888 lines
27 KiB
HTML
888 lines
27 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>Building a High-Availability Traefik Router with Docker Compose | River Rooks</title>
|
|
<style>
|
|
@import url('https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:ital,wght@0,400;0,500;0,700;1,400&family=Inter:ital,wght@0,400;0,500;0,700;1,400&family=JetBrains+Mono:ital,wght@0,400;0,500;1,400&display=swap');
|
|
|
|
:root {
|
|
--bg-canvas: #0d0f12; /* Deep slate/charcoal canvas */
|
|
--bg-surface: #121417; /* Tile surface */
|
|
--bg-elevated: #1c1f26; /* Hovered surface */
|
|
--border-color: #2b303b; /* Crisp 1px border */
|
|
--text-primary: #e0e6f0; /* Light off-white prose */
|
|
--text-muted: #8a95a5; /* Monospace metadata */
|
|
--accent-cyan: #00f0ff; /* Active accent */
|
|
--accent-green: #00e676; /* Success / online */
|
|
--accent-amber: #ffb700; /* Warning / highlight */
|
|
}
|
|
|
|
* {
|
|
box-sizing: border-box;
|
|
margin: 0;
|
|
padding: 0;
|
|
}
|
|
|
|
body {
|
|
background-color: var(--bg-canvas);
|
|
color: var(--text-primary);
|
|
font-family: 'Inter', sans-serif;
|
|
line-height: 1.7;
|
|
min-height: 100vh;
|
|
display: flex;
|
|
flex-direction: column;
|
|
align-items: center;
|
|
padding: 24px 16px 48px 16px;
|
|
}
|
|
|
|
.tiling-layout {
|
|
width: 100%;
|
|
max-width: 1160px;
|
|
display: flex;
|
|
flex-direction: column;
|
|
gap: 16px;
|
|
}
|
|
|
|
/* Top Global Header Bar (Gateway 3 Standard) */
|
|
.global-bar {
|
|
background-color: var(--bg-surface);
|
|
border: 1px solid var(--border-color);
|
|
border-radius: 4px;
|
|
padding: 10px 18px;
|
|
display: flex;
|
|
justify-content: space-between;
|
|
align-items: center;
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 0.8rem;
|
|
flex-wrap: wrap;
|
|
gap: 10px;
|
|
}
|
|
|
|
.brand-group {
|
|
display: flex;
|
|
align-items: center;
|
|
gap: 10px;
|
|
color: var(--text-primary);
|
|
font-weight: 700;
|
|
}
|
|
|
|
.status-indicator {
|
|
width: 8px;
|
|
height: 8px;
|
|
background-color: var(--accent-green);
|
|
display: inline-block;
|
|
}
|
|
|
|
.bar-nav {
|
|
display: flex;
|
|
gap: 14px;
|
|
align-items: center;
|
|
}
|
|
|
|
.bar-link {
|
|
color: var(--text-muted);
|
|
text-decoration: none;
|
|
transition: none; /* Instant snap */
|
|
}
|
|
|
|
.bar-link:hover {
|
|
color: var(--accent-cyan);
|
|
}
|
|
|
|
/* Right Sidebar Reading Workspace Grid: Content (Left) + Sidebar (Right) */
|
|
.article-workspace-grid {
|
|
display: grid;
|
|
grid-template-columns: 1fr 290px;
|
|
gap: 16px;
|
|
align-items: start;
|
|
}
|
|
|
|
@media (max-width: 960px) {
|
|
.article-workspace-grid {
|
|
grid-template-columns: 1fr;
|
|
}
|
|
.article-sidebar {
|
|
order: -1; /* Display TOC on top on mobile viewports */
|
|
}
|
|
}
|
|
|
|
/* Article Content Container Tile */
|
|
.article-tile {
|
|
background-color: var(--bg-surface);
|
|
border: 1px solid var(--border-color);
|
|
border-radius: 4px;
|
|
padding: 36px 40px;
|
|
display: flex;
|
|
flex-direction: column;
|
|
gap: 24px;
|
|
}
|
|
|
|
@media (max-width: 600px) {
|
|
.article-tile {
|
|
padding: 24px 18px;
|
|
}
|
|
}
|
|
|
|
.article-header-block {
|
|
border-bottom: 1px solid var(--border-color);
