在 Traefik Proxy 2.5 中使用/开发私有插件(Traefik 官方博客)

# Dockerfile.demo - Example for Traefik Proxy and a demo plugin from git:FROM alpine:3ARG PLUGIN_MODULE=github.com/traefik/plugindemoARG PLUGIN_GIT_REPO=https://github.com/traefik/plugindemo.gitARG PLUGIN_GIT_BRANCH=masterRUN apk add --update git && \
    git clone ${PLUGIN_GIT_REPO} /plugins-local/src/${PLUGIN_MODULE} \
      --depth 1 --single-branch --branch ${PLUGIN_GIT_BRANCH}FROM traefik:v2.5COPY --from=0 /plugins-local /plugins-local

docker build -f Dockerfile.demo --tag traefik-with-demo-plugin .

docker run --rm -it traefik-with-demo-plugin \
  --log.level=DEBUG \
  --experimental.localPlugins.demo.moduleName=github.com/traefik/plugindemo

## Create temporary variables for your plugin and git repository details:## Optionally save these to build-env.sh and run "source build-env.sh" after.export DOCKER_IMAGE=traefik-with-my-pluginexport PLUGIN_MODULE=github.com/YOUR_NAME/YOUR_REPOSITORYexport PLUGIN_GIT_REPO=https://github.com/YOUR_NAME/YOUR_REPOSITORY.gitexport PLUGIN_GIT_BRANCH=master

## Dockerfile.public - Bundle a Traefik plugin from a public git repositoryFROM alpine:3ARG PLUGIN_MODULE=github.com/traefik/plugindemoARG PLUGIN_GIT_REPO=https://github.com/traefik/plugindemo.gitARG PLUGIN_GIT_BRANCH=masterRUN apk update && \
    apk add git && \
    git clone ${PLUGIN_GIT_REPO} /plugins-local/src/${PLUGIN_MODULE} \
      --depth 1 --single-branch --branch ${PLUGIN_GIT_BRANCH}FROM traefik:v2.5COPY --from=0 /plugins-local /plugins-local

docker build -f Dockerfile.public \
  --tag ${DOCKER_IMAGE} \
  --build-arg PLUGIN_MODULE \
  --build-arg PLUGIN_GIT_REPO \
  --build-arg PLUGIN_GIT_BRANCH .

## Optionally save these to build-env.sh and run "source build-env.sh" after.## Docker BuildKit is required for ssh-agent forwarding:export DOCKER_BUILDKIT=1## Edit these variables for your plugin and git repository:export DOCKER_IMAGE=traefik-with-my-pluginexport PLUGIN_MODULE=github.com/YOUR_NAME/YOUR_REPOSITORYexport PLUGIN_GIT_REPO=git@github.com:YOUR_NAME/YOUR_REPOSITORY.gitexport PLUGIN_GIT_BRANCH=master

# syntax=docker/dockerfile:1.0.0-experimental# The above line is required to turn on experimental BuildKit features.# Dockerfile.private - Build Traefik and plugin from a private git repository.# Loads SSH keys from the host `ssh-agent` to allow git clone.FROM alpine:3# Clone your plugin git repositories:ARG PLUGIN_MODULE=github.com/traefik/plugindemo
ARG PLUGIN_GIT_REPO=git@github.com:traefik/plugindemo.git
ARG PLUGIN_GIT_BRANCH=master
RUN apk add --update git openssh && \
    mkdir -m 700 /root/.ssh && \
    touch -m 600 /root/.ssh/known_hosts && \
    ssh-keyscan github.com > /root/.ssh/known_hosts
RUN --mount=type=ssh git clone \
    --depth 1 --single-branch --branch ${PLUGIN_GIT_BRANCH} \    ${PLUGIN_GIT_REPO} /plugins-local/src/${PLUGIN_MODULE} 
    FROM traefik:v2.5
COPY --from=0 /plugins-local /plugins-local

docker build -f Dockerfile.private \
  --ssh default --tag ${DOCKER_IMAGE} \
  --build-arg PLUGIN_MODULE \
  --build-arg PLUGIN_GIT_REPO \
  --build-arg PLUGIN_GIT_BRANCH .

