# Traefik - [Traefik](http://traefik.io/) (pronounced traffic) is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy. - [Traefik](http://traefik.io/) integrates with your existing infrastructure components ([Docker](https://www.docker.com/), [Swarm](https://docs.docker.com/engine/swarm/), [Kubernetes](https://kubernetes.io/), [Marathon](https://mesosphere.github.io/marathon/), [Consul](https://www.consul.io/), [Etcd](https://etcd.io/), [Rancher](https://rancher.com/), [File](https://doc.traefik.io/traefik/reference/static-configuration/file/)) and configures itself automatically and dynamically. - Pointing Traefik at your orchestrator should be the only configuration step you need. But we will **start with the old ways similar to Nginx file-based configuration** (No Docker or Orchestrator) in this tutorial. # Why Traefik? - [Traefik](http://traefik.io/) built-in [Let’s Encrypt](https://letsencrypt.org/) and supports the automatic renewal of SSL certificates. - Traefik automatically enables [HTTP/2](https://http2.github.io/) - [Prometheus](https://prometheus.io/)/[Grafana](https://grafana.com/) can be supported through simple Traefik configuration. - Its has many [more features](https://traefik.io/pricing/) in its open-source version itself, which are currently not offered by any other open source web servers. # 1. Install [PHP 7.4](https://www.php.net/releases/index.php) ```bash php -v # Results: Command 'php' not found, but can be installed sudo apt -y install software-properties-common # Ubuntu 20.04 comes with PHP 7.4 repository added. For all below versions add the below repository: sudo add-apt-repository ppa:ondrej/php sudo apt update sudo apt -y install php7.4 php -v # Results: PHP 7.4.16 (cli) (built: Mar 5 2021 07:54:20) ( NTS ) # Install additional packages: sudo apt install php7.4-{gd,curl,intl,bcmath,ctype,dom,iconv,mbstring,simplexml,soap,xsl,zip,mysql} # Install FPM: sudo apt install php7.4-fpm # Check FPM status: systemctl status php7.4-fpm # Results: Active: active (running) ``` ## 1.1 Install [Composer](https://getcomposer.org/) ```bash # Install Composer (PHP Package Manager). Download latest version: https://getcomposer.org/download/ php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" php -r "if (hash_file('sha384', 'composer-setup.php') === '756890a4488ce9024fc62c56153228907f1545c228516cbf63f885e036d37e9a59d27d63f46af1d4d07ee0f76181c7d3') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;" php composer-setup.php php -r "unlink('composer-setup.php');" php composer.phar --version # Results: Composer version 2.0.11 2021-02-24 14:57:23 # Globally make composer available sudo mv composer.phar /usr/local/bin/composer composer --version # Results: Composer version 2.0.11 2021-02-24 14:57:23 ``` # 2. Install [MySQL 8](https://dev.mysql.com/downloads/mysql/8.0.html) and Configure App ```bash mysql --version # Results: Command 'mysql' not found, but can be installed # Find the latest mysql-apt-config_0.8.xx-1_all.deb file from https://repo.mysql.com/ wget https://repo.mysql.com/mysql-apt-config_0.8.16-1_all.deb sudo dpkg -i mysql-apt-config* # Choose 'MySQL Server & Cluster (Currently selected: mysql-5.7)' and select version 'mysql-8.0' press 'OK' sudo apt update sudo apt install mysql-server # clean config deb file as its not needed anymore rm mysql-apt-config* mysql --version # Results: Command 'mysql' not found, but can be installed ``` # 3. Install [Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html) ```bash curl -fsSL https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list sudo apt update sudo apt install elasticsearch # Start and Enable on startup sudo systemctl start elasticsearch sudo systemctl enable elasticsearch # Test using curl: curl -X GET 'http://localhost:9200' ``` # 5. Install [Redis](https://redis.io/topics/quickstart) ```bash sudo apt update sudo apt install redis-server # Start and check status sudo systemctl restart redis sudo systemctl status redis # Test using cli: redis-cli ping # Results: PONG ``` # 6. Install [RabbitMQ](https://www.rabbitmq.com/install-debian.html) ```bash echo 'deb http://www.rabbitmq.com/debian/ testing main' | sudo tee /etc/apt/sources.list.d/rabbitmq.list wget -O- https://www.rabbitmq.com/rabbitmq-release-signing-key.asc | sudo apt-key add - sudo apt update sudo apt install rabbitmq-server sudo systemctl enable rabbitmq-server sudo systemctl start rabbitmq-server sudo rabbitmq-plugins enable rabbitmq_management ``` # 7. Install [Magento 