如何使用Traefik 1.7.21作为CentOS 7上Docker容器的反向代理

The author selected Girls Who Code to receive a donation as part of the Write for DOnations program.

作者选择了《编码的女孩》作为Write for DOnations计划的一部分来接受捐赠。

介绍 (Introduction)

Docker can be an efficient way to run web applications in production, but you may want to run multiple applications on the same Docker host. In this situation, you’ll need to set up a reverse proxy since you only want to expose ports 80 and 443 to the rest of the world.

Docker是在生产环境中运行Web应用程序的有效方法，但是您可能希望在同一Docker主机上运行多个应用程序。 在这种情况下，您将需要设置反向代理，因为您只想向世界其他地方公开端口80和443 。

Traefik is a Docker-aware reverse proxy that includes its own monitoring dashboard. In this tutorial, you’ll use Traefik to route requests to two different web application containers: a Wordpress container and an Adminer container, each talking to a MySQL database. You’ll configure Traefik to serve everything over HTTPS using Let’s Encrypt.

Traefik是可感知Docker的反向代理，包括其自己的监视仪表板。 在本教程中，您将使用Traefik将请求路由到两个不同的Web应用程序容器： Wordpress容器和Adminer容器，每个容器都与MySQL数据库通信。 您将使用Let's Encrypt配置Traefik以通过HTTPS提供所有服务。

先决条件 (Prerequisites)

To follow along with this tutorial, you will need the following:

要继续学习本教程，您将需要以下内容：

• One CentOS 7 server set up by following Initial Server Setup with CentOS 7, including a sudo non-root user and a firewall.

  通过遵循CentOS 7的初始服务器设置来设置一台CentOS 7服务器，包括sudo非root用户和防火墙。

• Docker installed on your server, which you can do by following How To Install and Use Docker on CentOS 7.

  在您的服务器上安装了Docker，您可以按照如何在CentOS 7上安装和使用Docker进行操作 。

• Docker Compose installed with the instructions from How To Install Docker Compose on CentOS 7.

  Docker Compose已安装，其中包含如何在CentOS 7上安装Docker Compose的说明 。

• A domain and three A records, db-admin, blog, and monitor, that each point to the IP address of your server. You can learn how to point domains to DigitalOcean Droplets by reading through DigitalOcean’s Domains and DNS documentation. Throughout this tutorial, substitute your domain for your_domain in the configuration files and examples.

  一个域和三个A记录db-admin ， blog和monitor ，每个记录都指向服务器的IP地址。 通过阅读DigitalOcean的域和DNS文档，您可以了解如何将域指向DigitalOcean Droplet。 在本教程中，用配置文件和示例中的域替换your_domain 。

第1步-配置和运行Traefik (Step 1 — Configuring and Running Traefik)

The Traefik project has an official Docker image, so we will use that to run Traefik in a Docker container.

Traefik项目有一个正式的Docker映像 ，因此我们将使用它在Docker容器中运行Traefik。

But before we get our Traefik container up and running, we need to create a configuration file and set up an encrypted password so we can access the monitoring dashboard.

但是，在我们启动并运行Traefik容器之前，我们需要创建一个配置文件并设置一个加密密码，以便可以访问监视仪表板。

We’ll use the htpasswd utility to create this encrypted password. First, install the utility, which is included in the httpd-tools package:

我们将使用htpasswd实用程序创建此加密密码。 首先，安装实用程序，该实用程序包含在httpd-tools软件包中：

• sudo yum install -y httpd-tools
  须藤yum install -y httpd-tools

Then generate the password with htpasswd. Substitute secure_password with the password you’d like to use for the Traefik admin user:

然后使用htpasswd生成密码。 用您要用于Traefik管理员用户的密码代替secure_password ：

• htpasswd -nb admin secure_password

  htpasswd -nb admin secure_password

The output from the program will look like this:

该程序的输出将如下所示：

   
   

    
    Output
   
   
admin:$apr1$kEG/8JKj$yEXj8vKO7HDvkUMI/SbOO.