FROM traefik:v2.5## Default module name (put your setting in .env to override)ARG PLUGIN_MODULE=github.com/traefik/plugindemo
ADD . /plugins-local/src/${PLUGIN_MODULE}

## Traefik Proxy local plugin .env file## Configure your plugin name:PLUGIN_NAME=demo## Configure your module namespace:PLUGIN_MODULE=github.com/traefik/plugindemo## Configure whoami domain name for route testing:WHOAMI_TRAEFIK_HOST=whoami.example.com## Configure Email address for Let's Encrypt:## Uncomment and configure this for production only:# ACME_CA_EMAIL=you@example.com

# docker-compose.yaml for Traefik Proxy local plugin developmentversion: "3.3" networks: traefik-proxy: volumes: traefik-proxy:
services:
  traefik-proxy:
    build:
      context: .
      args:
        PLUGIN_MODULE: ${PLUGIN_MODULE}
    restart: unless-stopped
    networks:
    - traefik-proxy
    security_opt:
    - no-new-privileges:true
    command:    #- "--log.level=DEBUG"
    - "--providers.docker=true"
    - "--providers.docker.exposedbydefault=false"
    - "--providers.docker.network=traefik-proxy"
    ## Entrypoints:
    - "--entrypoints.web.address=:80"
    - "--entrypoints.websecure.address=:443"
    - "--entrypoints.traefik.address=:9000"
    ## Automatically redirect HTTP to HTTPS
    - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
    ## ACME TLS config:
    - "--certificatesresolvers.default.acme.storage=/data/acme.json"
    ## Uncomment for production TLS certificates (Let's Encrypt):
    # - "--certificatesresolvers.default.acme.tlschallenge=true"
    # - "--certificatesresolvers.default.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
    # - "--certificatesresolvers.default.acme.email=${ACME_CA_EMAIL}"
    ## Enable Dashboard available only from the docker localhost:9000
    - "--api.dashboard=true"
    - "--api.insecure=true"
    ## Enable local plugins:
    - "--experimental.localPlugins.${PLUGIN_NAME}.moduleName=${PLUGIN_MODULE}"
    ports:
    - "80:80"
    - "443:443"
    - "127.0.0.1:9000:9000"
    volumes:
    - "traefik-proxy:/data"
    - "/var/run/docker.sock:/var/run/docker.sock:ro"
  ## The whoami container will run the demo plugin for testing purposes:
  whoami:
    image: traefik/whoami
    networks:
      - traefik-proxy
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`${WHOAMI_TRAEFIK_HOST}`)"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      # Configure the plugin as a new middleware:
      - "traefik.http.routers.whoami.middlewares=whoami-demo"
      # Add a test header to all incoming requests:
      # (the presense of this header in whoami response shows if the plugin works:)
      - "traefik.http.middlewares.whoami-demo.plugin.${PLUGIN_NAME}.headers.DoesPluginWork=YES"
      - "traefik.http.routers.whoami.tls.certresolver=default"

# .dockerignore file exludes files from the image:.git

docker-compose up

# ... excerpt from /etc/hosts# Domain names for Traefik:# Point to the IP address of your docker server:127.0.0.1 whoami.example.com app1.example.com app2.example.com

curl -k https://whoami.example.com

Doespluginwork: YES

# /etc/dnsmasq.conf# Use this if you are tired of editing your /etc/hosts file.# This is a local DNS service bound only to the looback device on localhost.# To use this requires an /etc/resolv.conf file # with a single line (no leading space): nameserver 127.0.0.1# To prevent any changes to the host DNS config,# run: sudo chattr +i /etc/resolv.conf#      (now all of your DNS queries will go through dnsmasq)interface=lo
listen-address=::1,127.0.0.1
bind-interfaces
cache-size=1000# Use cloudflare upstream DNS servers:server=1.1.1.1
server=1.0.0.1# Example wildcard domain names# All *.example.com names point to a single docker server IP address:address=/example.com/127.0.0.1# dnsmasq also loads your /etc/hosts file, so those host names still work.

sudo systemctl enable --now dnsmasq.service

domain your.domain.example.com
search domain.example.com
nameserver 127.0.0.1

# This prevents editing the file, use -i to re-enable editing:chattr +i /etc/resolv.conf

# dig or drill:dig test.example.com | grep -A1 "ANSWER SECTION"# or nslookup:nslookup test.example.com