{"id":15982,"date":"2018-09-06T11:10:20","date_gmt":"2018-09-06T09:10:20","guid":{"rendered":"https:\/\/owncloud.com\/?p=15982"},"modified":"2021-02-16T18:06:49","modified_gmt":"2021-02-16T18:06:49","slug":"docker-owncloud-traefik-reverse-proxy-lets-encrypt-ssl","status":"publish","type":"post","link":"https:\/\/owncloud.com\/de\/blogs\/docker-owncloud-traefik-reverse-proxy-lets-encrypt-ssl\/","title":{"rendered":"Docker Series Pt.2: Set up ownCloud + Traefik as a Reverse Proxy with Let’s Encrypt SSL"},"content":{"rendered":"

In the first blog post<\/a> of this series you learned how to set up ownCloud with docker-compose. This tutorial builds on this knowledge to build an advanced docker setup. Docker can do far more than just setting up containers, it also makes communication between containers easier.<\/p>\n

A reverse proxy is useful in many ways. You can integrate multiple services easily in your setup, while they are reachable with only one public IP. It can also provide and automate Let’s Encrypt SSL certificates – for all your services.<\/p>\n

Using Traefik has many advantages: it is easy to set up, it has a useful web interface, and it’s specifically designed to work with docker containers.<\/p>\n

This guide explains how to set up Docker with Traefik and integrate an ownCloud into it. Integrating other docker images like WordPress<\/a>, Jitsi<\/a>, Mailman<\/a>, or Collabora<\/a> works in a similar way… try it out and play around!<\/p>\n

The First Steps<\/h2>\n

This guide assumes that you already have docker-compose installed on your machine. If you haven’t, just follow these official instructions<\/a> for your operating system.<\/p>\n

First you have to create a network<\/strong> for all services which should be reachable from the Internet. We then need to define it outside of a docker-compose file, as we want to use it for multiple docker-compose files:<\/p>\n