You’ll use this output in the Traefik configuration file to set up HTTP Basic Authentication for the Traefik health check and monitoring dashboard. Copy the entire output line so you can paste it later.

您将在Traefik配置文件中使用此输出来为Traefik运行状况检查和监视仪表板设置HTTP基本身份验证。 复制整个输出行，以便以后粘贴。

To configure the Traefik server, we’ll create a new configuration file called traefik.toml using the TOML format. TOML is a configuration language similar to INI files, but standardized. This file lets us configure the Traefik server and various integrations, or providers, we want to use. In this tutorial, we will use three of Traefik’s available providers: api, docker, and acme, which is used to support TLS using Let’s Encrypt.

要配置Traefik服务器，我们将使用TOML格式创建一个名为traefik.toml的新配置文件。 TOML是一种与INI文件类似的配置语言，但是是标准化的。 该文件使我们可以配置Traefik服务器以及我们要使用的各种集成或提供程序 。 在本教程中，我们将使用三个Traefik的可用提供商： api ， docker ，和acme ，这是用来让使用的加密支持TLS。

Open up your new file in Vi or your favorite text editor:

在Vi或您喜欢的文本编辑器中打开新文件：

• vi traefik.toml
  vi traefik.toml

Enter insert mode by pressing i, then add two named entry points, http and https, that all backends will have access to by default:

按下i进入插入模式，然后添加两个命名的入口点http和https ，默认情况下所有后端均可访问：

traefik.toml

traefik.toml

defaultEntryPoints = ["http", "https"]

We’ll configure the http and https entry points later in this file.

我们稍后将在此文件中配置http和https入口点。

Next, configure the api provider, which gives you access to a dashboard interface. This is where you’ll paste the output from the htpasswd command:

接下来，配置api提供程序，使您可以访问仪表板界面。 您将在此处粘贴htpasswd命令的输出：

traefik.toml

traefik.toml

...
[entryPoints]
  [entryPoints.dashboard]
    address = ":8080"
    [entryPoints.dashboard.auth]
      [entryPoints.dashboard.auth.basic]
        users = ["admin:your_encrypted_password"]

[api]
entrypoint="dashboard"

The dashboard is a separate web application that will run within the Traefik container. We set the dashboard to run on port 8080.

仪表板是一个单独的Web应用程序，将在Traefik容器中运行。 我们将仪表板设置为在端口8080上运行。

The entrypoints.dashboard section configures how we’ll be connecting with the api provider, and the entrypoints.dashboard.auth.basic section configures HTTP Basic Authentication for the dashboard. Use the output from the htpasswd command you just ran for the value of the users entry. You could specify additional logins by separating them with commas.

entrypoints.dashboard部分配置我们与api提供程序的连接方式， entrypoints.dashboard.auth.basic部分配置仪表板的HTTP基本认证。 使用您刚运行的htpasswd命令的输出作为users条目的值。 您可以使用逗号分隔其他登录名。

We’ve defined our first entryPoint, but we’ll need to define others for standard HTTP and HTTPS communication that isn’t directed towards the api provider. The entryPoints section configures the addresses that Traefik and the proxied containers can listen on. Add these lines to the file underneath the entryPoints heading:

我们已经定义了第一个entryPoint ，但是我们需要为不针对api提供程序的标准HTTP和HTTPS通信定义其他对象。 entryPoints部分配置Traefik和代理容器可以侦听的地址。 将这些行添加到entryPoints标题下的文件中：

traefik.toml

traefik.toml

...
  [entryPoints.http]
    address = ":80"
      [entryPoints.http.redirect]
        entryPoint = "https"
  [entryPoints.https]
    address = ":443"
      [entryPoints.https.tls]
...

