ssl - 有没有办法让一些 traefik 服务自己管理他们的 tls 证书？

Question

我会尝试为类似的东西配置 traefik:

1) server.example.com --> traefik --> httpChallengeToLetsEncrypt

2) 客户端 --> traefik (passthrough tls) --> server.example.com( with let's encrypt )

注意:traefik 在 example.com 级别接收请求

怎么了:

1) 工作正常只有在 traefik 无法管理的情况下，让我们自己加密证书 (否则它不会传输任何 pathPrefix 以 ".well-known/acme-challenge":-\开头的请求)

2) 不适用于 tcp 路由器的配置，如下所示:

tcp:
  routers:
    example:
      entryPoints:
        - web-secure
      rule: "HostSNI(`server.example.com`)"
      service: example
      tls:
        passthrough: true

  services:
    example:
      loadBalancer:
        servers:
          - url: "https://192.168.0.1:443/"

您将如何让一个或多个服务管理他们自己加密证书？
是否有可能在 traefik 还管理让我们加密证书的同时做到这一点，或者第 1 点中提到的问题是可重复的？

此致，

江铃

Answer 1

使用 tls.passthrough=true和 tcp路由器而不是 http
下面是一个完整的示例，其中 apache 负责自己的证书。

traefik 从不碰他们

version: "3"

services:
    traefik:
        image: traefik
        command:
            - --api.insecure=true
            - --providers.docker=true
        ports:
            - "80:80"
            - "443:443"
            - "8080:8080"
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        labels:
            - traefik.http.routers.api.rule=Host(`traefik.docker.local`)
            - traefik.http.routers.api.service=api@internal

    whoami:
        image: containous/whoami
        labels:
            - traefik.http.routers.whoami.rule=Host(`whoami.docker.local`)
            - traefik.http.routers.whoami.service=whoami@docker
            - traefik.http.services.whoami.loadbalancer.server.port=80

    apache:
        build: php-apache
        depends_on: [traefik]
        env_file: ./php-apache/env
        volumes:
            - "./php-apache/cert/haproxy/:/etc/ssl/haproxy/"
            - "./php-apache/cert/private/:/etc/ssl/private/"
            - "./php-apache/cert/trusted/:/usr/local/share/ca-certificates/"
            - "./php-apache/conf/:/etc/apache2/conf-enabled/"
            - "./php-apache/log/:/var/log/apache2/"
            - "./php-apache/sites/available/:/etc/apache2/sites-available/"
            - "./php-apache/sites/enabled/:/etc/apache2/sites-enabled/"
            - "./php-apache/www/:/var/www/"
        labels:
            - "traefik.http.routers.apache.entrypoints=http"
            - "traefik.http.routers.apache.priority=1"
            - "traefik.http.routers.apache.rule=HostRegexp(`{catchall:.*}`)"
            - "traefik.http.routers.apache.service=apache@docker"
            - "traefik.http.services.apache.loadbalancer.server.port=80"

            - "traefik.tcp.routers.apache.entrypoints=https"
            - "traefik.tcp.routers.apache.rule=HostSNI(`*`)"
            - "traefik.tcp.routers.apache.service=apache@docker"
            - "traefik.tcp.routers.apache.tls.passthrough=true"
            - "traefik.tcp.services.apache.loadbalancer.server.port=443"