基本身份验证不适用于 Traefik v2.1

时间：2020-12-22 07:33:04

标签： basic-authentication traefik

我的问题是我无法通过 traefik 为我的前端应用设置 basic authentication

这就是我如何配置我的 traefik

traefik.yml

global:
  checkNewVersion: true
  sendAnonymousUsage: false

entryPoints:
  https:
    address: :443
  http:
    address: :80
  traefik:
    address: :8080

tls:
  options:
    foo:
      minVersion: VersionTLS12
      cipherSuites:
        - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
        - "TLS_RSA_WITH_AES_256_GCM_SHA384"

providers:
  providersThrottleDuration: 2s
  docker:
    watch: true
    endpoint: unix:///var/run/docker.sock
    exposedByDefault: false
    network: web

api:
  insecure: true
  dashboard: true

log:
  level: INFO

certificatesResolvers:
  default:
    acme:
      storage: /acme.json
      httpChallenge:
        entryPoint: http

docker-compose.yml

version: '3'
services:
  traefik:
    image: traefik:v2.0
    restart: always
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "/srv/traefik/traefik.yml:/etc/traefik/traefik.yml"
      - "/srv/traefik/acme.json:/acme.json"
    networks:
      - web

networks:
  web:
    external: true

这里是我的前端应用程序作为 traefik 提供程序运行的地方，以及我的基本身份验证标签的地方

version: '3.7'
services:
  frontend:
    image: git.xxxx.com:7000/dockerregistry/registry/xxxx
    restart: "always"
    networks:
      - web
    volumes:
      - "/srv/config/api.js:/var/www/htdocs/api.js"
      - "/srv/efs/workspace:/var/www/htdocs/stock"
    labels:
      - traefik.enable=true
      - traefik.http.routers.frontend-http.rule=Host(`test.xxxx.com`)
      - traefik.http.routers.frontend-http.service=frontend
      - traefik.http.routers.frontend-http.entrypoints=http
      - traefik.http.routers.frontend.tls=true
      - traefik.http.routers.frontend.tls.certresolver=default
      - traefik.http.routers.frontend.entrypoints=http
      - traefik.http.routers.frontend.rule=Host(`test.xxxx.com`)
      - traefik.http.routers.frontend.service=frontend
      - traefik.http.middlewares.frontend.basicAuth.users=test:$$2y$$05$$c45HvbP0Sq9EzcfaXiGNsuuWMfPhyoFZVYgiTylpMMLtJY2nP1P6m
      - traefik.http.services.frontend.loadbalancer.server.port=8080

networks:
  web:
    external: true

我无法获得登录提示，所以我想知道我是否为此缺少一些容器标签。

提前致谢！华金

3 个答案:

答案 0 :(得分：2)

我是这样配置的：

  1. 通过 apache2-utils 生成密码，例如
htpasswd -nb admin secure_password
  1. 设置 traefik.toml
[entryPoints]
  [entryPoints.web]
    address = ":80"
    [entryPoints.web.http.redirections.entryPoint]
      to = "websecure"
      scheme = "https"

  [entryPoints.websecure]
    address = ":443"

[api]
  dashboard = true

[certificatesResolvers.lets-encrypt.acme]
  email = "your_email@your_domain"
  storage = "acme.json"
  [certificatesResolvers.lets-encrypt.acme.tlsChallenge]

[providers.docker]
  watch = true
  network = "web"

[providers.file]
  filename = "traefik_dynamic.toml"
  1. 设置 traefik_dynamic.toml
[http.middlewares.simpleAuth.basicAuth]
  users = [
    "admin:$apr1$ruca84Hq$mbjdMZBAG.KWn7vfN/SNK/"
  ]

[http.routers.api]
  rule = "Host(`monitor.your_domain`)"
  entrypoints = ["websecure"]
  middlewares = ["simpleAuth"]
  service = "api@internal"
  [http.routers.api.tls]
    certResolver = "lets-encrypt"
  1. 设置 traefik 服务
services:
  reverse-proxy:
    image: traefik:v2.3
    restart: always
    command:
      - --api.insecure=true
      - --providers.docker
    ports:
      - "80:80"
      - "443:443"
    networks:
      - web
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik.toml:/traefik.toml
      - ./traefik_dynamic.toml:/traefik_dynamic.toml
      - ./acme.json:/acme.json