The http entry point handles port 80, while the https entry point uses port 443 for TLS/SSL. We automatically redirect all of the traffic on port 80 to the https entry point to force secure connections for all requests.

http入口点处理端口80 ，而https入口点将端口443用于TLS / SSL。 我们会自动将端口80上的所有流量重定向到https入口点，以强制所有请求建立安全连接。

Next, add this section to configure Let’s Encrypt certificate support for Traefik:

接下来，添加此部分以为Traefik配置“让我们加密证书”支持：

traefik.toml

traefik.toml

...
[acme]
email = "your_email@your_domain"
storage = "acme.json"
entryPoint = "https"
onHostRule = true
  [acme.httpChallenge]
  entryPoint = "http"

This section is called acme because ACME is the name of the protocol used to communicate with Let’s Encrypt to manage certificates. The Let’s Encrypt service requires registration with a valid email address, so in order to have Traefik generate certificates for our hosts, set the email key to your email address. We then specify that we will store the information that we will receive from Let’s Encrypt in a JSON file called acme.json. The entryPoint key needs to point to the entry point handling port 443, which in our case is the https entry point.

由于ACME是用于与Let's Encrypt通信以管理证书的协议的名称，所以此部分称为acme 。 “让我们加密”服务需要使用有效的电子邮件地址进行注册，因此为了使Traefik为我们的主机生成证书，请将email密钥设置为您的电子邮件地址。 然后，我们指定将将从“加密”中接收的信息存储在一个名为acme.json的JSON文件中。 entryPoint密钥需要指向入口处理端口443 (在我们的情况下为https入口)。

The key onHostRule dictates how Traefik should go about generating certificates. We want to fetch our certificates as soon as our containers with specified hostnames are created, and that’s what the onHostRule setting will do.

关键onHostRule指示Traefik应该如何进行证书生成。 我们希望在创建具有指定主机名的容器后立即获取证书，这就是onHostRule设置的作用。

The acme.httpChallenge section allows us to specify how Let’s Encrypt can verify that the certificate should be generated. We’re configuring it to serve a file as part of the challenge through the http entrypoint.

acme.httpChallenge部分允许我们指定“让我们的加密”如何验证应生成证书。 我们正在将其配置为通过http入口点将文件作为挑战的一部分提供。

Finally, configure the docker provider by adding these lines to the file:

最后，通过docker添加到文件中来配置docker provider：

traefik.toml

traefik.toml

...
[docker]
domain = "your_domain"
watch = true
network = "web"

The docker provider enables Traefik to act as a proxy in front of Docker containers. We’ve configured the provider to watch for new containers on the web network (that we’ll create soon) and expose them as subdomains of your_domain.

该docker提供商能够Traefik作为在Docker容器的前代理。 我们已经配置了提供给watch的新容器web的网络(我们会尽快创造)，揭露他们的子域your_domain 。

At this point, traefik.toml should have the following contents:

此时， traefik.toml应该具有以下内容：

traefik.toml

traefik.toml

defaultEntryPoints = ["http", "https"]

[entryPoints]
  [entryPoints.dashboard]
    address = ":8080"
    [entryPoints.dashboard.auth]
      [entryPoints.dashboard.auth.basic]
        users = ["admin:your_encrypted_password"]
  [entryPoints.http]
    address = ":80"
      [entryPoints.http.redirect]
        entryPoint = "https"
  [entryPoints.https]
    address = ":443"
      [entryPoints.https.tls]

[api]
entrypoint="dashboard"

[acme]
email = "your_email@your_domain"
storage = "acme.json"
entryPoint = "https"
onHostRule = true
  [acme.httpChallenge]
  entryPoint = "http"

[docker]
domain = "your_domain"
watch = true
network = "web"

Once you have added the contents, hit ESC to leave insert mode. Type :x then ENTER to save and exit the file. With all of this configuration in place, we can fire up Traefik.

添加内容后，请按ESC退出插入模式。 键入:x然后按ENTER以保存并退出文件。 有了所有这些配置之后，我们就可以启动Traefik。

第2步-运行Traefik容器 (Step 2 — Running the Traefik Container)

Next, create a Docker network for the proxy to share with containers. The Docker network is necessary so that we can use it with applications that are run using Docker Compose. Let’s call this network web.