docker network create web<\/span>\n<\/code><\/pre>\n
This way, your database containers are protected. Not even Traefik can see them, they will all get their own internal network later, one for each service.<\/p>\n
Then we will set up our working directory. You can also use another place on the system, but then you will have to change all the paths in this guide.<\/p>\n
mkdir -p \/opt\/traefik\ntouch \/opt\/traefik\/docker-compose.yml\ntouch \/opt\/traefik\/acme.json && chmod 600 \/opt\/traefik\/acme.json\ntouch \/opt\/traefik\/traefik.toml\n<\/code><\/pre>\n
Let’s also assume that you have bought a domain which is pointing to the IP address of your server. Each of your services will need a subdomain, but they can all point to the same IP. Here’s an example:<\/p>\n
\"ownCloud<\/a>
Example IPv4 DNS settings for your server<\/p><\/div>\n
In this guide, the domain and subdomains are example.com<\/strong>, traefik.example.com<\/strong>, and owncloud.example.com<\/strong> – you will need to exchange it with your domain name when you are copy-pasting the docker-compose and config files.<\/p>\n
Define the Traefik Container<\/h2>\n
Now we will set up Traefik. First create and edit<\/strong> the traefik docker-compose file with vim \/opt\/traefik\/docker-compose.yml<\/code>:<\/p>\n
version<\/span>: '2'\n\nservices:<\/span>\n  proxy:<\/span>\n    # You might want to use a proper version<\/span>\n    image:<\/span> traefik\n    command: --configFile=\/traefik.toml\n    restart:<\/span> unless<\/span>-stopped\n    # Here's the network we created:<\/span>\n    networks:<\/span>\n      - web\n    # The traefik entryPoints<\/span>\n    ports:<\/span>\n      - 80:80<\/span>\n      - 443:443<\/span><\/span>\n    labels:<\/span>\n      - traefik.enable=true<\/span>\n      -<\/span> traefik.frontend.rule=Host:traefik.example.com<\/strong><\/span>\n      # Traefik will proxy to its own GUI.<\/span>\n      -<\/span> traefik.port=8080<\/span>\n      - traefik.docker.network=web\n    volumes:<\/span> \n      - \/var\/run<\/span>\/docker.sock:\/var<\/span>\/run\/docker<\/span>.sock \n      - \/opt\/traefik<\/span>\/traefik.toml:\/traefik<\/span>.toml \n      - \/opt\/traefik<\/span>\/acme.json:\/acme<\/span>.json \n\nnetworks:<\/span> \n  web:<\/span> \n    external:<\/span> true<\/span><\/span> <\/code><\/pre>\n
You should of course replace example.com<\/strong> in the docker-compose file with your own domain name.<\/p>\n
The Traefik Config File<\/h2>\n
Traefik has a toml config file to manage entry points, Let’s Encrypt settings, and the web interface. Create the traefik config file<\/strong> with vim \/opt\/traefik\/traefik.toml<\/code>:<\/p>\n
# uncomment this line to get debug info with \"docker logs\":\n#debug<\/span> = true\n\ndefaultEntryPoints<\/span> = [\"https\"<\/span>,\"http\"<\/span>]\n\n# The syntax is somewhat esoteric so this is mostly copy-paste<\/span>\n[entryPoints]\n  [entryPoints.http]\n  address<\/span> = \":80\"<\/span>\n    [entryPoints.http.redirect]\n    entryPoint<\/span> = \"https\"<\/span>\n  [entryPoints.https]\n  address<\/span> = \":443\"<\/span>\n  [entryPoints.https.tls]\n\n[docker]\nendpoint<\/span> = \"unix:\/\/\/var\/run\/docker.sock\"<\/span>\ndomain<\/span> = \"example.com<\/strong>\"<\/span>\nwatch<\/span> = true<\/span>\nexposedbydefault<\/span> = false<\/span>\n\n[acme]\nemail<\/span> = \"youremail@example.com<\/strong>\"<\/span>\nstorage<\/span> = \"\/acme.json\"\n# problems with let's encrypt? You can use this staging environment, \n# if you have to do a lot of trial and error:\n#caServer = \"https:\/\/acme-staging-v02.api.letsencrypt.org\/directory\"<\/span>\nentryPoint<\/span> = \"https\"<\/span>\nOnHostRule<\/span> = true<\/span>\n[acme.httpChallenge]\nentryPoint<\/span> = \"http\"<\/span>\n\n# enable web configuration backend.<\/span>\n[web]\n\n# Web administration port, proxied in docker-compose.yml<\/span>\naddress<\/span> = \":8080\"<\/span>\n<\/code><\/pre>\n
You need to add your<\/strong> domain and email address<\/strong> at [docker] and [acme], so that the config file works for you. The values you have to change are in bold<\/strong>.<\/p>\n
This traefik.toml automatically fetches a Let’s Encrypt SSL certificate, and also redirects all unencrypted HTTP traffic to port 443. This way, no one accidentally accesses your ownCloud without encryption.<\/p>\n
