Deploy Traefik locally with mkcert

Introduction

In this guide, we will walk through the steps to deploy Traefik, a popular open-source reverse proxy and load balancer, locally using mkcert to generate SSL certificates for secure HTTPS connections.

Mkcert:

mkcert is a simple tool that makes it easy to create locally-trusted development certificates. It automatically creates and installs a local CA in the system root store, and generates locally-trusted certificates. This is particularly useful for local development environments where you want to test HTTPS without dealing with self-signed certificates that browsers typically distrust.

Prerequisites

Before we begin, ensure you have the following prerequisites in place:

A local machine with Docker installed.
mkcert installed for generating local SSL certificates.
Basic knowledge of Docker and Traefik.

Logical Diagram

+-------------------+          +------------------+
|                   |          |                  |
|   Client Browser  +--------->|   Traefik        |
|                   |          |   Reverse Proxy  |
+-------------------+          +--------+---------+     
                                        |
                                        |
                                +--------v---------+
                                |                  |
                                |   Backend Apps   |
                                |                  |
                                +------------------+            

Step 1: Generate Local SSL Certificates with mkcert

a. Install mkcert if you haven’t already. Follow the instructions on the mkcert GitHub page. b. Generate a local CA (Certificate Authority):

mkcert -install

c. Create SSL certificates for your local domain (e.g., traefik.local):

mkcert traefik.local

d. This will generate two files: traefik.local.pem (certificate) and traefik.local-key.pem (private key).

Step 2: Deploy Traefik with Docker

a. Create a docker-compose.yml file to define the Traefik service:

# Define the services to be run by Docker Compose
services:
traefik:
    image: traefik:v3.4
    container_name: traefik # Name the container "traefik"
    restart: unless-stopped # Always restart unless explicitly stopped
    security_opt:
    - no-new-privileges:true # Prevent container from gaining new privileges
    ports:
    - "80:80"
    - "443:443"
    networks:
    - web
    volumes:
    - /var/run/docker.sock:/var/run/docker.sock:ro # Docker socket for Traefik to monitor containers
    - /opt/traefik/traefik.yml:/etc/traefik/traefik.yml # Traefik static configuration file
    - /opt/traefik/certs:/etc/traefik/certs # Directory for SSL certificates
    labels:
    - "traefik.enable=true"
    - "traefik.http.routers.traefik-dashboard.rule=Host('local domain name/localhost`)" # Replace with your local domain
    - "traefik.http.routers.traefik-dashboard.entrypoints=websecure" # Use the "websecure" entrypoint (usually port 443)
    - "traefik.http.routers.traefik-dashboard.tls=true" # Enable TLS for the dashboard
    - "traefik.http.routers.traefik-dashboard.tls
    - "traefik.http.routers.traefik-dashboard.service=api@internal"
    - "traefik.http.middlewares.dashboard-auth.basicauth.users=admin:$$2y$$XXXXXXXX"
    - "traefik.http.routers.traefik-dashboard.middlewares=dashboard-auth@docker"


networks:
web:
    external: true

b. Now, create a traefik.yml file in that traefik-data directory. This file will contain the static configuration for Traefik:

sudo touch traefik-data/traefik.yml

c. Add the following configuration to the traefik.yml file:

entryPoints:
web:
    address: ":80"
    http:
    redirections:
        entryPoint:
        to: websecure
        scheme: https
websecure:
    address: ":443"

api:
dashboard: true
insecure: false

providers:
docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false

tls:
certificates:
    - certFile: "/etc/traefik/certs/cert.pem"
    keyFile: "/etc/traefik/certs/key.pem"

log:
level: DEBUG

d. Place the generated SSL certificate and key files into the certs directory:

sudo mkdir -p traefik-data/certs
sudo mv traefik.local.pem traefik-data/certs/cert.pem
sudo mv traefik.local-key.pem traefik-data/certs/key.pem

e. Start the Traefik container using Docker Compose:

docker-compose -f docker-compose.yml up -d

3. Autometic Renewal of mkcert Certificates

mkcert certificates do not have an automatic renewal mechanism like Let’s Encrypt. However, you can set up a cron job to regenerate the certificates periodically. Here’s how you can do it: a. Open the crontab file for editing:

crontab -e

b. Add the following line to regenerate the certificates every 90 days (adjust the path and domain as needed):

0 0 */90 * * /usr/local/bin/mkcert -cert-file /path/to/traefik-data/certs/cert.pem -key-file /path/to/traefik-data/certs/key.pem traefik.local

c. Save and exit the crontab editor. This will ensure that your mkcert certificates are regenerated every 90 days.

Step 3: Access the Traefik Dashboard

a. Open your web browser and navigate to https://traefik.local (or your chosen local domain). b. You should see the Traefik dashboard login prompt. Enter the username and password you configured in the docker-compose.yml file. c. Once logged in, you can monitor and manage your Traefik instance.

Conclusion

You have successfully deployed Traefik locally using mkcert for SSL certificates. You can now take advantage of Traefik’s powerful features for managing your local development environment securely over HTTPS.

Operating Systems

Containerization

Automation Tools

Deploy Traefik locally with mkcert

Introduction

Mkcert:

Prerequisites

Logical Diagram

Step 1: Generate Local SSL Certificates with mkcert

Step 2: Deploy Traefik with Docker

3. Autometic Renewal of mkcert Certificates

Step 3: Access the Traefik Dashboard

Conclusion

​Introduction

​ Mkcert:

​Prerequisites

​Logical Diagram

​Step 1: Generate Local SSL Certificates with mkcert

​Step 2: Deploy Traefik with Docker

​3. Autometic Renewal of mkcert Certificates

​Step 3: Access the Traefik Dashboard

​Conclusion

Introduction

Mkcert:

Prerequisites

Logical Diagram

Step 1: Generate Local SSL Certificates with mkcert

Step 2: Deploy Traefik with Docker

3. Autometic Renewal of mkcert Certificates

Step 3: Access the Traefik Dashboard

Conclusion