|
|
padding-bottom: 24px;
|
|
display: flex;
|
|
flex-direction: column;
|
|
gap: 12px;
|
|
}
|
|
|
|
.article-breadcrumbs {
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 0.78rem;
|
|
color: var(--text-muted);
|
|
display: flex;
|
|
align-items: center;
|
|
gap: 8px;
|
|
}
|
|
|
|
.article-main-title {
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 2.3rem;
|
|
font-weight: 700;
|
|
color: var(--text-primary);
|
|
letter-spacing: -0.02em;
|
|
line-height: 1.25;
|
|
}
|
|
|
|
@media (max-width: 768px) {
|
|
.article-main-title {
|
|
font-size: 1.8rem;
|
|
}
|
|
}
|
|
|
|
.article-meta-row {
|
|
display: flex;
|
|
flex-wrap: wrap;
|
|
align-items: center;
|
|
gap: 14px;
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 0.8rem;
|
|
color: var(--text-muted);
|
|
}
|
|
|
|
.tag-chip {
|
|
background-color: var(--bg-canvas);
|
|
border: 1px solid var(--border-color);
|
|
padding: 2px 6px;
|
|
border-radius: 2px;
|
|
color: var(--text-muted);
|
|
}
|
|
|
|
/* Right Sidebar Components */
|
|
.article-sidebar {
|
|
display: flex;
|
|
flex-direction: column;
|
|
gap: 16px;
|
|
position: sticky;
|
|
top: 16px;
|
|
}
|
|
|
|
.sidebar-tile {
|
|
background-color: var(--bg-surface);
|
|
border: 1px solid var(--border-color);
|
|
border-radius: 4px;
|
|
padding: 18px;
|
|
display: flex;
|
|
flex-direction: column;
|
|
gap: 12px;
|
|
}
|
|
|
|
.sidebar-heading {
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 0.82rem;
|
|
font-weight: 700;
|
|
color: var(--text-muted);
|
|
text-transform: uppercase;
|
|
letter-spacing: 0.05em;
|
|
border-bottom: 1px solid var(--border-color);
|
|
padding-bottom: 8px;
|
|
display: flex;
|
|
justify-content: space-between;
|
|
align-items: center;
|
|
}
|
|
|
|
.toc-nav {
|
|
display: flex;
|
|
flex-direction: column;
|
|
gap: 4px;
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 0.78rem;
|
|
}
|
|
|
|
.toc-link {
|
|
color: var(--text-muted);
|
|
text-decoration: none;
|
|
padding: 4px 6px;
|
|
border-radius: 2px;
|
|
transition: none;
|
|
line-height: 1.4;
|
|
display: block;
|
|
}
|
|
|
|
.toc-link:hover {
|
|
background-color: var(--bg-elevated);
|
|
color: var(--accent-cyan);
|
|
}
|
|
|
|
.toc-link.active {
|
|
color: var(--accent-cyan);
|
|
background-color: var(--bg-canvas);
|
|
border-left: 2px solid var(--accent-cyan);
|
|
font-weight: 700;
|
|
}
|
|
|
|
.toc-sub {
|
|
padding-left: 14px;
|
|
color: var(--text-muted);
|
|
font-size: 0.74rem;
|
|
}
|
|
|
|
/* Collapsible Menu */
|
|
.collapsible-drawer {
|
|
border: 1px solid var(--border-color);
|
|
border-radius: 3px;
|
|
background-color: var(--bg-canvas);
|
|
overflow: hidden;
|
|
}
|
|
|
|
.collapsible-summary {
|
|
background-color: var(--bg-elevated);
|
|
padding: 8px 12px;
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 0.76rem;
|
|
font-weight: 700;
|
|
color: var(--text-primary);
|
|
cursor: pointer;
|
|
list-style: none;
|
|
display: flex;
|
|
justify-content: space-between;
|
|
align-items: center;
|
|
user-select: none;
|
|
}
|
|
|
|
.collapsible-summary::-webkit-details-marker {
|
|
display: none;
|
|
}
|
|
|
|
.collapsible-summary::after {
|
|
content: "[+]";
|
|
color: var(--accent-cyan);
|
|
font-weight: 700;
