crasivo/traefik repository overview

⁠🚢 Traefik Proxy

Hardened rootless Traefik image built on Alpine Linux with automated local PKI/OpenSSL generation and runtime config macro bootstrapping.

This image is designed for secure local development and production web application routing, running entirely without root privileges (uid:gid 1000:1000).

👉 GitHub Repository & Full Configuration Guides: github.com/crasivo/traefik-compose⁠

⁠🔥 Key Features

• Strict Rootless Security: The container runs under an unprivileged traefik user (UID/GID 1000), eliminating host takeover risks via container escape.
• Automated Local PKI: Generates a full custom Local Certificate Authority (Root CA) and valid SSL certificates on the fly at startup (supporting localhost, fallbacks, and custom wildcard domains via env).
• Hardened Alpine Base: Lightweight, minimal attack surface, built on top of the latest Alpine Linux.
• Flexible Modes: Supports both Docker Socket API routing and network-isolated TCP provider mapping.

⁠🚀 Quick Start Example

To use this image via docker-compose.yml with secure socket proxying, you can use the following minimal blueprint:

name: traefik

services:
  traefik:
    image: crasivo/traefik:latest
    container_name: traefik
    restart: always
    deploy:
      resources:
        limits:
          cpus: 0.5
          memory: 1G
    environment:
      - "TRAEFIK_PROVIDERS_DOCKER_ENDPOINT=unix:///var/run/docker.sock"
      - "TRAEFIK_PROVIDERS_DOCKER_NETWORK=${TRAEFIK_PUBLIC_NETWORK:-traefik_public}"
      - "VIRTUAL_HOST=${TRAEFIK_PUBLIC_HOST:-traefik.docker}"
    hostname: "${TRAEFIK_PUBLIC_HOST:-traefik.docker}"
    networks:
      public:
        aliases:
          - "${TRAEFIK_PUBLIC_HOST:-traefik.docker}"
    ports:
      - "80:80"   # HTTP
      - "443:443" # HTTPS
    volumes:
      - ./volumes/traefik_config:/etc/traefik
      - ./volumes/traefik_certs:/opt/docker/share/openssl
      - /var/run/docker.sock:/var/run/docker.sock:ro
    healthcheck:
      test: [ "CMD", "/usr/local/bin/traefik", "healthcheck", "--ping" ]
      interval: 10s
      timeout: 2s
      retries: 3
      start_period: 5s
    labels:
      - "traefik.enable=true"
      # Route: HTTPS
      - "traefik.http.routers.traefik-api-https.rule=Host(`${TRAEFIK_PUBLIC_HOST:-traefik.docker}`)"
      - "traefik.http.routers.traefik-api-https.entryPoints=https"
      - "traefik.http.routers.traefik-api-https.tls=true"
      - "traefik.http.routers.traefik-api-https.service=api@internal"

networks:
  public:
    external: true
    name: "${TRAEFIK_PUBLIC_NETWORK:-traefik_public}"

Note for Podman/RHEL users: Remember to swap the host socket path to your runtime user space directory (/run/user/1000/podman/podman.sock) and append the :z or :Z flags for SELinux compliance.

⁠🔐 Local SSL / Certificate Authority (PKI)

At every startup, the built-in openssl-generate.sh script automatically provisions a custom Crasivo Root CA alongside valid dynamic wildcard SSL certificates.

⁠How to Trust Your Local Root CA

To get a "green lock" in your browser and avoid SSL Handshake Error warnings in your terminal, copy the generated root certificate from the container's mounted volume (/etc/traefik/certs/root/certificate.pem) and add it to your host machine trust store:

• macOS: Double-click certificate.pem -> Add to Keychain Access -> Set to Always Trust.
• Windows: Install certificate -> Choose Local Machine -> Place strictly in Trusted Root Certification Authorities.
• Linux (Ubuntu/Debian): Copy to /usr/local/share/ca-certificates/Crasivo_Root_CA.crt and run sudo update-ca-certificates.
• Browsers (Chrome/Firefox): Import certificate.pem manually via Settings -> Certificates -> Authorities.

⁠💡 Advanced Configurations

For detailed guides regarding:

1. TCP Rootless mode (Complete isolation from host filesystem via TCP port 2375).
2. Enterprise RHEL / AlmaLinux / Podman setup (Handling SELinux blocks, Linger states, and systemd user services).
3. **Automated local DNS routing via dnsmasq**.

Please refer to the detailed documentation and scripts available in the original source code repository.

🔗 Documentation & Source: crasivo/traefik-compose⁠

📜 License: MIT⁠