接下来，为代理创建一个Docker网络以与容器共享。 Docker网络是必需的，以便我们可以将其与使用Docker Compose运行的应用程序一起使用。 让我们把这种网络web 。

• docker network create web

  码头工人网络创建网站

When the Traefik container starts, we will add it to this network. Then we can add additional containers to this network later for Traefik to proxy to.

Traefik容器启动时，我们会将其添加到此网络。 然后，我们可以稍后在该网络中添加其他容器，以供Traefik代理。

Next, create an empty file which will hold our Let’s Encrypt information. We’ll share this into the container so Traefik can use it:

接下来，创建一个空文件，其中将保存我们的“加密”信息。 我们将其共享到容器中，以便Traefik可以使用它：

• touch acme.json

  触摸acme.json

Traefik will only be able to use this file if the root user inside of the container has unique read and write access to it. To do this, lock down the permissions on acme.json so that only the owner of the file has read and write permission.

仅当容器内部的root用户对该文件具有唯一的读写访问权限时，Traefik才能使用此文件。 为此，请锁定acme.json的权限，以便只有文件所有者才具有读取和写入权限。

• chmod 600 acme.json

  chmod 600 acme.json

Once the file gets passed to Docker, the owner will automatically change to the root user inside the container.

一旦文件传递给Docker，所有者将自动更改为容器内的root用户。

Finally, create the Traefik container with this command:

最后，使用以下命令创建Traefik容器：

• docker run -d \
  泊坞窗运行-d \
• -v /var/run/docker.sock:/var/run/docker.sock \
  -v /var/run/docker.sock:/var/run/docker.sock \
• -v $PWD/traefik.toml:/traefik.toml \
  -v $ PWD / traefik.toml：/traefik.toml \
• -v $PWD/acme.json:/acme.json \
  -v $ PWD / acme.json：/acme.json \
• -p 80:80 \
  -p 80:80 \
• -p 443:443 \
  -p 443：443 \

• -l traefik.frontend.rule=Host:monitor.your_domain \

  -l traefik.frontend.rule =主机：监视器。 your_domain \

• -l traefik.port=8080 \
  -l traefik.port = 8080 \
• --network web \
  -网络网
• --name traefik \
  --name traefik \
• traefik:1.7.21-alpine
  traefik：1.7.21-高山

The command is a little long so let’s break it down.

该命令有点长，所以让我们分解一下。

We use the -d flag to run the container in the background as a daemon. We then share our docker.sock file into the container so that the Traefik process can listen for changes to containers. We also share the traefik.toml configuration file and the acme.json file we created into the container.

我们使用-d标志在后台将容器作为守护程序运行。 然后，我们将docker.sock文件共享到容器中，以便Traefik进程可以侦听对容器的更改。 我们还将共享我们在容器中创建的traefik.toml配置文件和acme.json文件。

Next, we map ports 80 and 443 of our Docker host to the same ports in the Traefik container so Traefik receives all HTTP and HTTPS traffic to the server.

接下来，我们将Docker主机的端口80和443映射到Traefik容器中的相同端口，以便Traefik接收到服务器的所有HTTP和HTTPS通信。

Then we set up two Docker labels that tell Traefik to direct traffic to the hostname monitor.your_domain to port 8080 within the Traefik container, exposing the monitoring dashboard.

然后，我们设置了两个Docker标签，它们告诉Traefik将流量定向到主机名monitor. your_domain monitor. your_domain到Traefik容器内的端口8080 ，公开了监视仪表板。

We set the network of the container to web, and we name the container traefik.

我们将容器的网络设置为web ，并将容器命名为traefik 。

Finally, we use the traefik:1.7.21-alpine image for this container, because it’s small.