2.4](https://devdocs.magento.com/guides/v2.4/install-gde/composer.html) ```bash composer create-project --repository-url=https://repo.magento.com/ magento/project-community-edition # Update permissions cd /var/www/html/ sudo find var generated vendor pub/static pub/media app/etc -type f -exec chmod g+w {} + sudo find var generated vendor pub/static pub/media app/etc -type d -exec chmod g+ws {} + sudo chown -R :www-data . sudo chmod u+x bin/magento # Install Magento 2.4 bin/magento setup:install \ --base-url=http://example.com:81/ \ --db-host=localhost \ --db-name=magento \ --db-user=magento \ --db-password=magento \ --admin-firstname=admin \ --admin-lastname=admin \ --admin-email=admin@admin.com \ --admin-user=admin \ --admin-password=admin123 \ --language=en_US \ --currency=USD \ --timezone=America/Chicago \ --use-rewrites=1 ``` # 8. Install [Nginx](http://nginx.com/) Why need Nginx? - [Traefik Does Not Support FastCGI protocol](https://github.com/traefik/traefik/issues/753) - Magento 2 is default configured with Nginx conf ```bash sudo apt update sudo apt install nginx # Testing using: systemctl status nginx ``` ## 8.1 Configure Nginx ```bash # Delete the default conf file sudo rm /etc/nginx/sites-enabled/default sudo rm /etc/nginx/sites-available/default # Make new conf for Magento 2.4 with a different port than 80. use example.com.conf sudo service nginx restart # Add 'example.com' to hosts sudo nano /etc/hosts # 27.0.0.1 localhost example.com # Test by opening in browser: http://example.com:81 ``` ```conf # /etc/nginx/sites-enabled/example.com.conf server { listen 81; listen [::]:81; proxy_busy_buffers_size 512k; proxy_buffers 4 512k; proxy_buffer_size 256k; fastcgi_buffers 16 16k; fastcgi_buffer_size 32k; server_name example.com; # your magento2 root directory set $MAGE_ROOT /home/ubuntu/dev/2.4; set $MAGE_DEBUG_SHOW_ARGS 1; # your magento2 root directory conf include /home/ubuntu/dev/2.4/nginx.conf.sample; } ``` ## 8.2 Testing Nginx: Open in the browser: ![Magento-Setup-Screen.png](https://res.cloudinary.com/adapttive/image/upload/v1616966233/Magento_Setup_Screen_d83b0a7c92.png) # 9. Install [Traefik](http://traefik.io/) ```bash # go to https://github.com/containous/traefik/releases and download the latest binary. # downloading using v2.4.5 wget https://github.com/traefik/traefik/releases/download/v2.4.5/traefik_v2.4.5_linux_amd64.tar.gz # extract the binary tar -zxvf traefik_${traefik_version}_linux_${arch}.tar.gz tar -zxvf traefik_v2.4.5_linux_amd64.tar.gz # check help ./traefik --help # make executable and move to /usr/local/bin sudo chmod +x traefik sudo cp /home/$USER/traefik /usr/local/bin sudo chown root:root /usr/local/bin/traefik sudo chmod 755 /usr/local/bin/traefik # give the traefik binary the ability to bind to privileged ports (80, 443) as non-root sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/traefik # setup traefik user and group and permissions sudo groupadd -g 321 traefik sudo useradd -g traefik --no-user-group --home-dir /var/www --no-create-home --shell /usr/sbin/nologin --system --uid 321 traefik sudo usermod -aG traefik sudo mkdir /etc/traefik sudo mkdir /etc/traefik/acme sudo mkdir /etc/traefik/dynamic sudo chown -R root:root /etc/traefik sudo chown -R traefik:traefik /etc/traefik/dynamic /etc/traefik/acme sudo mkdir /var/log/traefik sudo touch /var/log/traefik/debug.log sudo touch /var/log/traefik/access.log sudo chown traefik:traefik /var/log/traefik/ /var/log/traefik/access.log /var/log/traefik/debug.log ``` # 10. Configuring Traefik - Traefik support multiple configurations [providers](https://doc.traefik.io/traefik/providers/overview/). - The simplest ways is to start with [file configuration provider](https://doc.traefik.io/traefik/providers/file/) as we do in [Nginx](https://www.nginx.com/) - File configurations can be done in 2 formats: `toml` and `yaml` - Create the file `/etc/traefik/traefik.toml` (main conf file similar to `/etc/nginx/nginx.conf` in nginx) with the following content ```toml # /etc/traefik/traefik.toml [log] level = "DEBUG" filePath = "/var/log/traefik/debug.log" [accessLog] filePath = "/var/log/traefik/access.log" bufferingSize = 100 [providers] [providers.file] filename = "/etc/traefik/dynamic/traefik.toml" [api] dashboard = true debug = true [entryPoints] [entryPoints.web] address = ":80" [entryPoints.web-secure] address = ":443" [entryPoints.dashboard] address = ":8080" [certificatesResolvers.magento.acme] email = "mymail@example.com" storage = "/etc/traefik/acme/acme.json" [certificatesResolvers.magento.acme.httpChallenge] # used