Add nginx reverse proxy

Gamer-20A · August 23, 2023, 1:35pm

hi so i have cups and pi hole installed, now i want them both to be accessible using nginx, if not nginx then traefik maybe because its listed on your article two projects one device, but i cannot find it at all, help me with it please

mpous · August 23, 2023, 2:32pm

@ajlennon could you please help @Gamer-20A to deploy traefik on this multi-app scenario?

ajlennon · August 23, 2023, 3:16pm

Of course @mpous !

I’ve been having a lot of fun with Traefik this week trying to get it working with MING. I am still basically a noob but have figured out quite a few things. Here is a Dockerfile setting up routing to containers including Node-Red, Grafana and Openthread Border Routers. Basically this is URL path prefix to various ports in containers.

version: '2'

volumes:
  node-red-data:
  grafana-data:
  influxdb-data:
  influxdb-etc:

services:

  # ------------------------------------------------------------------------------------
  # BalenaLabs WiFi-Connect
  # ------------------------------------------------------------------------------------
  wifi-connect:
    image: bh.cr/balenalabs/wifi-connect-rpi
    container_name: wifi-connect
    network_mode: host
    labels:
        io.balena.features.dbus: '1'
        io.balena.features.firmware: '1'
    cap_add:
        - NET_ADMIN
    environment:
        DBUS_SYSTEM_BUS_ADDRESS: "unix:path=/host/run/dbus/system_bus_socket"
    restart: always

  # ------------------------------------------------------------------------------------
  # Node-RED
  # ------------------------------------------------------------------------------------
  node-red:
    build: ./node-red
    container_name: node-red
    volumes:
        - 'node-red-data:/data'
    labels:
      # Enable traefik support for this container
      - "traefik.enable=true"
      # Set service port
      - "traefik.http.services.node-red.loadbalancer.server.port=80"
      # Make it available on the "web" entrypoint which is defined below as :80
      - "traefik.http.routers.node-red.entrypoints=web"
      # Add a specific path prefix that will be expected on the URL suffix
      - "traefik.http.routers.node-red.rule=PathPrefix(`/node-red`)"
      - "traefik.http.middlewares.strip-node-red-prefix.stripprefix.forceSlash=false"
      - "traefik.http.routers.node-red.middlewares=strip-node-red-prefix"
      # Make sure this rule is processed before OTBR as OTBR includes /node in path
      - "traefik.http.routers.node-red.priority=5"
      - "io.balena.features.dbus=true"
      - "io.balena.features.sysfs=true"
      - "io.balena.features.supervisor-api=true"
      - "io.balena.features.balena-api=true"
    environment:
        PORT: 80
        USERNAME: "balena"
        PASSWORD: "balena"
        ENCRIPTION_KEY: "balena"
    cap_add:
        - SYS_RAWIO
    devices:
        - "/dev/mem:/dev/mem"
        - "/dev/gpiomem:/dev/gpiomem"
    depends_on:
      influxdb:
        condition: service_started
      reverse-proxy:
        condition: service_started
    restart: always

  # ------------------------------------------------------------------------------------
  # Mosquitto MQTT Broker
  # ------------------------------------------------------------------------------------
  mosquitto-broker:
    image: eclipse-mosquitto:1.6.15
    container_name: mqtt
    ports:
      - "1883:1883"
    restart: always

  # ------------------------------------------------------------------------------------
  # Influxdb
  # ------------------------------------------------------------------------------------
  influxdb:
    image: influxdb:1.7.11
    container_name: influxdb
    volumes:
        - influxdb-data:/var/lib/influxdb
        - influxdb-etc:/etc/influxdb
    restart: always

  # ------------------------------------------------------------------------------------
  # Grafana
  # ------------------------------------------------------------------------------------
  grafana:
    image: bh.cr/balenalabs/dashboard
    container_name: grafana
    volumes:
        - "grafana-data:/data"
    environment:
        - "GF_SERVER_ROOT_URL=/grafana"
        - "GF_SERVER_SERVE_FROM_SUB_PATH=true"
    labels:
      # Enable traefik support for this container
      - "traefik.enable=true"
      # Set service port
      - "traefik.http.services.grafana.loadbalancer.server.port=80"
      # Make it available on the "web" entrypoint which is defined below as :80
      - "traefik.http.routers.grafana.entrypoints=web"
      # Add a specific path prefix that will be expected on the URL suffix
      - "traefik.http.routers.grafana.rule=PathPrefix(`/grafana`)"
    depends_on:
      influxdb:
        condition: service_started
      reverse-proxy:
        condition: service_started
    restart: always