最后，我们将traefik:1.7.21-alpine图片用于此容器，因为它很小。

A Docker image’s ENTRYPOINT is a command that always runs when a container is created from the image. In this case, the command is the traefik binary within the container. You can pass additional arguments to that command when you launch the container, but we’ve configured all of our settings in the traefik.toml file.

Docker映像的ENTRYPOINT是从映像创建容器时始终运行的命令。 在这种情况下，命令是容器内的traefik二进制文件。 启动容器时，可以将其他参数传递给该命令，但是我们已经在traefik.toml文件中配置了所有设置。

With the container started, you now have a dashboard you can access to see the health of your containers. You can also use this dashboard to visualize the frontends and backends that Traefik has registered. Access the monitoring dashboard by pointing your browser to https://monitor.your_domain. You will be prompted for your username and password, which are admin and the password you configured in Step 1.

容器启动后，您现在可以使用仪表板来查看容器的运行状况。 您也可以使用此仪表板来可视化Traefik已注册的前端和后端。 通过将浏览器指向https://monitor. your_domain来访问监视仪表板https://monitor. your_domain https://monitor. your_domain 。 系统将提示您输入用户名和密码，即admin和在步骤1中配置的密码。

Once logged in, you’ll see an interface similar to this:

登录后，您将看到类似于以下的界面：

There isn’t much to see just yet, but leave this window open, and you will see the contents change as you add containers for Traefik to work with.

没什么可看的，但是保持此窗口为打开状态，当您添加供Traefik使用的容器时，内容将发生变化。

We now have our Traefik proxy running, configured to work with Docker, and ready to monitor other Docker containers. Let’s start some containers for Traefik to act as a proxy for.

现在，我们运行Traefik代理，将其配置为与Docker一起使用，并准备监视其他Docker容器。 让我们启动一些容器，让Traefik充当代理。

第3步-向Traefik注册容器 (Step 3 — Registering Containers with Traefik)

With the Traefik container running, you’re ready to run applications behind it. Let’s launch the following containers behind Traefik:

运行Traefik容器后，您就可以在其后面运行应用程序了。 让我们在Traefik后面启动以下容器：

1. A blog using the official Wordpress image.

   使用官方Wordpress图片的博客。

2. A database management server using the official Adminer image.

   使用官方Adminer映像的数据库管理服务器。

We’ll manage both of these applications with Docker Compose using a docker-compose.yml file. Open the docker-compose.yml file in your editor:

我们将使用docker-compose.yml文件通过Docker Compose管理这两个应用程序。 在编辑器中打开docker-compose.yml文件：

• vi docker-compose.yml
  vi docker-compose.yml

Add the following lines to the file to specify the version and the networks we’ll use:

将以下行添加到文件中以指定版本和我们将使用的网络：

docker-compose.yml

docker-compose.yml

version: "3"

networks:
  web:
    external: true
  internal:
    external: false

We use Docker Compose version 3 because it’s the newest major version of the Compose file format.

我们使用Docker Compose版本3因为它是Compose文件格式的最新主要版本。

For Traefik to recognize our applications, they must be part of the same network, and since we created the network manually, we pull it in by specifying the network name of web and setting external to true. Then we define another network so that we can connect our exposed containers to a database container that we won’t expose through Traefik. We’ll call this network internal.

为了让Traefik能够识别我们的应用程序，它们必须属于同一网络，并且由于我们是手动创建的网络，因此可以通过指定web的网络名称并将external设置为true来拉入网络。 然后，我们定义另一个网络，以便可以将暴露的容器连接到我们不会通过Traefik暴露的数据库容器。 我们将此网络称为internal网络。

Next, we’ll define each of our services, one at a time. Let’s start with the blog container, which we’ll base on the official WordPress image. Add this configuration to the file:

接下来，我们将一次定义每个services 。 让我们从blog容器开始，我们将基于官方的WordPress图像。 将此配置添加到文件中：

docker-compose.yml

docker-compose.yml

version: "3"
...

