Traefik 101: Magento 2Traefik 101: Magento 2

Learn basic deployment of a Magento 2.4 using file-based configuration (without using any Container service like Docker).

Traefik

  • Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy.
  • Traefik integrates with your existing infrastructure components (Docker, Swarm, Kubernetes, Marathon, Consul, Etcd, Rancher, File) and configures itself automatically and dynamically.
  • Pointing Traefik at your orchestrator should be the only configuration step you need. But we will start with the old ways similar to Nginx file-based configuration (No Docker or Orchestrator) in this tutorial.

Why Traefik?

  • Traefik built-in Let’s Encrypt and supports the automatic renewal of SSL certificates.
  • Traefik automatically enables HTTP/2
  • Prometheus/Grafana can be supported through simple Traefik configuration.
  • Its has many more features in its open-source version itself, which are currently not offered by any other open source web servers.

1. Install PHP 7.4

php -v
# Results: Command 'php' not found, but can be installed

sudo apt -y install software-properties-common

# Ubuntu 20.04 comes with PHP 7.4 repository added. For all below versions add the below repository:
sudo add-apt-repository ppa:ondrej/php
sudo apt update

sudo apt -y install php7.4

php -v
# Results: PHP 7.4.16 (cli) (built: Mar  5 2021 07:54:20) ( NTS )

# Install additional packages:
sudo apt install php7.4-{gd,curl,intl,bcmath,ctype,dom,iconv,mbstring,simplexml,soap,xsl,zip,mysql}

# Install FPM:
sudo apt install php7.4-fpm

# Check FPM status:
systemctl status php7.4-fpm
# Results: Active: active (running)

1.1 Install Composer

# Install Composer (PHP Package Manager). Download latest version: https://getcomposer.org/download/
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"

php -r "if (hash_file('sha384', 'composer-setup.php') === '756890a4488ce9024fc62c56153228907f1545c228516cbf63f885e036d37e9a59d27d63f46af1d4d07ee0f76181c7d3') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"

php composer-setup.php

php -r "unlink('composer-setup.php');"

php composer.phar --version
# Results: Composer version 2.0.11 2021-02-24 14:57:23

# Globally make composer available
sudo mv composer.phar /usr/local/bin/composer

composer --version
# Results: Composer version 2.0.11 2021-02-24 14:57:23

2. Install MySQL 8 and Configure App

mysql --version
# Results: Command 'mysql' not found, but can be installed

# Find the latest mysql-apt-config_0.8.xx-1_all.deb file from https://repo.mysql.com/ 
wget https://repo.mysql.com/mysql-apt-config_0.8.16-1_all.deb 
sudo dpkg -i mysql-apt-config*
# Choose 'MySQL Server & Cluster (Currently selected: mysql-5.7)' and select version 'mysql-8.0' press 'OK'
sudo apt update
sudo apt install mysql-server


# clean config deb file as its not needed anymore
rm mysql-apt-config*

mysql --version
# Results: Command 'mysql' not found, but can be installed

3. Install Elasticsearch

curl -fsSL https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
sudo apt update
sudo apt install elasticsearch

# Start and Enable on startup
sudo systemctl start elasticsearch
sudo systemctl enable elasticsearch

# Test using curl:
curl -X GET 'http://localhost:9200'

5. Install Redis

sudo apt update
sudo apt install redis-server

# Start and check status
sudo systemctl restart redis
sudo systemctl status redis

# Test using cli:
redis-cli
ping
# Results: PONG

6. Install RabbitMQ

echo 'deb http://www.rabbitmq.com/debian/ testing main' | sudo tee /etc/apt/sources.list.d/rabbitmq.list
wget -O- https://www.rabbitmq.com/rabbitmq-release-signing-key.asc | sudo apt-key add -

sudo apt update
sudo apt install rabbitmq-server

sudo systemctl enable rabbitmq-server
sudo systemctl start rabbitmq-server

sudo rabbitmq-plugins enable rabbitmq_management

7. Install Magento 2.4

composer create-project --repository-url=https://repo.magento.com/ magento/project-community-edition

