Need help with Traefik setup

[pablomalo]

Hi all, I am blown away by the quality of the documentation for this project and would love to install it on a VPS I am currently setting up.

I've been using Traefik as a reverse proxy to the various Dockerized services that are running. (I must admit I'm something of a n00b at networking and have proceeded through a lot of copy-paste and trial-and-error. Some of those Traefik labels on the docker-compose.yml file remain a little opaque).

I haven't had any success with Dashy, however. Something seems to have worked since Traefik has indeed registered the route to the virtual host and obtained the necessary SSL certificate, as the following screenshot tends to prove.

However when I try to connect to the host, I get a gateway timeout. Watching the container logs, Dashy itself is up and running, error-free.

Below is my docker-compose.yml.

version: "3"

networks:
  proxynet:
    external: true
    
services:
  dashy:
    image: lissy93/dashy:2.1.0
    container_name: dashy
    hostname: dashy
    volumes:
      - ./conf.yml:/app/public/conf.yml
      - ./item-icons:/app/public/item-icons
    # Set any environmental variables
    env_file: .env
    restart: unless-stopped
    # Configure healthchecks
    healthcheck:
      test: ['CMD', 'node', '/app/services/healthcheck']
      interval: 1m30s
      timeout: 10s
      retries: 3
      start_period: 40s
    labels:
      - 'traefik.enable=true'
      - 'traefik.docker.network=proxynet'
      - 'traefik.http.routers.dashy.rule=Host(`${HOSTNAME}`)'
      - 'traefik.http.routers.dashy.entrypoints=websecure'
      - 'traefik.http.routers.dashy.tls.certResolver=letsEncrypt'
      - 'traefik.http.routers.dashy.tls=true'
      # Labels below copied from https://github.com/Lissy93/dashy/blob/master/docs/management.md#traefik
      - 'traefik.http.middlewares.sslHeader.headers.customRequestHeaders.X-Forwarded-Proto=https'
      - 'traefik.http.middlewares.testHeader.headers.accessControlAllowMethods=GET,OPTIONS,PUT'
      - 'traefik.http.middlewares.testHeader.headers.accessControlAllowOriginList=https://${HOSTNAME}'
      - 'traefik.http.middlewares.testHeader.headers.accessControlMaxAge=100'
      - 'traefik.http.middlewares.testHeader.headers.addVaryHeader=true'

Has anyone had more luck with this kind of setup?

[Lissy93]

I wish I knew more about Traefik to be able to help 🙁
I know that it's definitely possible, as I've seen others using it, so hopefully someone else can weigh in with some advice

[BoW2EviL]

I'm beat my head three days trying to get this to work with traefik.
For some reason it doesn't like the internal ports for forwarding the
vue traffic?? In all the applications I've forwarded with traefik I've
never ran into one that would sporadically work correctly. No logs
would be triggered no errors happen? I was just about to give up. And
I figured I would test something before I did. In my home lab I have
traefik forward to other servers so I figured I would try some more
configs. And wouldn't you know it it works flawless for me. Hopefully
this will help others as I see little to no documentation over this
issue with traefik.

So instead of trying to port forward. Use url forward instead. And use
the url directly with port. I don't know if this will work with 127...
Or 172... But I don't see why not. I already have mine exposed
locally to the network so I just used the IP and port I would normally
access dashy with.. ie "192.168.0.10:4000 [1]"

I'm not experienced enough to explain to you why this happens with
this Vue stuff but here's the fix i suggest.

THIS FAILS
labels:
  - 'traefik.enable=true'
  - 'traefik.http.routers.dashy.rule=Host(`${HOSTNAME}`)'
  - "traefik.http.routers.dashy.service=dashy-svc"
  - "traefik.http.services.dashy-svc.loadbalancer.server.url=http://192.168.0.10:4000"

lol after testing it... it failed.... lol ok.. no matter where i put it?!?
i know i got the url forward to work in the lables in the past?
maybe traefik is waiting for some responce from the docker container?
so to recap using the "labels" I could not create a router to fwd traffic using the URL or PORTS.
i did mention eairly i was pulling my hair out over this and thought Wow i Fixed it LOL ....
ill do a Quick rightup... ya right who was i kidin.