|
|
}
|
|
|
|
.collapsible-drawer[open] .collapsible-summary::after {
|
|
content: "[-]";
|
|
}
|
|
|
|
.drawer-content {
|
|
padding: 10px;
|
|
display: flex;
|
|
flex-direction: column;
|
|
gap: 8px;
|
|
}
|
|
|
|
.related-card {
|
|
background-color: var(--bg-surface);
|
|
border: 1px solid var(--border-color);
|
|
border-radius: 2px;
|
|
padding: 8px 10px;
|
|
text-decoration: none;
|
|
display: flex;
|
|
flex-direction: column;
|
|
gap: 3px;
|
|
transition: none;
|
|
}
|
|
|
|
.related-card:hover {
|
|
border-color: var(--accent-cyan);
|
|
background-color: var(--bg-elevated);
|
|
}
|
|
|
|
.related-date {
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 0.7rem;
|
|
color: var(--accent-cyan);
|
|
}
|
|
|
|
.related-title {
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 0.8rem;
|
|
font-weight: 700;
|
|
color: var(--text-primary);
|
|
line-height: 1.35;
|
|
}
|
|
|
|
.related-card:hover .related-title {
|
|
color: var(--accent-cyan);
|
|
}
|
|
|
|
/* Markdown Prose Elements */
|
|
.markdown-prose {
|
|
max-width: 68ch;
|
|
font-size: 1.02rem;
|
|
color: var(--text-primary);
|
|
line-height: 1.7;
|
|
}
|
|
|
|
.markdown-prose p {
|
|
margin-bottom: 18px;
|
|
}
|
|
|
|
.markdown-prose h2 {
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 1.45rem;
|
|
font-weight: 700;
|
|
color: var(--text-primary);
|
|
margin: 36px 0 16px 0;
|
|
padding-bottom: 8px;
|
|
border-bottom: 1px solid var(--border-color);
|
|
}
|
|
|
|
.markdown-prose h3 {
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 1.15rem;
|
|
font-weight: 700;
|
|
color: var(--text-primary);
|
|
margin: 28px 0 12px 0;
|
|
}
|
|
|
|
.markdown-prose code:not(pre code) {
|
|
font-family: 'JetBrains Mono', monospace;
|
|
font-size: 0.88rem;
|
|
background-color: var(--bg-canvas);
|
|
border: 1px solid var(--border-color);
|
|
padding: 2px 6px;
|
|
border-radius: 3px;
|
|
color: var(--accent-cyan);
|
|
}
|
|
|
|
/* ASCII Network Diagram Component */
|
|
.ascii-diagram-container {
|
|
background-color: var(--bg-canvas);
|
|
border: 1px solid var(--border-color);
|
|
border-radius: 4px;
|
|
padding: 16px;
|
|
margin: 22px 0;
|
|
overflow-x: auto;
|
|
font-family: 'JetBrains Mono', monospace;
|
|
font-size: 0.78rem;
|
|
color: var(--accent-cyan);
|
|
line-height: 1.35;
|
|
}
|
|
|
|
/* Code Block Component */
|
|
.code-block-container {
|
|
margin: 22px 0;
|
|
border: 1px solid var(--border-color);
|
|
border-radius: 4px;
|
|
background-color: var(--bg-canvas);
|
|
overflow: hidden;
|
|
}
|
|
|
|
.code-block-header {
|
|
background-color: var(--bg-surface);
|
|
border-bottom: 1px solid var(--border-color);
|
|
padding: 6px 14px;
|
|
display: flex;
|
|
justify-content: space-between;
|
|
align-items: center;
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 0.74rem;
|
|
color: var(--text-muted);
|
|
}
|
|
|
|
.copy-btn {
|
|
background: transparent;
|
|
border: 1px solid var(--border-color);
|
|
color: var(--text-muted);
|
|
padding: 2px 8px;
|
|
font-family: inherit;
|
|
font-size: 0.72rem;
|
|
cursor: pointer;
|
|
border-radius: 2px;
|
|
transition: none;
|
|
}
|
|
|
|
.copy-btn:hover {
|
|
border-color: var(--accent-cyan);
|
|
color: var(--accent-cyan);
|
|