# Update permissions
cd /var/www/html/<magento install directory>
sudo find var generated vendor pub/static pub/media app/etc -type f -exec chmod g+w {} +
sudo find var generated vendor pub/static pub/media app/etc -type d -exec chmod g+ws {} +
sudo chown -R :www-data . 
sudo chmod u+x bin/magento

# Install Magento 2.4

bin/magento setup:install \
--base-url=http://example.com:81/ \
--db-host=localhost \
--db-name=magento \
--db-user=magento \
--db-password=magento \
--admin-firstname=admin \
--admin-lastname=admin \
--admin-email=admin@admin.com \
--admin-user=admin \
--admin-password=admin123 \
--language=en_US \
--currency=USD \
--timezone=America/Chicago \
--use-rewrites=1

8. Install Nginx

Why need Nginx?

sudo apt update
sudo apt install nginx

# Testing using:
systemctl status nginx

8.1 Configure Nginx

# Delete the default conf file
sudo rm /etc/nginx/sites-enabled/default
sudo rm /etc/nginx/sites-available/default

# Make new conf for Magento 2.4 with a different port than 80. use example.com.conf
sudo service nginx restart

# Add 'example.com' to hosts
sudo nano /etc/hosts
# 27.0.0.1       localhost example.com

# Test by opening in browser: http://example.com:81
# /etc/nginx/sites-enabled/example.com.conf
server {
        listen 81;
        listen [::]:81;

        proxy_busy_buffers_size   512k;
        proxy_buffers   4 512k;
        proxy_buffer_size   256k;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;

        server_name example.com;
        # your magento2 root directory
        set $MAGE_ROOT /home/ubuntu/dev/2.4;
        set $MAGE_DEBUG_SHOW_ARGS 1;

        # your magento2 root directory conf
        include /home/ubuntu/dev/2.4/nginx.conf.sample;
}

8.2 Testing Nginx:

Magento-Setup-Screen.png

9. Install Traefik

# go to https://github.com/containous/traefik/releases and download the latest binary.
# downloading using v2.4.5

wget https://github.com/traefik/traefik/releases/download/v2.4.5/traefik_v2.4.5_linux_amd64.tar.gz

# extract the binary tar -zxvf traefik_${traefik_version}_linux_${arch}.tar.gz
tar -zxvf traefik_v2.4.5_linux_amd64.tar.gz

# check help
./traefik --help

# make executable and move to /usr/local/bin
sudo chmod +x traefik
sudo cp /home/$USER/traefik /usr/local/bin
sudo chown root:root /usr/local/bin/traefik
sudo chmod 755 /usr/local/bin/traefik

# give the traefik binary the ability to bind to privileged ports (80, 443) as non-root
sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/traefik

# setup traefik user and group and permissions
sudo groupadd -g 321 traefik
sudo useradd -g traefik --no-user-group --home-dir /var/www --no-create-home --shell /usr/sbin/nologin --system --uid 321 traefik
sudo usermod -aG traefik

sudo mkdir /etc/traefik
sudo mkdir /etc/traefik/acme
sudo mkdir /etc/traefik/dynamic
sudo chown -R root:root /etc/traefik
sudo chown -R traefik:traefik /etc/traefik/dynamic /etc/traefik/acme

sudo mkdir /var/log/traefik
sudo touch /var/log/traefik/debug.log
sudo touch /var/log/traefik/access.log
sudo chown traefik:traefik  /var/log/traefik/ /var/log/traefik/access.log  /var/log/traefik/debug.log

10. Configuring Traefik

  • Traefik support multiple configurations providers.
  • The simplest ways is to start with file configuration provider as we do in Nginx
  • File configurations can be done in 2 formats: toml and yaml
  • Create the file /etc/traefik/traefik.toml (main conf file similar to /etc/nginx/nginx.conf in nginx) with the following content
# /etc/traefik/traefik.toml
[log]
  level = "DEBUG"
  filePath = "/var/log/traefik/debug.log"

[accessLog]
  filePath =  "/var/log/traefik/access.log"
  bufferingSize =  100

[providers]
  [providers.file]
    filename = "/etc/traefik/dynamic/traefik.toml"

[api]
  dashboard = true
  debug = true

[entryPoints]
  [entryPoints.web]
    address = ":80"
  [entryPoints.web-secure]
    address = ":443"
  [entryPoints.dashboard]
    address = ":8080"

