und Kubernetes erkennt und leitet er Services automatisch weiter.

Was ist Traefik?

Hauptmerkmale von Traefik:

Automatische Service-Erkennung: Automatisches Routing über Docker/Kubernetes-Labels
Let's Encrypt-Integration: Automatisches SSL-Zertifikatmanagement
Middleware-System: Auth, Rate Limiting, Redirect, Headers
Dashboard: Echtzeit-Überwachungsschnittstelle
Mehrere Provider: Docker, Kubernetes, Consul, etcd-Unterstützung
TCP/UDP-Routing: Unterstützung für Nicht-HTTP-Protokolle

Traefik v3 bietet bessere Performance und neue Funktionen im Vergleich zu v2. Dieser Leitfaden konzentriert sich auf Traefik v3.

Traefik v3 Installation

Installation mit Docker Compose

hljs yaml

# docker-compose.yml
services:
  traefik:
    image: traefik:v3.0
    container_name: traefik
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"  # Dashboard (in Production schließen)
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./config:/etc/traefik/config:ro
      - traefik_certs:/certs
    networks:
      - traefik-net
    labels:
      - "traefik.enable=true"
      # Dashboard
      - "traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$xyz$$hash"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"

volumes:
  traefik_certs:

networks:
  traefik-net:
    external: true

traefik.yml Konfiguration

hljs yaml

# traefik.yml
global:
  checkNewVersion: true
  sendAnonymousUsage: false

api:
  dashboard: true
  insecure: false  # false in Production

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true

  websecure:
    address: ":443"
    http:
      tls:
        certResolver: letsencrypt
    http3:
      advertisedPort: 443

certificatesResolvers:
  letsencrypt:
    acme:
      email: admin@example.com
      storage: /certs/acme.json
      httpChallenge:
        entryPoint: web
      # DNS-Challenge (für Wildcard)
      # dnsChallenge:
      #   provider: cloudflare
      #   resolvers:
      #     - "1.1.1.1:53"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: traefik-net
  file:
    directory: /etc/traefik/config
    watch: true

log:
  level: INFO
  filePath: /var/log/traefik/traefik.log

accessLog:
  filePath: /var/log/traefik/access.log
  bufferingSize: 100

Automatisches Routing mit Docker Provider

Registrieren Sie Services automatisch bei Traefik mit Docker-Labels:

hljs yaml

# Beispielanwendung
services:
  webapp:
    image: nginx:alpine
    networks:
      - traefik-net
    labels:
      # Traefik aktivieren
      - "traefik.enable=true"

      # HTTP-Router
      - "traefik.http.routers.webapp.rule=Host(`app.example.com`)"
      - "traefik.http.routers.webapp.entrypoints=websecure"
      - "traefik.http.routers.webapp.tls.certresolver=letsencrypt"

      # Service-Port
      - "traefik.http.services.webapp.loadbalancer.server.port=80"

      # Middleware anwenden
      - "traefik.http.routers.webapp.middlewares=security-headers,rate-limit"

networks:
  traefik-net:
    external: true

Multi-Service-Beispiel

hljs yaml

services:
  api:
    image: myapi:latest
    networks:
      - traefik-net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`api.example.com`)"
      - "traefik.http.routers.api.entrypoints=websecure"
      - "traefik.http.routers.api.tls.certresolver=letsencrypt"
      - "traefik.http.services.api.loadbalancer.server.port=3000"
      # Health Check
      - "traefik.http.services.api.loadbalancer.healthcheck.path=/health"
      - "traefik.http.services.api.loadbalancer.healthcheck.interval=30s"

  frontend:
    image: myfrontend:latest
    networks:
      - traefik-net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.frontend.rule=Host(`example.com`) || Host(`www.example.com`)"
      - "traefik.http.routers.frontend.entrypoints=websecure"
      - "traefik.http.routers.frontend.tls.certresolver=letsencrypt"
      - "traefik.http.services.frontend.loadbalancer.server.port=80"

networks:
  traefik-net:
    external: true

Middleware-Konfiguration

Statische Middleware (traefik.yml oder Konfigurationsdatei)

hljs yaml

# config/middlewares.yml
http:
  middlewares:
    # Sicherheits-Header
    security-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        forceSTSHeader: true
        contentTypeNosniff: true
        frameDeny: true
        referrerPolicy: "strict-origin-when-cross-origin"
        customResponseHeaders:
          X-Powered-By: ""
          Server: ""