}
|
|
|
|
.code-block-container pre {
|
|
padding: 14px 16px;
|
|
overflow-x: auto;
|
|
font-family: 'JetBrains Mono', monospace;
|
|
font-size: 0.82rem;
|
|
line-height: 1.5;
|
|
color: var(--text-primary);
|
|
}
|
|
|
|
/* Callout Boxes */
|
|
.markdown-callout {
|
|
margin: 20px 0;
|
|
padding: 14px 18px;
|
|
border-radius: 3px;
|
|
border: 1px solid var(--border-color);
|
|
background-color: var(--bg-canvas);
|
|
font-size: 0.94rem;
|
|
line-height: 1.6;
|
|
}
|
|
|
|
.callout-note {
|
|
border-left: 4px solid var(--accent-cyan);
|
|
}
|
|
|
|
.callout-tip {
|
|
border-left: 4px solid var(--accent-green);
|
|
}
|
|
|
|
.callout-title {
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-weight: 700;
|
|
font-size: 0.82rem;
|
|
margin-bottom: 6px;
|
|
display: flex;
|
|
align-items: center;
|
|
gap: 6px;
|
|
}
|
|
|
|
.callout-note .callout-title { color: var(--accent-cyan); }
|
|
.callout-tip .callout-title { color: var(--accent-green); }
|
|
|
|
/* Tables */
|
|
.table-container {
|
|
width: 100%;
|
|
overflow-x: auto;
|
|
margin: 22px 0;
|
|
}
|
|
|
|
.markdown-table {
|
|
width: 100%;
|
|
border-collapse: collapse;
|
|
font-size: 0.84rem;
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
text-align: left;
|
|
}
|
|
|
|
.markdown-table th {
|
|
background-color: var(--bg-canvas);
|
|
border: 1px solid var(--border-color);
|
|
padding: 8px 12px;
|
|
color: var(--text-muted);
|
|
font-weight: 700;
|
|
}
|
|
|
|
.markdown-table td {
|
|
border: 1px solid var(--border-color);
|
|
padding: 8px 12px;
|
|
color: var(--text-primary);
|
|
}
|
|
|
|
/* Global Footer Tile (Gateway 3 Exact Match) */
|
|
.footer-tile {
|
|
background-color: var(--bg-surface);
|
|
border: 1px solid var(--border-color);
|
|
border-radius: 4px;
|
|
padding: 12px 20px;
|
|
display: flex;
|
|
justify-content: space-between;
|
|
align-items: center;
|
|
font-family: 'IBM Plex Mono', monospace;
|
|
font-size: 0.78rem;
|
|
color: var(--text-muted);
|
|
flex-wrap: wrap;
|
|
gap: 10px;
|
|
}
|
|
|
|
.footer-links-cluster {
|
|
display: flex;
|
|
gap: 12px;
|
|
align-items: center;
|
|
}
|
|
|
|
.footer-btn {
|
|
color: var(--text-primary);
|
|
text-decoration: none;
|
|
padding: 2px 4px;
|
|
transition: none;
|
|
}
|
|
|
|
.footer-btn:hover {
|
|
background-color: var(--accent-cyan);
|
|
color: var(--bg-canvas);
|
|
}
|
|
|
|
.pipe {
|
|
color: var(--border-color);
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
|
|
<main class="tiling-layout">
|
|
|
|
<!-- Top Global Header Bar (Gateway 3 Standard) -->
|
|
<header class="global-bar">
|
|
<div class="brand-group">
|
|
<span class="status-indicator"></span>
|
|
<span>RIVER ROOKS // INFRASTRUCTURE ARCHIVE</span>
|
|
</div>
|
|
<nav class="bar-nav" aria-label="Navigation">
|
|
<a href="service-gateway-tiling.html" class="bar-link">Gateway 3 ↗</a>
|
|
<a href="blog-tiling-lead.html" class="bar-link">← Back to Blog Feed</a>
|
|
<a href="https://git.rooks.dev" target="_blank" rel="noopener" class="bar-link">Git Forge</a>
|
|
<a href="feed.xml" class="bar-link">RSS</a>
|
|
<a href="index.html" class="bar-link">Catalog ↗</a>
|
|
</nav>
|
|
</header>
|
|
|
|
<!-- Right Sidebar Workspace Grid -->
|
|