  # ------------------------------------------------------------------------------------
  # OpenThread Border Router + MQTT-SN Gateway
  # ------------------------------------------------------------------------------------
  openthread-border-router:
    build: ./openthread-otbr
    devices:
      - /dev/ttyACM0:/dev/ttyACM0
    environment:
# For build
      - RADIO_URL="spinel+hdlc+uart:///dev/ttyACM0"
      - BACKBONE_INTERFACE="eth0"
# For run
      - RUN_MQTT_SNGATEWAY=1
      - SENSORNET="udp6"
      - BROKER_NAME="mqtt.dynamicdevices.co.uk"
      - BROKER_PORT=1883
      - BROKER_SECURE_PORT=8883
      - GATEWAY_PORT=10000
      - GATEWAY_IPV6_PORT=10000
      - MULTICAST_IPV6="ff03::1"
      - MULTICAST_IPV6_PORT=10000
      - MULTICAST_IPV6_IF="wpan0"
      - MULTICAST_IPV6_HOPS=3
      - AUTO_FORM_NETWORK=1
      - THREAD_CHANNEL=15
      - THREAD_PAN_ID=0x4444
      - THREAD_EXT_PAN_ID="3333333344444444"
      - THREAD_NETWORK_NAME="INST"
      - THREAD_NETWORK_KEY="33334444333344443333444433334444"
      - THREAD_IPV6_PREFIX="fd11:22::/64 pasor"
    labels:
      - "io.balena.features.kernel-modules=1"
      # Enable traefik support for this container
      - "traefik.enable=true"
      # Set service port
      - "traefik.http.services.openthread-border-router.loadbalancer.server.port=80"
      - "traefik.http.services.openthread-border-router-rest.loadbalancer.server.port=8081"
      # Make it available on the "web" entrypoint which is defined below as :80
      - "traefik.http.routers.openthread-border-router.entrypoints=web"
      - "traefik.http.routers.openthread-border-router-main.entrypoints=web"
      - "traefik.http.routers.openthread-border-router-rest.entrypoints=web"
      # Set service for routers
      - "traefik.http.routers.openthread-border-router.service=openthread-border-router"
      - "traefik.http.routers.openthread-border-router-main.service=openthread-border-router"
      - "traefik.http.routers.openthread-border-router-rest.service=openthread-border-router-rest"

      # Add a specific path prefix that will be expected on the URL suffix
      # NOTE: Really need to rework the OTBR and REST servers here as we're working around their paths
      - "traefik.http.routers.openthread-border-router.rule=( PathPrefix(`/otbr`) || PathPrefix(`/res`) )"
      - "traefik.http.routers.openthread-border-router-main.rule=( Path(`/`) )"
      - "traefik.http.routers.openthread-border-router-rest.rule=( PathPrefix(`/diagnostics`) || PathPrefix(`/node`) || PathPrefix(`/networks`))"

      - "traefik.http.middlewares.strip-otbr-prefix.stripprefix.prefixes=/otbr"
      - "traefik.http.middlewares.strip-otbr-prefix.stripprefix.forceSlash=false"
      - "traefik.http.routers.openthread-border-router.middlewares=strip-otbr-prefix"

      - "traefik.http.middlewares.redirect-root.redirectregex.regex=^/"
      - "traefik.http.middlewares.redirect-root.redirectregex.replacement=/otbr"
      - "traefik.http.routers.openthread-border-router-main.middlewares=redirect-root"

      # Make sure priority is lower than node-red
      - "traefik.http.routers.openthread-border-router.priority=4"
      - "traefik.http.routers.openthread-border-router-rest.priority=4"

    sysctls:
      net.ipv6.conf.all.disable_ipv6: 0
      net.ipv4.conf.all.forwarding: 1
      net.ipv6.conf.all.forwarding: 1
    depends_on:
      reverse-proxy:
        condition: service_started
    privileged: true
    restart: always

  # ------------------------------------------------------------------------------------
  # Traefik Reverse Proxy
  # ------------------------------------------------------------------------------------
  reverse-proxy:
    build: ./reverse-proxy
    command:
      - "--log.level=DEBUG"
      - "--accesslog=true"
      - "--accesslog.filepath=/var/log/traefik.log"
      - "--api.dashboard=true"
      # Uncomment this to enable the Traefik WebUI on port :8080
      - "--api.insecure"
      - "--providers.docker=true"
      - "--providers.docker.endpoint=unix:///var/run/balena-engine.sock"
      #- "--providers.docker.exposedbydefault=true"
      - "--entrypoints.web.address=:80"
    ports:
      # The HTTP port
      - "80:80"
      # The Dashboard port
      - "8080:8080"
    labels:
      # So that Traefik can listen to the Docker events
      - "io.balena.features.balena-socket=1"
    restart: always

Let me know what you are trying to do and maybe I can help

ajlennon · August 23, 2023, 3:27pm

A couple of things that helped me, and I have them set here, were to

enable the WebUI on :8080. This lets you see the routers and middlewares and services, how they are wired up, and if any failed to be configured
logging to a local log file. You can tail this file and see what requests are being forwarded to what internal services and so forth

Topic		Replies	Views
Integrating Traefik reverse proxy with MING Project help	1	276	August 24, 2023
BalenaHub Block to implement a reverse proxy to route web requests to containers (Traefik) balenaHub	5	1087	March 29, 2022
Rebuilding my Home Server Project help	12	2773	July 1, 2020
React Front End with NGINX and an Express Backend. Can't Find Backend Server balenaOS raspberrypi4	3	856	May 19, 2022
Traefik as a replacement for ha-proxy and cert-manager openBalena	2	410	October 12, 2022

Add nginx reverse proxy

Related topics