during the challenge entryPoint = "web" ``` - Create the file `/etc/traefik/dynamic/traefik.toml` (website conf file similar to `/etc/nginx/sites-enabled/example.conf` in nginx) with the following content ```toml # /etc/traefik/dynamic/traefik.toml [http] # Redirect to https [http.middlewares] [http.middlewares.test-redirectscheme.redirectScheme] scheme = "https" [http.middlewares.auth.basicAuth] # generate password hash form cli or online generators like https://www.web2generators.com/apache-tools/htpasswd-generator users = [ "admin:$apr1$npasswordhash" ] [http.routers] # magento 2 web server router [http.routers.magento] rule = "Host(`www.example.com`)" service = "magento" entryPoints = ["web-secure"] [http.routers.magento.tls] certResolver = "magento" # traefik dashboard [http.routers.dashboard] rule = "Host(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))" entryPoints = ["web-secure"] service = "api@internal" middlewares = ["auth"] [http.routers.dashboard.tls] certResolver = "magento" # similar to proxy_pass in nginx, traefik maps services [http.services] [http.services.magento.loadbalancer] [[http.services.magento.loadbalancer.servers]] url = "http://example.com:81" ``` # 11. Setup Service - create the file `/etc/systemd/system/traefik.service` with the following content ```ini [Unit] Description=traefik proxy After=network-online.target Wants=network-online.target systemd-networkd-wait-online.service [Service] Restart=on-abnormal ; User and group the process will run as. User=traefik Group=traefik ; Always set "-root" to something safe in case it gets forgotten in the traefik file. ExecStart=/usr/local/bin/traefik --configfile=/etc/traefik/traefik.toml ; Limit the number of file descriptors; see `man systemd.exec` for more limit settings. LimitNOFILE=1048576 ; Use private /tmp and /var/tmp, which are discarded after traefik stops. PrivateTmp=true ; Use a minimal /dev (May bring additional security if switched to 'true', but it may not work on Raspberry Pi's or other devices, so it has been disabled in this dist.) PrivateDevices=false ; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys. ProtectHome=true ; Make /usr, /boot, /etc and possibly some more folders read-only. ProtectSystem=full ; … except /etc/ssl/traefik, because we want Letsencrypt-certificates there. ; This merely retains r/w access rights, it does not add any new. Must still be writable on the host! ReadWriteDirectories=/etc/traefik/acme ; The following additional security directives only work with systemd v229 or later. ; They further restrict privileges that can be gained by traefik. Uncomment if you like. ; Note that you may have to add capabilities required by any plugins in use. CapabilityBoundingSet=CAP_NET_BIND_SERVICE AmbientCapabilities=CAP_NET_BIND_SERVICE NoNewPrivileges=true [Install] WantedBy=multi-user.target ``` - then run the following commands ```bash sudo chown root:root /etc/systemd/system/traefik.service sudo chmod 644 /etc/systemd/system/traefik.service sudo systemctl daemon-reload sudo systemctl start traefik.service ``` - to enable autoboot use this command ```bash sudo systemctl enable traefik.service # to restart sudo systemctl restart traefik.service ``` - use this command to investigate and check logs ```bash journalctl --boot -u traefik.service ``` # 12. Debugging - Check the to access web and for Traefik dashboard - Check logs for any errors with `journalctl --boot -u traefik.service`. or log files at `/var/log/traefik/` - Check the permissions are correct for all config file with ownership to `traefik:traefik` - Check the `iptables-rules` as Oracle Cloud servers by default don't have entry in `IPTABLES`. Add using below code: ```bash sudo iptables -L sudo iptables-save > ~/iptables-rules sudo iptables -P INPUT ACCEPT sudo iptables -P OUTPUT ACCEPT sudo iptables -P FORWARD ACCEPT sudo iptables -F ``` - Set Magento2.4 deploy mode to `developer` for error reporting on browser: ```bash bin/magento deploy:mode:set developer ``` - **Note: Lets Encrypt auto SSL will not work on the local environment and requires a domain pointing to your server.** As a hack you can point `example.com` to `127.0.0.1` for testing SSL on local. ![Traefik Dashboard](https://res.cloudinary.com/adapttive/image/upload/v1613929740/Traefik_Dashboard_c8632f6ed1.png) # References - - - - - - - - - - - - - - -

MySQL

#mysql

Blog posts by tag

Traefik 101: Deploying Magento 2 with Traefik using File Configuration Provider