services:
  blog:
    image: wordpress:5.3.2-apache
    environment:
      WORDPRESS_DB_PASSWORD:
    labels:
      - traefik.backend=blog
      - traefik.frontend.rule=Host:blog.your_domain
      - traefik.docker.network=web
      - traefik.port=80
    networks:
      - internal
      - web
    depends_on:
      - mysql

The environment key lets you specify environment variables that will be set inside of the container. By not setting a value for WORDPRESS_DB_PASSWORD, we’re telling Docker Compose to get the value from our shell and pass it through when we create the container. We will define this environment variable in our shell before starting the containers. This way we don’t hard-code passwords into the configuration file.

environment键使您可以指定将在容器内部设置的环境变量。 通过不为WORDPRESS_DB_PASSWORD设置值，我们告诉Docker Compose从外壳中获取值，并在创建容器时将其传递给它。 在启动容器之前，我们将在外壳中定义此环境变量。 这样，我们就不会将密码硬编码到配置文件中。

The labels section is where you specify configuration values for Traefik. Docker labels don’t do anything by themselves, but Traefik reads these so it knows how to treat containers. Here’s what each of these labels does:

labels部分是您指定Traefik的配置值的地方。 Docker标签本身不会做任何事情，但是Traefik会读取这些标签，因此知道如何处理容器。 这些标签的作用如下：

• traefik.backend specifies the name of the backend service in Traefik (which points to the actual blog container).

  traefik.backend在traefik.backend指定后端服务的名称(指向实际的blog容器)。

• traefik.frontend.rule=Host:blog.your_domain tells Traefik to examine the host requested and if it matches the pattern of blog.your_domain it should route the traffic to the blog container.

  traefik.frontend.rule=Host:blog. your_domain traefik.frontend.rule=Host:blog. your_domain告诉Traefik检查请求的主机以及它是否与blog. your_domain模式匹配blog. your_domain blog. your_domain应该将流量路由到blog容器。

• traefik.docker.network=web specifies which network to look under for Traefik to find the internal IP for this container. Since our Traefik container has access to all of the Docker info, it would potentially take the IP for the internal network if we didn’t specify this.

  traefik.docker.network=web指定要在哪个网络下查找Traefik，以查找该容器的内部IP。 由于我们的Traefik容器可以访问所有Docker信息，因此，如果我们不指定此地址，它将有可能获取internal网络的IP。

• traefik.port specifies the exposed port that Traefik should use to route traffic to this container.

  traefik.port指定Traefik用于将流量路由到此容器的公开端口。

With this configuration, all traffic sent to our Docker host’s port 80 will be routed to the blog container.

使用此配置，所有发送到我们的Docker主机端口80流量都将被路由到blog容器。

We assign this container to two different networks so that Traefik can find it via the web network and it can communicate with the database container through the internal network.

我们将此容器分配给两个不同的网络，以便Traefik可以通过web网络找到它，并且可以通过internal网络与数据库容器进行通信。

Lastly, the depends_on key tells Docker Compose that this container needs to start after its dependencies are running. Since WordPress needs a database to run, we must run our mysql container before starting our blog container.

最后， depends_on键告诉Docker Compose该容器在其依赖项运行后需要启动。 由于WordPress需要数据库才能运行，因此在启动blog容器之前，我们必须运行mysql容器。

Next, configure the MySQL service by adding this configuration to your file:

接下来，通过将以下配置添加到文件中来配置MySQL服务：

docker-compose.yml

docker-compose.yml

services:
...
  mysql:
    image: mysql:5.7
    environment:
      MYSQL_ROOT_PASSWORD:
    networks:
      - internal
    labels:
      - traefik.enable=false

We’re using the official MySQL 5.7 image for this container. You’ll notice that we’re once again using an environment item without a value. The MYSQL_ROOT_PASSWORD and WORDPRESS_DB_PASSWORD variables will need to be set to the same value to make sure that our WordPress container can communicate with MySQL. We don’t want to expose the mysql container to Traefik or the outside world, so we’re only assigning this container to the internal network. Since Traefik has access to the Docker socket, the process will still expose a frontend for the mysql container by default, so we’ll add the label traefik.enable=false to specify that Traefik should not expose this container.