<div class="article-workspace-grid">
|
|
|
|
<!-- Center / Left: Article Content -->
|
|
<article class="article-tile">
|
|
|
|
<!-- Article Header Block -->
|
|
<header class="article-header-block">
|
|
<div class="article-breadcrumbs">
|
|
<span>~/notes/</span>
|
|
<span>></span>
|
|
<span style="color: var(--accent-cyan);">ha-traefik-docker.md</span>
|
|
</div>
|
|
|
|
<h1 class="article-main-title">Building a High-Availability Traefik Router with Docker Compose</h1>
|
|
|
|
<div class="article-meta-row">
|
|
<div><span style="color: var(--accent-cyan);">2026-07-15</span></div>
|
|
<span>•</span>
|
|
<div><span>12 MIN READ</span></div>
|
|
<span>•</span>
|
|
<div><span>AUTHOR: RIVER ROOKS</span></div>
|
|
<span>•</span>
|
|
<div>
|
|
<span class="tag-chip">[#homelab]</span>
|
|
<span class="tag-chip">[#docker-traefik]</span>
|
|
<span class="tag-chip">[#networking]</span>
|
|
</div>
|
|
</div>
|
|
</header>
|
|
|
|
<!-- Markdown Prose Body -->
|
|
<div class="markdown-prose">
|
|
|
|
<h2 id="architecture">1.0 Ingress Architecture & Topologies</h2>
|
|
<p>
|
|
When running multi-tier web applications across self-hosted bare-metal clusters, an edge reverse proxy is indispensable. Managing static Nginx reverse proxy virtual host configs by hand becomes unmaintainable once container fleets scale past twenty services.
|
|
</p>
|
|
<p>
|
|
Traefik v3.1 solves this by inspecting the Docker socket daemon directly. When a new container is deployed, Traefik dynamically binds routing rules, attaches middlewares, and provisions automated wildcard TLS certificates without restarting the daemon.
|
|
</p>
|
|
|
|
<!-- ASCII Architecture Diagram Showcase -->
|
|
<div class="ascii-diagram-container">
|
|
<pre>+-------------------------------------------------------------------------+
|
|
| [INTERNET / WAN INGRESS] ==> Cloudflare DNS (DNS-01 ACME Challenge) |
|
|
+-------------------------------------------------------------------------+
|
|
||
|
|
\/
|
|
+-------------------------------------------------------------------------+
|
|
| gw-node01.lan (OPNsense 24.7 Gateway / NAT Port 443 Forwarding) |
|
|
+-------------------------------------------------------------------------+
|
|
||
|
|
\/ 10GbE VLAN 20 (Server DMZ)
|
|
+-------------------------------------------------------------------------+
|
|
| pve-node02.lan :: Traefik v3.1 Reverse Proxy Container (:443/:80) |
|
|
+-------------------------------------------------------------------------+
|
|
|| || ||
|
|
\/ (Docker Internal) \/ (Docker Internal) \/ (WireGuard)
|
|
+--------------------+ +--------------------+ +--------------------+
|
|
| Forgejo Git Server | | CyberChef Security | | Uptime Kuma Status |
|
|
+--------------------+ +--------------------+ +--------------------+
|
|
</pre>
|
|
</div>
|
|
|
|
<h2 id="dns-challenge">2.0 Automated DNS-01 ACME with Cloudflare</h2>
|
|
<p>
|
|
Standard HTTP-01 challenges require opening port <code>80/tcp</code> publicly to the internet, exposing unauthenticated ingress surfaces. By employing the <strong>DNS-01 challenge</strong>, Traefik proves domain ownership by creating temporary <code>_acme-challenge.rooks.dev</code> TXT records through the Cloudflare API.
