mirror/matrix-docker-ansible-deploy
1
0
Fork 0
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git synced 2025-02-04 22:35:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update docs/configuring-playbook-traefik.md: add the common section "Adjusting the playbook configuration"

Browse Source 
- Move the section not related to adjusting the playbook configurations out of it

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>
This commit is contained in:
Suguru Hirahara 2025-02-01 19:29:28 +09:00
parent c2cd5fdb48
commit eb51913dea
No known key found for this signature in database
GPG Key ID: E4F9743DAB4B7B75
1 changed files with 15 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
docs/configuring-playbook-traefik.md
View File

@ -2,13 +2,11 @@
By default, this playbook installs and manages a [Traefik](https://doc.traefik.io/traefik/) reverse-proxy server, powered by the [ansible-role-traefik](https://github.com/mother-of-all-self-hosting/ansible-role-traefik) Ansible role for you. If that's okay, you can skip this document. By default, this playbook installs and manages a [Traefik](https://doc.traefik.io/traefik/) reverse-proxy server, powered by the [ansible-role-traefik](https://github.com/mother-of-all-self-hosting/ansible-role-traefik) Ansible role for you. If that's okay, you can skip this document.
## Adjusting the playbook configuration
This Ansible role support various configuration options. Feel free to consult its `default/main.yml` variables file. This Ansible role support various configuration options. Feel free to consult its `default/main.yml` variables file.
## Adjusting SSL certificate retrieval ### Disable access logs
See the dedicated [Adjusting SSL certificate retrieval](configuring-playbook-ssl-certificates.md) documentation page.
## Disable access logs
To disable access logging, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file: To disable access logging, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
@ -16,7 +14,7 @@ To disable access logging, add the following configuration to your `inventory/ho
traefik_config_accessLog_enabled: false traefik_config_accessLog_enabled: false
``` ```
## Enable Traefik Dashboard ### Enable Traefik Dashboard
To enable a Traefik [Dashboard](https://doc.traefik.io/traefik/operations/dashboard/) UI at `https://matrix.example.com/dashboard/` (note the trailing `/`), add the following configuration to your `vars.yml` file: To enable a Traefik [Dashboard](https://doc.traefik.io/traefik/operations/dashboard/) UI at `https://matrix.example.com/dashboard/` (note the trailing `/`), add the following configuration to your `vars.yml` file:
@ -31,7 +29,7 @@ traefik_dashboard_basicauth_password: YOUR_PASSWORD_HERE
> [!WARNING] > [!WARNING]
> Enabling the dashboard on a hostname you use for something else (like `matrix_server_fqn_matrix` in the configuration above) may cause conflicts. Enabling the Traefik Dashboard makes Traefik capture all `/dashboard` and `/api` requests and forward them to itself. If any of the services hosted on the same hostname requires any of these 2 URL prefixes, you will experience problems. So far, we're not aware of any playbook services which occupy these endpoints and are likely to cause conflicts. > Enabling the dashboard on a hostname you use for something else (like `matrix_server_fqn_matrix` in the configuration above) may cause conflicts. Enabling the Traefik Dashboard makes Traefik capture all `/dashboard` and `/api` requests and forward them to itself. If any of the services hosted on the same hostname requires any of these 2 URL prefixes, you will experience problems. So far, we're not aware of any playbook services which occupy these endpoints and are likely to cause conflicts.
## Extending the configuration ### Extending the configuration
There are some additional things you may wish to configure about the component. There are some additional things you may wish to configure about the component.
@ -59,13 +57,13 @@ traefik_configuration_extension_yaml: |
dashboard: true dashboard: true
``` ```
