traefik
traefik copied to clipboard
Adds support for .deb package builder in Traefik
Implements a Dockerfile and adjusts the Makefile for automated .deb package building in Traefik
This commit introduces a Dockerfile configured for Ubuntu 24, enhancing the environment setup and handling of environment variables for the automated construction of .deb packages. Significant improvements and additions include:
- Integration of logrotate to manage log files.
- Provision of a
traefik.yml
example that redirects traffic from port 80 to 8000. - Installation instructions for setting up Traefik as a standalone service on Ubuntu without Docker.
- Implementation of a systemd service configuration for robust service management, featuring:
- Running as user
www-data
to enhance security. -
AmbientCapabilities=CAP_NET_BIND_SERVICE
to allow binding to well-known ports without elevated privileges. -
Restart=always
to ensure the service restarts automatically if it crashes. - Enhanced filesystem and service isolation with
ProtectSystem=strict
,PrivateTmp=true
,ProtectHome=true
,PrivateDevices=true
,ProtectKernelTunables=true
,ProtectControlGroups=true
. - Specified
ReadWritePaths=/etc/traefik/acme.json /var/log/traefik/
to restrict read-write permissions to essential paths.
- Running as user
- Configuration to run Traefik under the
www-data
user for improved security and compliance.
These enhancements are aimed at solidifying Traefik's deployment as a secure and reliable reverse proxy and load balancer on Ubuntu systems.
Can be enhanced to support other debian and ubuntu releases.