|
|
</p>
|
|
|
|
<!-- Callout Showcase -->
|
|
<div class="markdown-callout callout-tip">
|
|
<div class="callout-title">[!TIP] Principle of Least Privilege</div>
|
|
<p>
|
|
Do not use your Global Cloudflare API Key. Instead, generate a scoped API Token with permissions restricted strictly to: <code>Zone.Zone:Read</code> and <code>Zone.DNS:Edit</code> scoped exclusively to your primary apex zone.
|
|
</p>
|
|
</div>
|
|
|
|
<h2 id="compose-spec">3.0 Complete Docker Compose Specification</h2>
|
|
<p>
|
|
Below is the production-tested <code>compose.yaml</code> definition. It mounts the Docker socket in read-only mode (<code>:ro</code>) and stores ACME certificate state inside an encrypted <code>acme.json</code> file with strict <code>0600</code> permissions:
|
|
</p>
|
|
|
|
<!-- Code Block Showcase -->
|
|
<div class="code-block-container">
|
|
<div class="code-block-header">
|
|
<div class="code-title">
|
|
<span>docker-compose.traefik.yml</span>
|
|
<span>YAML</span>
|
|
</div>
|
|
<button class="copy-btn" onclick="copySnippet(this)">Copy Compose</button>
|
|
</div>
|
|
<pre><code>services:
|
|
traefik:
|
|
image: traefik:v3.1.2
|
|
container_name: edge-traefik-proxy
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
networks:
|
|
- proxy-tier
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
environment:
|
|
- CF_DNS_API_TOKEN_FILE=/run/secrets/cf_token
|
|
secrets:
|
|
- cf_token
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- ./data/traefik.yml:/etc/traefik/traefik.yml:ro
|
|
- ./data/acme.json:/acme.json
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.api.rule=Host(`proxy.rooks.dev`)"
|
|
- "traefik.http.routers.api.entrypoints=websecure"
|
|
- "traefik.http.routers.api.tls.certresolver=cloudflare"
|
|
- "traefik.http.routers.api.service=api@internal"
|
|
|
|
secrets:
|
|
cf_token:
|
|
file: ./secrets/cloudflare_api_token.txt
|
|
|
|
networks:
|
|
proxy-tier:
|
|
external: true</code></pre>
|
|
</div>
|
|
|
|
<h2 id="configuration-matrix">4.0 Configuration Parameters Matrix</h2>
|
|
<p>
|
|
Key parameters governing the Traefik core engine:
|
|
</p>
|
|
|
|
<!-- Markdown Table Showcase -->
|
|
<div class="table-container">
|
|
<table class="markdown-table">
|
|
<thead>
|
|
<tr>
|
|
<th>Directive Parameter</th>
|
|
<th>Value</th>
|
|
<th>Scope</th>
|
|
<th>Behavior Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td><code>providers.docker.exposedbydefault</code></td>
|
|
<td><code>false</code></td>
|
|
<td>Core Security</td>
|
|
<td>Prevents untagged backend containers from being routed.</td>
|
|
</tr>
|
|
<tr>
|
|
<td><code>entrypoints.web.http.redirections</code></td>
|
|
<td><code>to: websecure</code></td>
|
|
<td>HTTP → HTTPS</td>
|
|
<td>Enforces automatic HTTP 301 redirects to port 443.</td>
|
|
</tr>
|
|
<tr>
|
|
<td><code>certificatesresolvers.cf.acme.dnschallenge</code></td>
|
|
<td><code>cloudflare</code></td>
|
|
<td>Let's Encrypt</td>
|
|
<td>Uses Cloudflare DNS provider for wildcard propagation.</td>
|
|
</tr>
|
|
<tr>
|
|
<td><code>certificatesresolvers.cf.acme.storage</code></td>
|
|
<td><code>/acme.json</code></td>
|
|
<td>Persistent Storage</td>
|
|
<td>Encrypted JSON database for RSA/ECDSA key pairs.</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<h2 id="verification">5.0 Verification & Failover Testing</h2>
|
|
<p>
|
|
Verify TLS certificate issuance and HTTP/3 ALPN negotiation directly via <code>curl</code>:
|
|
</p>
|
|
|
|
<div class="code-block-container">
|
|
<div class="code-block-header">
|
|
<div class="code-title">
|
|
<span>terminal stdout: curl -Iv</span>
|
|
<span>Bash</span>
|
|
</div>
|
|
<button class="copy-btn" onclick="copySnippet(this)">Copy Output</button>
|
|
</div>
|
|
<pre><code>$ curl -Iv https://proxy.rooks.dev
|
|
* Server certificate:
|
|
* subject: CN=*.rooks.dev
|
|
* start date: Jul 15 00:00:00 2026 GMT
|
|
* expire date: Oct 13 23:59:59 2026 GMT
|
|
* issuer: C=US, O=Let's Encrypt, CN=R3
|
|
* SSL certificate verify ok.
