Traefik v2 as a reverse proxy without docker

Question

I have read the documentation but I can not figure out how to configure Traefik v2 to replace Nginx as a reverse proxy for web sites (virtual hosts) without involving Docker. Ideally there would be let'sencrypt https as well.

I have a service running at http://127.0.0.1:4000 which I would like to reverse proxy to from http://myhost.com:80

This is the configuration i've come up with so far:

[Global]
checkNewVersion = true

[log]
  level = "DEBUG"
  filePath = "log-file.log"

[accessLog]
  filePath =  "log-access.log"
  bufferingSize =  100

[entrypoints]
    [entrypoints.http]
    address = ":80"

[http]
    [http.routers]
       [http.routers.my-router]
          rule = "Host(`www.myhost.com`)"
          service = "http"
          entrypoint=["http"]

    [http.services]
          [http.services.http.loadbalancer]
            [[http.services.http.loadbalancer.servers]]
              url = "http://127.0.0.1:4000"

Answer 1

I figured it out, the first part to note is that in traefik v2 there are two types of configuration, static and dynamic. So I created two files, traefik.toml and traefik-dynamic.toml.

contents of traefik.toml:

[log]
  level = "DEBUG"
  filePath = "log-file.log"

[accessLog]
  filePath =  "log-access.log"
  bufferingSize =  100

[providers]
  [providers.file]
    filename = "traefik-dynamic.toml"

[api]
  dashboard = true
  debug = true

[entryPoints]
  [entryPoints.web]
    address = ":80"
  [entryPoints.web-secure]
    address = ":443"
  [entryPoints.dashboard]
    address = ":8080"

[certificatesResolvers.sample.acme]
  email = "[email protected]"
  storage = "acme.json"

  [certificatesResolvers.sample.acme.httpChallenge]
    # used during the challenge
    entryPoint = "web"

traefik-dynamic.toml:

[http]
    # Redirect to https
    [http.middlewares]
      [http.middlewares.test-redirectscheme.redirectScheme]
        scheme = "https"

    [http.routers]
       [http.routers.my-router]
          rule = "Host(`www.example.com`)"
          service = "phx"
          entryPoints = ["web-secure"]
       [http.routers.my-router.tls]
          certResolver = "sample"

    [http.services]
          [http.services.phx.loadbalancer]
            [[http.services.phx.loadbalancer.servers]]
              url = "http://127.0.0.1:4000"

Answer 2

You can also use Traefik v2 to reverse proxy to a service running on the localhost without using Nginx as explained here using File (and not Docker provider) for Traefik.

First, route calls to myhost.com through localhost by updating /etc/hosts like:

127.0.0.1 myhost.com

Create a minimal docker-compose.yml like:

version: "3.7"
services:

  proxy:
    image: traefik:2.0
    command:
      - "--providers.file.filename=/etc/traefik/proxy-config.toml"
      - "--entrypoints.web.address=:80"
    ports:
      - "80:80"
    volumes:
      - ./proxy-config.toml:/etc/traefik/proxy-config.toml:ro

This Compose file creates a read-only volume containing the dynamic configuration for the Traefik reverse proxy standing in for Nginx as requested. It uses the File provider for Traefik and not Docker and a blank HTTP address mapped to port 80 for the entrypoint. This is a complete Compose file in itself. Beyond that all that's needed is the reverse proxy configuration for Traefik.

Configure the Traefik reverse proxy proxy-config.toml in the same directory:

[http.routers.test-streamrouter]
  rule = "Host(`myhost.com`)"
  service = "test-loadbalancer"
  entryPoints = ["web"]

[[http.services.test-loadbalancer.loadBalancer.servers]]
  url = "http://host.docker.internal:4000"

This is a sample reverse proxy in its entirety. It can be enhanced with middlewares to perform URL rewriting, update domain names or even redirect users if that's your aim. A single load balancer is used as shown in this answer. And host.docker.internal is used to return the host's internal networking address.

Note: At time of writing "host.docker.internal" only works with Docker for Mac and will fail on Linux. However, you may be able to use the Compose service name instead (i.e. "proxy").

Once you get this working you can set up the Let's Encrypt stuff or swap between development and production configurations using the TRAEFIK_PROVIDERS_FILE_FILENAME environment variable.