答案 1 :(得分：2)

首先，标签应该像这样""

其次，我认为您在前端应用程序中缺少一个标签。 使用基本身份验证时需要两个步骤，应该如下所示：

  - "traefik.http.routers.frontend.middlewares=frontend-auth"
  - "traefik.http.middlewares.frontend-auth.basicauth.users=test:$$2y$$05$$c45HvbP0Sq9EzcfaXiGNsuuWMfPhyoFZVYgiTylpMMLtJY2nP1P6m"

答案 2 :(得分：1)

在您的 Docker Compose 文件中不要为 traefik 添加“中间件”标签，而是使用传递 traefik.yml 选项的 providers.file 文件来执行此操作，您应该在其中定义路由器、服务、中间件等。在该“提供者文件”中，您应该在 middlewares 下设置 http.routes.traefik – 这在开始时可能听起来非常混乱，但并不难，相信我。

让我们做一个 YAML 案例（您可以将其转换为“TOML”here）。

这个例子假设你有一个 Docker Compose 文件专门用于 Traefik——我没有尝试使用同一个 Docker Compose 文件和其中的任何其他服务（如 Wordpress、数据库或其他），因为我这些文件的路径已经不同。

docker-compose.yml

version: '3.1'

services:
  reverse-proxy:
    image: traefik:v2.4
    [ ... ]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # Map the dynamic conf into the container
      - ./traefik/config.yml:/etc/traefik/config.yml:ro
      # Map the static conf into the container
      - ./traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      # Note you don't use "traefik.http.routers.<service>.middlewares etc." here
[ ... ]

在这种情况下，我在 ./traefik 中设置/获取 Traefik 的配置文件（相对于 docker-compose.yml 文件）。

./traefik/config.yml

http:
  routers:
    traefik:
      middlewares: "basicauth"
      [ ... ]
  middlewares:
    basicauth:
      basicAuth:
        removeHeader: true
        users:
          - <user>:<password>
          # password should be generated using `htpasswd` (md5, sha1 or bcrypt)
[ ... ]

在这里您可以根据需要设置 basicauth 名称（因为这是您将在仪表板中看到的中间件名称），因此您可以：

http:
  routers:
    traefik:
      middlewares: "super-dashboard-auth"
      [ ... ]
  middlewares:
    super-dashboard-auth:
      basicAuth:
        removeHeader: true
        users:
          - <user>:<password>
          # password should be generated using `htpasswd` (md5, sha1 or bcrypt)
[ ... ]

请注意，basicAuth 必须保持原样。此外，在这里您不需要使用“双美元方法”来转义它（如在 label approach 中那样），因此在创建用户密码后，您应该完全按照 htpasswd 创建它的方式输入它。 

# BAD
user:$$2y$$10$$nRLqyZT.64JI/CD/ym65UGDn8HaY0D6CBTxhe6JXf9u4wi5bEMdh.

# GOOD
user:$2y$10$nRLqyZT.64JI/CD/ym65UGDn8HaY0D6CBTxhe6JXf9u4wi5bEMdh.

当然，您可能希望从 .env 文件中获取此数据，而不是硬编码那些字符串，在这种情况下，您需要从 docker-compose.yml像这样使用 environment：

services:
  reverse-proxy:
    image: traefik:v2.4
    container_name: traefik
    [ ... ]
    environment:
      TRAEFIK_DASHBOARD_USER: "${TRAEFIK_DASHBOARD_USER}"
      TRAEFIK_DASHBOARD_PWD: "${TRAEFIK_DASHBOARD_PWD}"
      # And any other env. var. you may need
[ ... ]

并在您的 traefik/config.yml 文件中像这样使用它：

[ ... ]
middlewares:
    super-dashboard-auth:
      basicAuth:
        removeHeader: true
        users:
          - "{{env "TRAEFIK_DASHBOARD_USER"}}:{{env "TRAEFIK_DASHBOARD_PWD"}}"
[ ... ]

之后在 providers.file.filename 中包含上一个文件

./traefik/traefik.yml

[ ... ]

api:
  dashboard: true
  insecure: false

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    [ ... ]

  file:
    filename: /etc/traefik/config.yml
    watch: true

[ ... ]

然后简单地docker-compose up -d

相关问题
最新问题