traefik icon indicating copy to clipboard operation
traefik copied to clipboard

Adds support for .deb package builder in Traefik

Open robertoberto opened this issue 9 months ago • 7 comments

Implements a Dockerfile and adjusts the Makefile for automated .deb package building in Traefik

This commit introduces a Dockerfile configured for Ubuntu 24, enhancing the environment setup and handling of environment variables for the automated construction of .deb packages. Significant improvements and additions include:

  • Integration of logrotate to manage log files.
  • Provision of a traefik.yml example that redirects traffic from port 80 to 8000.
  • Installation instructions for setting up Traefik as a standalone service on Ubuntu without Docker.
  • Implementation of a systemd service configuration for robust service management, featuring:
    • Running as user www-data to enhance security.
    • AmbientCapabilities=CAP_NET_BIND_SERVICE to allow binding to well-known ports without elevated privileges.
    • Restart=always to ensure the service restarts automatically if it crashes.
    • Enhanced filesystem and service isolation with ProtectSystem=strict, PrivateTmp=true, ProtectHome=true, PrivateDevices=true, ProtectKernelTunables=true, ProtectControlGroups=true.
    • Specified ReadWritePaths=/etc/traefik/acme.json /var/log/traefik/ to restrict read-write permissions to essential paths.
  • Configuration to run Traefik under the www-data user for improved security and compliance.

These enhancements are aimed at solidifying Traefik's deployment as a secure and reliable reverse proxy and load balancer on Ubuntu systems.

Can be enhanced to support other debian and ubuntu releases.

robertoberto avatar May 11 '24 22:05 robertoberto