我们正在为此容器使用官方MySQL 5.7映像。 您会注意到，我们再次使用了没有值的environment项目。 必须将MYSQL_ROOT_PASSWORD和WORDPRESS_DB_PASSWORD变量设置为相同的值，以确保我们的WordPress容器可以与MySQL通信。 我们不想将mysql容器公开给Traefik或外界，因此我们仅将此容器分配给internal网络。 由于Traefik可以访问Docker套接字，因此默认情况下该进程仍会公开mysql容器的前端，因此我们将添加标签traefik.enable=false来指定Traefik不应公开此容器。

Finally, add this configuration to define the Adminer container:

最后，添加此配置以定义Adminer容器：

docker-compose.yml

docker-compose.yml

services:
...
  adminer:
    image: adminer:4.7.6-standalone
    labels:
      - traefik.backend=adminer
      - traefik.frontend.rule=Host:db-admin.your_domain
      - traefik.docker.network=web
      - traefik.port=8080
    networks:
      - internal
      - web
    depends_on:
      - mysql

This container is based on the official Adminer image. The network and depends_on configurations for this container exactly match what we’re using for the blog container.

此容器基于官方Adminer映像。 该容器的network和depends_on配置与我们用于blog容器的配置完全匹配。

However, since we’re directing all of the traffic to port 80 on our Docker host directly to the blog container, we need to configure this container differently in order for traffic to make it to our adminer container. The line traefik.frontend.rule=Host:db-admin.your_domain tells Traefik to examine the host requested. If it matches the pattern of db-admin.your_domain, Traefik will route the traffic to the adminer container.

然而，由于我们指挥所有流量的端口80直接我们的码头工人主机上的blog容器，我们需要以不同的方式配置此容器的流量，使其向我们adminer容器。 线traefik.frontend.rule=Host:db-admin. your_domain traefik.frontend.rule=Host:db-admin. your_domain告诉Traefik检查请求的主机。 如果与db-admin. your_domain的模式匹配db-admin. your_domain db-admin. your_domain ，Traefik会将流量路由到adminer容器。

At this point, docker-compose.yml should have the following contents:

此时， docker-compose.yml应该具有以下内容：

docker-compose.yml

docker-compose.yml

version: "3"

networks:
  web:
    external: true
  internal:
    external: false

services:
  blog:
    image: wordpress:5.3.2-apache
    environment:
      WORDPRESS_DB_PASSWORD:
    labels:
      - traefik.backend=blog
      - traefik.frontend.rule=Host:blog.your_domain
      - traefik.docker.network=web
      - traefik.port=80
    networks:
      - internal
      - web
    depends_on:
      - mysql
  mysql:
    image: mysql:5.7
    environment:
      MYSQL_ROOT_PASSWORD:
    networks:
      - internal
    labels:
      - traefik.enable=false
  adminer:
    image: adminer:4.7.6-standalone
    labels:
      - traefik.backend=adminer
      - traefik.frontend.rule=Host:db-admin.your_domain
      - traefik.docker.network=web
      - traefik.port=8080
    networks:
      - internal
      - web
    depends_on:
      - mysql

Save the file and exit the text editor.

保存文件并退出文本编辑器。

Next, set values in your shell for the WORDPRESS_DB_PASSWORD and MYSQL_ROOT_PASSWORD variables before you start your containers:

接下来，在启动容器之前，在外壳程序中为WORDPRESS_DB_PASSWORD和MYSQL_ROOT_PASSWORD变量设置值：

• export WORDPRESS_DB_PASSWORD=secure_database_password

  导出WORDPRESS_DB_PASSWORD = secure_database_password

• export MYSQL_ROOT_PASSWORD=secure_database_password

  导出MYSQL_ROOT_PASSWORD = secure_database_password

Substitute secure_database_password with your desired database password. Remember to use the same password for both WORDPRESS_DB_PASSWORD and MYSQL_ROOT_PASSWORD.