|
|
< HTTP/2 200 OK
|
|
< server: traefik
|
|
< strict-transport-security: max-age=63072000; includeSubDomains; preload</code></pre>
|
|
</div>
|
|
|
|
<p>
|
|
Zero downtime updates are achieved through rolling container health checks configured inside Traefik dynamic labels.
|
|
</p>
|
|
|
|
</div>
|
|
|
|
</article>
|
|
|
|
<!-- Right Sidebar: TOC & Collapsible Related Articles -->
|
|
<aside class="article-sidebar" aria-label="Table of Contents and Series">
|
|
|
|
<!-- Document Outline Tile -->
|
|
<div class="sidebar-tile">
|
|
<div class="sidebar-heading">
|
|
<span>DOCUMENT OUTLINE</span>
|
|
<span style="color: var(--accent-cyan);">INDEX</span>
|
|
</div>
|
|
|
|
<nav class="toc-nav" aria-label="Table of Contents">
|
|
<a href="#architecture" class="toc-link active">> 1.0 Ingress Architecture</a>
|
|
<a href="#dns-challenge" class="toc-link">> 2.0 DNS-01 ACME Setup</a>
|
|
<a href="#compose-spec" class="toc-link">> 3.0 Compose Specification</a>
|
|
<a href="#configuration-matrix" class="toc-link">> 4.0 Configuration Matrix</a>
|
|
<a href="#verification" class="toc-link">> 5.0 Verification & Testing</a>
|
|
</nav>
|
|
</div>
|
|
|
|
<!-- Collapsible Related Dispatches Tile -->
|
|
<div class="sidebar-tile">
|
|
<div class="sidebar-heading">
|
|
<span>RELATED DISPATCHES</span>
|
|
<span>DRAWER</span>
|
|
</div>
|
|
|
|
<details class="collapsible-drawer" open>
|
|
<summary class="collapsible-summary">
|
|
<span>Homelab Series (3)</span>
|
|
</summary>
|
|
<div class="drawer-content">
|
|
|
|
<a href="article-tiling-firmware.html" class="related-card">
|
|
<span class="related-date">2026-07-20 • 8 min</span>
|
|
<span class="related-title">Reverse Engineering IoT Firmware: SPI Flash</span>
|
|
<span style="color: var(--text-muted); font-size: 0.7rem;">[#firmware] [#hardware]</span>
|
|
</a>
|
|
|
|
<a href="article-tiling-heap.html" class="related-card">
|
|
<span class="related-date">2026-06-28 • 15 min</span>
|
|
<span class="related-title">CTF Write-up: Heap Exploitation in glibc 2.35</span>
|
|
<span style="color: var(--text-muted); font-size: 0.7rem;">[#ctf] [#security]</span>
|
|
</a>
|
|
|
|
<a href="blog-tiling-lead.html" class="related-card">
|
|
<span class="related-date">2026-06-14 • 10 min</span>
|
|
<span class="related-title">Zero-Trust Network Isolation with WireGuard</span>
|
|
<span style="color: var(--text-muted); font-size: 0.7rem;">[#networking] [#wireguard]</span>
|
|
</a>
|
|
|
|
</div>
|
|
</details>
|
|
</div>
|
|
|
|
<!-- Runtime Metadata Tile -->
|
|
<div class="sidebar-tile" style="font-family: 'IBM Plex Mono', monospace; font-size: 0.76rem; color: var(--text-muted);">
|
|
<div style="display: flex; justify-content: space-between; margin-bottom: 6px;">
