In this tutorial I use a bare metal installation of Traefik and configurate it as reverse proxy for an Apache2 webserver. As Linux distribution I use openSUSE Leap 15.5.
I used this setup to secure Apache2 on a very old - not public accessible - server where it was not possible to update the system and the tls version was no longer supported by the browser. Traefik uses the GO libaries for TSL therefore it worked great as a workaround.
Prerequisites #
Certificates #
I use Let’s Encrypt wildcard certificates that I have copied on the server.
# Change certificate permissions
sudo chmod -R 0400 /etc/traefik/certificates
# Check permissions
ls /etc/traefik/certificates
# Shell output:
-r-------- 1 root root 1773 Aug 25 17:10 cert1.pem
-r-------- 1 root root 3749 Aug 25 17:10 chain1.pem
-r-------- 1 root root 5522 Aug 25 17:10 fullchain1.pem
-r-------- 1 root root 1704 Aug 25 17:10 privkey1.pem
Apache2 #
# Install Apache2
sudo zypper install apache2
# Open apache listen.conf
sudo vi /etc/apache2/listen.conf
# Change the Apache2 to listen to port 81
Listen 81
#<IfDefine SSL>
# <IfDefine !NOSSL>
# <IfModule mod_ssl.c>
#
# Listen 443
#
# </IfModule>
# </IfDefine>
#</IfDefine>
# Restart Apache2
sudo systemctl restart apache2
Hosts File #
# Hosts file
C:\Windows\System32\drivers\etc\hosts
# Add entry to hosts file
192.168.30.224 traefik-proxy.jklug.work
Install Traefik #
Find the latest release:
https://github.com/traefik/traefik/releases
# Download latest archive
wget https://github.com/traefik/traefik/releases/download/v2.10.4/traefik_v2.10.4_linux_amd64.tar.gz
# Unpack archive
tar -xvf traefik_v2.10.4_linux_amd64.tar.gz
# Move trafik into bin directory
sudo mv traefik /usr/local/bin/
# Make file executable
chmod +x /usr/local/bin/traefik
Traefik Configuration #
# Create directory for configuration files
sudo mkdir /etc/traefik
traefik.yaml #
# Main configuration
sudo vi /etc/traefik/traefik.yaml
# General settings
log:
level: INFO
global:
checkNewVersion: false
sendAnonymousUsage: false
api: # Disable in production
insecure: false
dashboard: false
# Ports
entryPoints:
web:
address: ":80"
websecure:
address: ":443"
# Reverse proxy
providers:
file:
filename: "/etc/traefik/reverse-proxy.yml"
reverse-proxy.yml #
# Reverse proxy configuration
sudo vi /etc/traefik/reverse-proxy.yml
http: # Routing
routers:
apache-router: # HTTP routing
rule: "Host(`traefik-proxy.jklug.work`)"
service: apache-service
entryPoints:
- web
middlewares: # Redirect http to https
- http-to-https
apache-router-secure: # HTTPS routing
rule: "Host(`traefik-proxy.jklug.work`)"
service: apache-service
entryPoints:
- websecure
tls: true
# Redirect http to https
middlewares:
http-to-https:
redirectScheme:
scheme: https
permanent: true
# Define Apache2 service
services:
apache-service:
loadBalancer:
servers:
- url: "http://localhost:81"
# Define path to Let's Encrypt certificates
tls:
certificates:
- certFile: /etc/traefik/certificates/fullchain1.pem
keyFile: /etc/traefik/certificates/privkey1.pem
Traefik Startup #
init.d Version #
# Create configuration file
touch /etc/init.d/traefik
# Make configuration file executable
Make file executable: chmod +x /etc/init.d/traefik
# Edit configuration file
vi /etc/init.d/traefik
#!/bin/sh
TRAEFIK_BIN="/usr/local/bin/traefik"
TRAEFIK_CONFIG="/etc/traefik/traefik.yaml"
. /etc/rc.status
rc_reset
case "$1" in
start)
echo -n "Starting Traefik: "
startproc $TRAEFIK_BIN --configFile $TRAEFIK_CONFIG
rc_status -v
;;
stop)
echo -n "Stopping Traefik: "
killproc -TERM $TRAEFIK_BIN
rc_status -v
;;
try-restart)
$0 status >/dev/null && $0 restart
rc_status
;;
restart)
$0 stop
$0 start
rc_status
;;
force-reload)
echo -n "Reload service Traefik"
checkproc $TRAEFIK_BIN
rc_status -v
;;
reload)
rc_status -v
;;
status)
echo -n "Checking for Traefik: "
checkproc $TRAEFIK_BIN
rc_status -v
;;
probe)
;;
*)
echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}"
exit 1
;;
esac
rc_exit
Start Traefik #
# Start traefik
/etc/init.d/traefik start
# Stop traefik
/etc/init.d/traefik stop
# Restart traefik
/etc/init.d/traefik restart
systen.d Version #
# Create / edit configuration file
sudo vi /etc/systemd/system/traefik.service
[Unit]
Description=Traefik
Documentation=https://docs.traefik.io
After=network.target
[Service]
ExecStart=/usr/local/bin/traefik --configFile=/etc/traefik/traefik.yaml
Restart=always
StandardOutput=journal
StandardError=journal
SyslogIdentifier=traefik
[Install]
WantedBy=multi-user.target
Start Traefik #
# Reload the systemd daemon to pick up the new service file
sudo systemctl daemon-reload
# Start traefik
sudo systemctl start traefik
# Start traefik
sudo systemctl stop traefik
# Enable startup
sudo systemctl enable traefik
# Check status
sudo systemctl status traefik