用所需的数据库密码替换secure_database_password 。 请记住，对WORDPRESS_DB_PASSWORD和MYSQL_ROOT_PASSWORD使用相同的密码。

With these variables set, run the containers using docker-compose:

设置好这些变量后，使用docker-compose运行容器：

• docker-compose up -d
  docker-compose up -d

Now take another look at the Traefik admin dashboard. You’ll see that there is now a backend and a frontend for the two exposed servers:

现在再看一下Traefik管理控制台。 您将看到两个暴露的服务器现在有一个backend和一个frontend ：

Navigate to blog.your_domain, substituting your_domain with your domain. You’ll be redirected to a TLS connection and can now complete the Wordpress setup:

导航到blog. your_domain blog. your_domain ，用您的域替换your_domain 。 您将被重定向到TLS连接，现在可以完成Wordpress设置：

Now access Adminer by visiting db-admin.your_domain in your browser, again substituting your_domain with your domain. The mysql container isn’t exposed to the outside world, but the adminer container has access to it through the internal Docker network that they share using the mysql container name as a host name.

现在，通过访问db-admin. your_domain访问Adminer db-admin. your_domain 您的浏览器中的db-admin. your_domain ，再次用您的域替换了your_domain 。 mysql容器没有暴露于外界，但是adminer容器可以通过internal Docker网络访问它们，他们使用mysql容器名称作为主机名共享它们。

On the Adminer login screen, use the username root, use mysql for the server, and use the value you set for MYSQL_ROOT_PASSWORD for the password. Once logged in, you’ll see the Adminer user interface:

在“管理员”登录屏幕上，使用用户名root ，对服务器使用mysql ，并使用为MYSQL_ROOT_PASSWORD设置的值作为密码。 登录后，您将看到Adminer用户界面：

Both sites are now working, and you can use the dashboard at monitor.your_domain to keep an eye on your applications.

这两个站点现在都可以使用，您可以在monitor. your_domain使用仪表板monitor. your_domain monitor. your_domain密切关注您的应用程序。

结论 (Conclusion)

In this tutorial, you configured Traefik to proxy requests to other applications in Docker containers.

在本教程中，您配置了Traefik以将请求代理到Docker容器中的其他应用程序。

Traefik’s declarative configuration at the application container level makes it easy to configure more services, and there’s no need to restart the traefik container when you add new applications to proxy traffic to since Traefik notices the changes immediately through the Docker socket file it’s monitoring.

Traefik在应用程序容器级别的声明式配置使配置更多服务变得容易，并且当您添加新的应用程序以代理流量时，无需重新启动traefik容器，因为Traefik会通过其监视的Docker套接字文件立即注意到更改。

To learn more about what you can do with Traefik, head over to the official Traefik documentation. If you’d like to explore Docker containers further, check out How To Set Up a Private Docker Registry on Ubuntu 18.04 or How To Secure a Containerized Node.js Application with Nginx, Let’s Encrypt, and Docker Compose. Although these tutorials are written for Ubuntu 18.04, many of the Docker-specific commands can be used for CentOS 7.

要了解有关使用Traefik可以做什么的更多信息，请访问Traefik官方文档 。 如果您想进一步探索Docker容器，请查看如何在Ubuntu 18.04上设置私有Docker注册表，或如何使用Nginx，Let's Encrypt和Docker Compose保护容器化的Node.js应用程序 。 尽管这些教程是针对Ubuntu 18.04编写的，但许多特定于Docker的命令可用于CentOS 7。

翻译自: https://www.digitalocean.com/community/tutorials/how-to-use-traefik-1-7-21-as-a-reverse-proxy-for-docker-containers-on-centos-7-2