|
|
<span>TRAEFIK ENGINE:</span>
|
|
<span style="color: var(--accent-cyan); font-weight: 700;">v3.1.2 DOCKER</span>
|
|
</div>
|
|
<div style="display: flex; justify-content: space-between; margin-bottom: 6px;">
|
|
<span>CERT PROVIDER:</span>
|
|
<span style="color: var(--accent-green); font-weight: 700;">ACME DNS-01</span>
|
|
</div>
|
|
<div style="display: flex; justify-content: space-between;">
|
|
<span>NODE TARGET:</span>
|
|
<span style="color: var(--text-primary);">pve-node02.lan</span>
|
|
</div>
|
|
</div>
|
|
|
|
</aside>
|
|
|
|
</div>
|
|
|
|
<!-- Global Footer Tile (Gateway 3 Exact Match) -->
|
|
<footer class="footer-tile">
|
|
<div>River Rooks • University of Alabama College of Engineering</div>
|
|
<nav class="footer-links-cluster" aria-label="Global Footer Links">
|
|
<a href="service-gateway-tiling.html" class="footer-btn">Gateway Lander</a>
|
|
<span class="pipe">|</span>
|
|
<a href="feed.xml" class="footer-btn">RSS</a>
|
|
<span class="pipe">|</span>
|
|
<a href="https://git.rooks.dev" target="_blank" rel="noopener" class="footer-btn">Forgejo</a>
|
|
<span class="pipe">|</span>
|
|
<a href="mailto:river@rooks.dev" class="footer-btn">river@rooks.dev</a>
|
|
<span class="pipe">|</span>
|
|
<a href="#" title="Fingerprint: 0x4A8E92F1C0B3D4E7" class="footer-btn">PGP</a>
|
|
<span class="pipe">|</span>
|
|
<a href="index.html" class="footer-btn">Catalog ↗</a>
|
|
</nav>
|
|
</footer>
|
|
|
|
</main>
|
|
|
|
<script>
|
|
function copySnippet(btn) {
|
|
const code = btn.closest('.code-block-container').querySelector('pre').innerText;
|
|
navigator.clipboard.writeText(code).then(() => {
|
|
const orig = btn.innerText;
|
|
btn.innerText = 'Copied!';
|
|
btn.style.color = 'var(--accent-green)';
|
|
btn.style.borderColor = 'var(--accent-green)';
|
|
setTimeout(() => {
|
|
btn.innerText = orig;
|
|
btn.style.color = '';
|
|
btn.style.borderColor = '';
|
|
}, 1800);
|
|
});
|
|
}
|
|
|
|
// ScrollSpy for Right TOC
|
|
window.addEventListener('DOMContentLoaded', () => {
|
|
const links = document.querySelectorAll('.toc-link');
|
|
const sections = [];
|
|
|
|
links.forEach(link => {
|
|
const targetId = link.getAttribute('href').substring(1);
|
|
const section = document.getElementById(targetId);
|
|
if (section) sections.push({ link, section });
|
|
});
|
|
|
|
window.addEventListener('scroll', () => {
|
|
const scrollPos = window.scrollY + 100;
|
|
for (let i = sections.length - 1; i >= 0; i--) {
|
|
if (sections[i].section.offsetTop <= scrollPos) {
|
|
links.forEach(l => l.classList.remove('active'));
|
|
sections[i].link.classList.add('active');
|
|
break;
|
|
}
|
|
}
|
|
});
|
|
});
|
|
</script>
|
|
|
|
</body>
|
|
</html>
|