    # Rate Limiting
    rate-limit:
      rateLimit:
        average: 100
        burst: 50
        period: 1m
        sourceCriterion:
          ipStrategy:
            depth: 1

    # Basic Auth
    basic-auth:
      basicAuth:
        users:
          - "admin:$apr1$xyz$hashedpassword"
        removeHeader: true

    # IP-Allowlist
    ip-whitelist:
      ipAllowList:
        sourceRange:
          - "192.168.1.0/24"
          - "10.0.0.0/8"

    # www zu non-www umleiten
    www-redirect:
      redirectRegex:
        regex: "^https://www\\.(.*)"
        replacement: "https://${1}"
        permanent: true

Dashboard

hljs yaml

# Sichere Dashboard-Konfiguration
labels:
  - "traefik.enable=true"
  - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
  - "traefik.http.routers.traefik-dashboard.service=api@internal"
  - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
  - "traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt"
  - "traefik.http.routers.traefik-dashboard.middlewares=dashboard-auth"
  - "traefik.http.middlewares.dashboard-auth.basicauth.users=admin:$$apr1$$xyz$$hash"

Basic-Auth-Passwort generieren:

hljs bash

# Passwort mit htpasswd generieren
echo $(htpasswd -nB admin) | sed -e s/\\$/\\$\\$/g

# Oder mit openssl
echo "admin:$(openssl passwd -apr1 'IhrPasswort')" | sed -e 's/\$/\$\$/g'

Kubernetes Ingress Controller

Installation mit Helm

hljs bash

# Traefik Helm-Repository hinzufügen
helm repo add traefik https://traefik.github.io/charts
helm repo update

# Traefik installieren
helm install traefik traefik/traefik \
  --namespace traefik \
  --create-namespace \
  --set deployment.replicas=2 \
  --set ports.web.redirectTo.port=websecure \
  --set ingressRoute.dashboard.enabled=true

IngressRoute (Traefik CRD)

hljs yaml

# ingressroute.yml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: webapp-ingress
  namespace: default
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`app.example.com`)
      kind: Rule
      services:
        - name: webapp-service
          port: 80
      middlewares:
        - name: security-headers
  tls:
    certResolver: letsencrypt

Middleware CRD

hljs yaml

# middleware.yml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: security-headers
  namespace: default
spec:
  headers:
    stsSeconds: 31536000
    stsIncludeSubdomains: true
    contentTypeNosniff: true
    frameDeny: true

TCP/UDP-Routing

hljs yaml

# traefik.yml - TCP-Entrypoint
entryPoints:
  mysql:
    address: ":3306"
  redis:
    address: ":6379"

hljs yaml

# config/tcp.yml
tcp:
  routers:
    mysql-router:
      entryPoints:
        - mysql
      rule: "HostSNI(`*`)"
      service: mysql-service

  services:
    mysql-service:
      loadBalancer:
        servers:
          - address: "mysql:3306"

Load Balancing

hljs yaml

# Load Balancing mit mehreren Instanzen
services:
  api:
    image: myapi:latest
    deploy:
      replicas: 3
    networks:
      - traefik-net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`api.example.com`)"
      - "traefik.http.services.api.loadbalancer.server.port=3000"
      # Sticky Sessions
      - "traefik.http.services.api.loadbalancer.sticky.cookie=true"
      - "traefik.http.services.api.loadbalancer.sticky.cookie.name=traefik_session"
      - "traefik.http.services.api.loadbalancer.sticky.cookie.secure=true"
      # Health Check
      - "traefik.http.services.api.loadbalancer.healthcheck.path=/health"
      - "traefik.http.services.api.loadbalancer.healthcheck.interval=10s"
      - "traefik.http.services.api.loadbalancer.healthcheck.timeout=3s"

Fazit

Traefik ist eine leistungsstarke Reverse-Proxy- und Load-Balancer-Lösung für moderne Microservice-Infrastrukturen. Mit seiner tiefen Integration in Docker und Kubernetes, automatischem SSL-Management und einem reichen Middleware-Ökosystem ist es eine zuverlässige Wahl für Produktionsumgebungen. Dank der Label-basierten Konfiguration kann jeder Service seine eigenen Routing-Regeln definieren.

Traefik Reverse Proxy: Moderner Load Balancer für Docker und Kubernetes

Inhaltsverzeichnis