So heres what fixed it for me. start by removing the label from your docker-compose.yml
dashy entry or use the trafik disable labels this should disable traefik from looking
for the containers status. Make sure you have traefiks file providers directory setup.

traefik:
  container_name: traefik
  image: traefik:2.5
  command: # CLI arguments
    - --providers.file.directory=/rules
  ...
  
dashy:
  image: lissy93/dashy:latest
  ports:
   - "4000:80"  ### note 4000 is the external port. i have not tried this with "expose: 80" for internal forwarding should work as long as traefik can get to it 
  ...
  labels:
    - "traefik.enable=false"

then using the /rules directory add a yml file like this

http:
  routers:
    dashy-router:
      rule: "Host(`dashy.io`)"
      entryPoints:
        - https
      #middlewares:
      #  - ??? what ever you use it even works with none
      service:
        - dashy-svc
  services:
    dashy-svc:
      loadBalancer:
        servers:
          - url: "http://192.168.0.10:4000"  ### i dont know if something like http://dashy:4000 would work? should though.

you can also combine this with a oauth proxy and dns-server to use ssl for internal and external traffic with the same domain.name.
you can then bypass internal traffics oauth checks. see here for how to seperate traefik internal from external
https://community.traefik.io/t/traefik-v2-simple-trick-to-bypass-basic-auth/2012
im not going into how to setup a local dns-server here but it can be done.

my next step will be to try to connect dashy to keycloak to remove the oauth proxy, for some more hair pulling Fun!!!

hope this helps somebody else from going bald. happy hacking
thankyou @Lissy93 for such a great project

[Lissy93]

Thank you for sharing that!!
I am going to link to this in the docs...

I really should know why the port forwarding method does not work, and be able to provide a fix. But currently I'm just not sure what's causing it 😳 I initially thought a quirk with Vue, but it could actually be something I'm doing wrong in the Dockerfile.
When I've finished version 2.1.2 I'm going to setup Traefik in my lab, and hopefully then I'll get a better insight.

Btw, the KeyCloak stuff might be easier if you wait for 2.1.2. It will include a complete refactor of how config is loaded and managed (Re #799). But it'll still be backwards compatible, so doing it now and updating later will work too.

[BoW2EviL]

this was the only suggestion i could find but it didn't help me vary much
https://community.traefik.io/t/javascript-vue-js-app-behind-traefik-v2-0/1874/12

I had to add the rule with loadbalancer service and also create a vue.config.js file (at the same level as the package.json file) with the following content:

module.exports = {
    devServer: {
        public: 'frontend.service.localhost',
        port: 80,
        compress: true,
    }
}

Maybe there is way to do it without the vue.config.js file. if so that would be great, since I don't won't to have that suff configured in the app

which lead me to believe that vue is rejecting a random domain name proxy request.
but if it can be done with caddy then is it vue actually rejecting? I don't think this is the case any more.

I believe traefik is waiting for a status update that other servers do but vue does not.
your comments about "hash vs history" make me think that traefik believes your healthy container is still booting or broken.
From looking at the debug logs in traefik it dose not even attempt to route the traffic,
or at least it does not show it attempting to communicate with the container via the logs.

for example if I attempt to goto a url NOT defined in traefik, traefik shows the attempt to locate somewhere to send it then 404s
any url I set dashy to, would not show up on ANY log just 404s instantly without a log entry.

the several times I did get it to work it was only after touching the ip:4000 first, then to goto the domain.
in these cases there were log entries but I didnt have debugging on.
and NO MATTER WHAT I DID i could never get it to show the initializing page ONLY after it initialized the home page.
and i could have worked with that BUT... it only worked with the first couple of links i made within the app.
I then added a bunch of links to the conf file and i was never able to get traefik to work again.....
I almost gave up..

that's the reason i wrote the right up. I figured the lack of documentation on traefik means many others also gave up.
I probably would not have wrote it. but I seen how engaged you seemed to be and couldn't help myself but want to help you.
This was my first write up so i hope it wasn't too bad, or too Long LoL.

[malheleco]

Thanks a lot for these insights! I just faced the same problem with the gateway timeout.
In my case, I realized that traefik did not join the docker network that dashy created and after manually joining it, dashy started working via the domain I configured for it in traefik.
I coulnd't find out though why it didn't connect to the network as my docker-compose file requests that it should.

[Bloopps]

Thank you for sharing that!!
I am going to link to this in the docs...

I really should know why the port forwarding method does not work, and be able to provide a fix. But currently I'm just not sure what's causing it 😳 I initially thought a quirk with Vue, but it could actually be something I'm doing wrong in the Dockerfile.
When I've finished version 2.1.2 I'm going to setup Traefik in my lab, and hopefully then I'll get a better insight.

