Dmitriy Shesterkin mitrofun

Adding trusted root certificates to the server

Mac OS X

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/new-root-certificate.crt
sudo security delete-certificate -c "<name of existing certificate>"

Windows

certutil -addstore -f "ROOT" new-root-certificate.crt

Traefik and Portainer on Docker Swarm with Letsencrypt

Reproducing a Traefik with SSL and Portainer setup on a 2 Node Docker Swarm

Install Docker:

Install Docker on both nodes with a Bootstrap Script:

$ curl https://gitlab.com/rbekker87/scripts/raw/master/setup-docker-ubuntu.sh | bash

Deploying Traefik using forward proxy mode with Authentik

This is an example guide how to deploy Authentik with Traefik in forward auth proxy mode - that means that any application behind the proxy will be automatically authenticated by Traefik. This allows better reuse of code and completely moves user management to Traefik & Authentik.

In this guide we use custom DNS to make the requests nicer and to show that it works with DNS. So step #1 is to put following records to your /etc/hosts (for example by sudo nano /etc/hosts and adding these values)

	# https://hakibenita.com/how-to-turn-django-admin-into-a-lightweight-dashboard

	from django.contrib import admin
	from django.db.models import Count, Sum, Min, Max, DateTimeField
	from django.db.models.functions import Trunc

	from . import models


	def get_next_in_date_hierarchy(request, date_hierarchy):


	@register.inclusion_tag('admin/submit_line.html', takes_context=True)
	def submit_row(context):
	"""
	Displays the row of buttons for delete and save.
	"""
	ctx = original_submit_row(context)
	ctx.update({
	'show_save_and_add_another': context.get('show_save_and_add_another', ctx['show_save_and_add_another']),
	'show_save_and_continue': context.get('show_save_and_continue', ctx['show_save_and_continue']),

	def normalise_environment(key_values):
	''' Converts denormalised dict of (string -> string) pairs, where the first string
	is treated as a path into a nested list/dictionary structure

	{
	"FOO__1__BAR": "setting-1",
	"FOO__1__BAZ": "setting-2",
	"FOO__2__FOO": "setting-3",
	"FOO__2__BAR": "setting-4",
	"FIZZ": "setting-5",

	version: '3'
	services:
	traefik:
	restart: unless-stopped
	image: traefik:v2.0.2
	ports:
	- "80:80"
	- "443:443"
	labels:
	- "traefik.http.services.traefik.loadbalancer.server.port=8080"

	#!/usr/bin/env bash
	set -euo pipefail
	IFS=$'\n\t'

	DOMAIN_NAME=$1

	openssl req \
	-newkey rsa:2048 \
	-x509 \
	-nodes \

	# Tutorial: https://blog.creekorful.com/2020/01/how-to-expose-traefik-2-dashboard-securely-docker-swarm/
	version: '3'

	services:
	reverse-proxy:
	image: traefik:2.3
	command:
	# - '--log.level=DEBUG'
	- '--api=true'
	- '--api.dashboard=true'

	version: '3'

	services:
	traefik:
	image: traefik:v2.0.0
	command:
	- --api.insecure=false # set to 'false' on production
	- --api.dashboard=true # see https://docs.traefik.io/v2.0/operations/dashboard/#secure-mode for how to secure the dashboard
	- --api.debug=true # enable additional endpoints for debugging and profiling
	- --log.level=DEBUG # debug while we get it working, for more levels/info see https://docs.traefik.io/observability/logs/