Now we are good to go! Run the container with docker-compose -f \/opt\/traefik\/docker-compose.yml up -d<\/code>. And that’s it!<\/p>\n
If Let’s Encrypt doesn’t work out of the box, you may have to do some troubleshooting. Note that Let’s Encrypt blocks certificate requests if you try too often; that’s why you can use the alternative caServer option in traefik.toml.<\/p>\n
If you uncomment it, Traefik asks the Let’s Encrypt staging server for an (untrusted) certificate. When you get that to work, you can then comment out the caServer option again, so it uses the default server for fetching trusted certificates. Good luck troubleshooting!<\/p>\n
If it works, you can visit traefik.example.com<\/strong> to look at the web interface. It should look like this:<\/p>\n
\"ownCloud<\/a>
The Traefik web interface with no other containers running yet.<\/p><\/div>\n
Add Basic Authentication for Traefik<\/h3>\n
If you want to expose the Traefik web interface, you would probably like to have some form of authentication. Basic auth is supported so let’s add that. Run this for the username you want – for example admin – and enter your password. It will compute a hash of the password, which you can use in the docker-compose file:<\/p>\n
htpasswd -n username<\/span>\n<\/code><\/pre>\n
Here’s what I got for admin\/admin:<\/p>\n
admin:$apr1<\/span>$IBj9Hfsd<\/span>$kf7vXLpY4<\/span>\/9XD365jcp\/<\/span>n1\n<\/code><\/pre>\n
(Don’t use admin\/admin as a password combination.<\/strong> Every hacker tries that first.)<\/p>\n
Now that needs to go in the docker-compose.yml. Add this to the labels-section<\/strong>: (Note:<\/strong> any $ signs have to be escaped with another $.)<\/p>\n
\u00a0   labels:\n      - \"traefik.frontend.auth.basic=admin:$$apr1<\/span>$$IBj9Hfsd<\/span>$$kf7vXLpY4<\/span>\/9XD365jcp\/n1\"<\/span><\/code><\/pre>\n
Rebuild your container<\/strong> with docker-compose -f \/opt\/traefik\/docker-compose.yml up -d<\/code> and now you should have basic auth! Just visit traefik.example.com<\/strong> again – and you will be prompted for a password.<\/p>\n
Now you have a running Traefik container, with a secured web interface, where you can watch the containers that Traefik is handling.<\/p>\n
Add the ownCloud Containers<\/h2>\n
Now let’s add an ownCloud to this setup. We’ve already covered the ownCloud docker-compose file in the last blogpost, biut now you will learn how to integrate it here.<\/p>\n
First, create a folder<\/strong> for ownCloud and edit the docker-compose.yml<\/strong> with<\/p>\n
mkdir<\/span> \/opt\/ownCloud\nvim<\/span> \/opt\/ownCloud\/docker-compose.yml\n<\/code><\/pre>\n
You can use this as an example, but you should use your own domain instead of example.com <\/strong>and change any insecure default passwords. Everything you have to change is in bold<\/strong> here:<\/p>\n
version<\/span>: '2.1'\n\nvolumes:\n  files:\n    driver: local\n  mysql:\n    driver: local\n  backup:\n    driver: local\n  redis:\n    driver: local\n\nservices:\n  owncloud:\n    image: owncloud\/server:10.0\n    restart: unless-stopped\n    depends_on:\n      - db\n<\/span>      - redis\n<\/span>    environment:\n      - OWNCLOUD_DOMAIN=owncloud.example.com\n<\/strong><\/span>      - OWNCLOUD_DB_TYPE=mysql\n<\/span>      - OWNCLOUD_DB_NAME=owncloud\n<\/span>      - OWNCLOUD_DB_USERNAME=owncloud\n<\/span>      - OWNCLOUD_DB_PASSWORD=owncloud\n<\/strong><\/span>      - OWNCLOUD_DB_HOST=db\n<\/span>      - OWNCLOUD_ADMIN_USERNAME=admin\n<\/strong><\/span>      - OWNCLOUD_ADMIN_PASSWORD=admin\n<\/strong><\/span>      - OWNCLOUD_UTF8MB4_ENABLED=true<\/span>\n<\/span>      - OWNCLOUD_REDIS_ENABLED=true<\/span>\n<\/span>      - OWNCLOUD_REDIS_HOST=redis\n<\/span>    networks:\n      - web\n<\/span>      - internal\n<\/span>    labels:\n      - traefik.enable=true<\/span>\n<\/span>      - traefik.frontend.rule=Host:owncloud.example.com<\/strong><\/span>\n<\/span>      - traefik.port=80<\/span>\n<\/span>      - traefik.docker.network=web<\/span>\n<\/span>    healthcheck:\n      test: [\"CMD\", \"\/usr\/bin\/healthcheck\"]\n      interval: 30s\n      timeout: 10s\n      retries: 5\n    volumes:\n      - files:<\/span>\/mnt\/data\n<\/span>\n  db:\n    image: webhippie\/mariadb:latest\n    restart: unless-stopped\n    environment:\n      - MARIADB_ROOT_PASSWORD=owncloud\n<\/strong><\/span>      - MARIADB_USERNAME=owncloud\n<\/span>      - MARIADB_PASSWORD=owncloud\n<\/strong><\/span>      - MARIADB_DATABASE=owncloud\n<\/span>      - MARIADB_MAX_ALLOWED_PACKET=128<\/span>M\n<\/span>      - MARIADB_INNODB_LOG_FILE_SIZE=64<\/span>M\n<\/span>      - MARIADB_INNODB_LARGE_PREFIX=ON\n<\/span>      - MARIADB_INNODB_FILE_FORMAT=Barracuda\n<\/span>    healthcheck:\n      test: [\"CMD\", \"\/usr\/bin\/healthcheck\"]\n      interval: 30s\n      timeout: 10s\n      retries: 5\n    volumes:\n      - mysql:<\/span>\/var\/lib\/mysql\n<\/span>      - backup:<\/span>\/var\/lib\/backup\n<\/span>    networks:\n      - internal\n<\/span>\n  redis:\n    image: webhippie\/redis:latest\n    restart: unless-stopped\n    environment:\n      - REDIS_DATABASES=1<\/span>\n<\/span>    healthcheck:\n      test: [\"CMD\", \"\/usr\/bin\/healthcheck\"]\n      interval: 30s\n      timeout: 10s\n      retries: 5\n    volumes:\n      - redis:<\/span>\/var\/lib\/redis\n<\/span>    networks:\n      - internal\n<\/span>\nnetworks:\n  web:\n    external: true\n  internal:<\/span>\n<\/code><\/pre>\n
If you read carefully, you will notice that we only expose port 80 for the ownCloud container. How does this fit with using SSL certificates?<\/p>\n
Well, the ownCloud container does not communicate with the outside at all – only with the Traefik container. Traefik does not need to encrypt the traffic to the ownCloud container and vice versa, they are on the same machine anyway. As Traefik handles the SSL encryption, ownCloud does not even need to know that users are accessing it encrypted.<\/p>\n
You can run the container<\/strong> with docker-compose -f \/opt\/ownCloud\/docker-compose.yml up -d<\/code> and then ownCloud starts! As soon as the health test at docker ps<\/code> shows the ownCloud container as being healthy, Traefik will start routing to it. You can check if your ownCloud works at owncloud.example.com<\/strong>.<\/p>\n
Congratulations! You just set up ownCloud with Traefik. What’s next?<\/p>\n
Play Around with Docker!<\/h2>\n
You can also add other services like, as we already mentioned, WordPress<\/a>, Jitsi<\/a>, Mailman<\/a>, and Collabora<\/a>, but there are also hundreds of others to choose from. All of them are only a container away.<\/p>\n
When you have integrated some services and have a cool docker-compose file for your setup, why not share it, so that everyone can learn from it? This way, others have an easier time setting it up – or can point out where you can improve your setup.<\/p>\n
\n  
\n    \n                <\/i>\n            Share your setup on Central!    <\/a>\n  <\/div>\n\n  <\/p>\n
Did you encounter problems with this guide? You can always ask in the comments for advice. And if you made it through this how-to easily, share your success on social media!<\/p>\n
A big warm thank you to Jon Neverland for his blogpost Traefik with Docker and Let’s encrypt<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Docker is an easy and powerful way to set up ownCloud, making it easy to extend the architecture. The reverse proxy Traefik, for example, integrates other services and can provide Let’s Encrypt SSL certificates.<\/p>\n","protected":false},"author":7,"featured_media":16082,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"categories":[48],"tags":[229,225,388,352,349,487],"class_list":["post-15982","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-collabora","tag-community","tag-docker","tag-opensource","tag-server","tag-traefik"],"acf":[],"_links":{"self":[{"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/posts\/15982","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/comments?post=15982"}],"version-history":[{"count":1,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/posts\/15982\/revisions"}],"predecessor-version":[{"id":59156,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/posts\/15982\/revisions\/59156"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/media\/16082"}],"wp:attachment":[{"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/media?parent=15982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/categories?post=15982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/tags?post=15982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}