Btw, the KeyCloak stuff might be easier if you wait for 2.1.2. It will include a complete refactor of how config is loaded and managed (Re #799). But it'll still be backwards compatible, so doing it now and updating later will work too.

@Lissy93 Were you able to find anything to fix the problem?

[schewara]

If it helps, here my docker-compose template snippet, without the need to touch all the traefik.yml and dynamic configuration parts

        ...
        image: "{{ dashy_image }}"
        volumes:
          - "{{ dashy_basedir }}/config/conf.yml:/app/public/conf.yml:ro"
          - "{{ dashy_basedir }}/config/item-icons:/app/public/item-icons:ro"
        environment:
          - NODE_ENV=production
        labels:
          - "traefik.enable=true"
          - "traefik.docker.network={{ dashy_network }}"
          - "traefik.http.services.dashy.loadbalancer.server.port=80"
          - "traefik.http.routers.dashy.entrypoints=https"
          - "traefik.http.routers.dashy.rule=Host(`{{ dashy_hostname }}`)"
          - "traefik.http.routers.dashy.service=dashy"
          # - "traefik.http.routers.dashy.middlewares=dashy"
          # - "traefik.http.middlewares.dashy.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
          # - "traefik.http.middlewares.dashy.headers.accesscontrolalloworiginlist=https://keycloak.my.tld"
          # - "traefik.http.middlewares.dashy.headers.accesscontrolmaxage=100"
          # - "traefik.http.middlewares.dashy.headers.addvaryheader=true"
        networks:
          - "{{ dashy_network }}"
        healthcheck:
          test: ['CMD', 'node', '/app/services/healthcheck']
          interval: 1m
          timeout: 10s
          retries: 3
          start_period: 30s
        expose:
          - 80
        ...

[ZanzyTHEbar]

I am having this same exact issue - the solution here did not help me. I am still getting the gateway timed-out error.

I can confirm that going to the local IP address and port Dashy loads and works as expected. With traefik - it does not. A shame - as i am a big fan of both services.

[hubortje]

Had anybody had a solution in the meantime? 😅
Having the same problem, the proposed solution did not work out for me.

[JScharloo]

Hello @hubortje .

After some time of tinkering myself I have got Dashy running with Traefik. I battled multiple issues, including Bad Gateway: connection refused & connection timeout. With the following compose file I have my setup running successfully:

version: "3.8"
services:
  dashy:
    image: lissy93/dashy
    container_name: dashy
    volumes: 
      - /config/dashy/conf.yml:/app/public/conf.yml
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 4000:80
    environment:
      - NODE_ENV=production
    # Specify your user ID and group ID. You can find this by running `id -u` and `id -g`
    #  - UID=[***Your UID***]
    #  - GID=[***Your GUID***]
    restart: unless-stopped
    networks:
      - [***Your Traefik Network***]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashy.entryPoints=[***Your Traefik HTTPS Entrypoint***]"
      - "traefik.http.routers.dashy.tls.certResolver=[***Your Traefik Resolver***]"
      - "traefik.http.routers.dashy.rule=Host(`[***Your Domain Name***]`)" # Edit here to change to your domain name
      #- "traefik.http.services.dashy.loadbalancer.server.url=`http://dashy`" # Not needed, but for your insight into alternative method using docker internal DNS
      - "traefik.http.services.dashy.loadbalancer.server.port=80"
      - "traefik.docker.network=[***Your Traefik Network***]"

      - 'traefik.http.routers.dashy.middlewares=dashy-mw'
      - "traefik.http.middlewares.dashy-mw.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
      - "traefik.http.middlewares.dashy-mw.headers.accesscontrolalloworiginlist=[***Your Domain Name or Wildcard***]"
      - "traefik.http.middlewares.dashy-mw.headers.accesscontrolmaxage=100"
      - "traefik.http.middlewares.dashy-mw.headers.addvaryheader=true"
    healthcheck:
      test: ['CMD', 'node', '/app/services/healthcheck']
      interval: 2m10s
      timeout: 10s
      retries: 3
      start_period: 5s

networks:
    [***Your Traefik Network***]:
        external: true
        driver: bridge

Note that Traefik does not parse the labels until the container goes to 'Healthy' state. In this case after 2 minutes and 15 seconds.

Hope this helps!

[hubortje]

@JScharloo this solved it perfectly.
First try worked directly out of the box. Thank you very much.

Would you mind documenting this? Even a few notes would suffice, so I could write a text for the documentation?

[APoniatowski]

interesting how something as simple as the changing the interval, can make such a big difference