## Reverse-proxying another service behind Traefik ### Reverse-proxying another service behind Traefik
The preferred way to reverse-proxy additional services behind Traefik would be to start the service as another container, configure the container with the corresponding Traefik [container labels](https://docs.docker.com/config/labels-custom-metadata/) (see [Traefik & Docker](https://doc.traefik.io/traefik/routing/providers/docker/)), and connect the service to the `traefik` network. Some services are also already available via the compatible [mash-playbook](https://github.com/mother-of-all-self-hosting/mash-playbook), but take a look at the minor [interoperability adjustments](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/interoperability.md). The preferred way to reverse-proxy additional services behind Traefik would be to start the service as another container, configure the container with the corresponding Traefik [container labels](https://docs.docker.com/config/labels-custom-metadata/) (see [Traefik & Docker](https://doc.traefik.io/traefik/routing/providers/docker/)), and connect the service to the `traefik` network. Some services are also already available via the compatible [mash-playbook](https://github.com/mother-of-all-self-hosting/mash-playbook), but take a look at the minor [interoperability adjustments](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/interoperability.md).
However, if your service does not run on a container or runs on another machine, the following configuration might be what you are looking for. However, if your service does not run on a container or runs on another machine, the following configuration might be what you are looking for.
## Reverse-proxying a remote HTTP/HTTPS service behind Traefik ### Reverse-proxying a remote HTTP/HTTPS service behind Traefik
If you want to host another webserver would be reachable via `my-fancy-website.example.net` from the internet and via `https://<internal webserver IP address>:<internal port>` from inside your network, you can make the playbook's integrated Traefik instance reverse-proxy the traffic to the correct host. If you want to host another webserver would be reachable via `my-fancy-website.example.net` from the internet and via `https://<internal webserver IP address>:<internal port>` from inside your network, you can make the playbook's integrated Traefik instance reverse-proxy the traffic to the correct host.
@ -120,7 +118,7 @@ aux_file_definitions:
``` ```
Changing the `url` to one with an `http://` prefix would allow to connect to the server via HTTP. Changing the `url` to one with an `http://` prefix would allow to connect to the server via HTTP.
## Reverse-proxying another service behind Traefik without terminating SSL ### Reverse-proxying another service behind Traefik without terminating SSL
If you do not want to terminate SSL at the Traefik instance (for example, because you're already terminating SSL at other webserver), you need to adjust the static configuration in the same way as in the previous chapter in order to be able to add our own dynamic configuration files. Afterwards, you can add the following configuration to your `vars.yml` configuration file: If you do not want to terminate SSL at the Traefik instance (for example, because you're already terminating SSL at other webserver), you need to adjust the static configuration in the same way as in the previous chapter in order to be able to add our own dynamic configuration files. Afterwards, you can add the following configuration to your `vars.yml` configuration file:
@ -148,7 +146,7 @@ With these changes, all TCP traffic will be reverse-proxied to the target system
> [!WARNING] > [!WARNING]
> This configuration might lead to problems or need additional steps when a [certbot](https://certbot.eff.org/) behind Traefik also tries to manage [Let's Encrypt](https://letsencrypt.org/) certificates, as Traefik captures all traffic to ```PathPrefix(`/.well-known/acme-challenge/`)```. > This configuration might lead to problems or need additional steps when a [certbot](https://certbot.eff.org/) behind Traefik also tries to manage [Let's Encrypt](https://letsencrypt.org/) certificates, as Traefik captures all traffic to ```PathPrefix(`/.well-known/acme-challenge/`)```.
## Traefik behind a `proxy_protocol` reverse-proxy ### Traefik behind a `proxy_protocol` reverse-proxy
If you run a reverse-proxy which speaks `proxy_protocol`, add the following configuration to your `vars.yml` file: If you run a reverse-proxy which speaks `proxy_protocol`, add the following configuration to your `vars.yml` file:
@ -169,6 +167,12 @@ traefik_configuration_extension_yaml: |
- "<proxy IPv6>/128" - "<proxy IPv6>/128"
``` ```
## Other configurations
### Adjusting SSL certificate retrieval
See the dedicated [Adjusting SSL certificate retrieval](configuring-playbook-ssl-certificates.md) documentation page.
## Troubleshooting ## Troubleshooting
As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-traefik`. As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-traefik`.