[certificatesResolvers.magento.acme]
  email = "mymail@example.com"
  storage = "/etc/traefik/acme/acme.json"

  [certificatesResolvers.magento.acme.httpChallenge]
  # used during the challenge
    entryPoint = "web"
  • Create the file /etc/traefik/dynamic/traefik.toml (website conf file similar to /etc/nginx/sites-enabled/example.conf in nginx) with the following content
# /etc/traefik/dynamic/traefik.toml
[http]
  # Redirect to https
  [http.middlewares]
    [http.middlewares.test-redirectscheme.redirectScheme]
      scheme = "https"
    [http.middlewares.auth.basicAuth]
     # generate password hash form cli or online generators like https://www.web2generators.com/apache-tools/htpasswd-generator
      users = [
          "admin:$apr1$npasswordhash"
        ]

  [http.routers]
    # magento 2 web server router
    [http.routers.magento]
      rule = "Host(`www.example.com`)"
      service = "magento"
      entryPoints = ["web-secure"]
    [http.routers.magento.tls]
      certResolver = "magento"

    # traefik dashboard
    [http.routers.dashboard]
      rule = "Host(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      entryPoints = ["web-secure"]
      service = "api@internal"
      middlewares = ["auth"]
    [http.routers.dashboard.tls]
      certResolver = "magento"

# similar to proxy_pass in nginx, traefik maps services
[http.services]
    [http.services.magento.loadbalancer]
      [[http.services.magento.loadbalancer.servers]]
        url = "http://example.com:81"

11. Setup Service

  • create the file /etc/systemd/system/traefik.service with the following content
[Unit]
Description=traefik proxy
After=network-online.target
Wants=network-online.target systemd-networkd-wait-online.service

[Service]
Restart=on-abnormal
; User and group the process will run as.
User=traefik
Group=traefik
; Always set "-root" to something safe in case it gets forgotten in the traefik file.
ExecStart=/usr/local/bin/traefik --configfile=/etc/traefik/traefik.toml
; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.
LimitNOFILE=1048576
; Use private /tmp and /var/tmp, which are discarded after traefik stops.
PrivateTmp=true
; Use a minimal /dev (May bring additional security if switched to 'true', but it may not work on Raspberry Pi's or other devices, so it has been disabled in this dist.)
PrivateDevices=false
; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
ProtectHome=true
; Make /usr, /boot, /etc and possibly some more folders read-only.
ProtectSystem=full
; … except /etc/ssl/traefik, because we want Letsencrypt-certificates there.
;   This merely retains r/w access rights, it does not add any new. Must still be writable on the host!
ReadWriteDirectories=/etc/traefik/acme
; The following additional security directives only work with systemd v229 or later.
; They further restrict privileges that can be gained by traefik. Uncomment if you like.
; Note that you may have to add capabilities required by any plugins in use.
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target
  • then run the following commands
sudo chown root:root /etc/systemd/system/traefik.service
sudo chmod 644 /etc/systemd/system/traefik.service
sudo systemctl daemon-reload
sudo systemctl start traefik.service
  • to enable autoboot use this command
sudo systemctl enable traefik.service

# to restart
sudo systemctl restart traefik.service
  • use this command to investigate and check logs
journalctl --boot -u traefik.service

12. Debugging

  • Check the https://www.example.com to access web and https://traefik.example.com/dashboard/ for Traefik dashboard
  • Check logs for any errors with journalctl --boot -u traefik.service. or log files at /var/log/traefik/
  • Check the permissions are correct for all config file with ownership to traefik:traefik
  • Check the iptables-rules as Oracle Cloud servers by default don't have entry in IPTABLES. Add using below code:
sudo iptables -L
sudo iptables-save > ~/iptables-rules
sudo iptables -P INPUT ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -F
  • Set Magento2.4 deploy mode to developer for error reporting on browser:
bin/magento deploy:mode:set developer
  • Note: Lets Encrypt auto SSL will not work on the local environment and requires a domain pointing to your server. As a hack you can point example.com to 127.0.0.1 for testing SSL on local.

Traefik Dashboard

References