MyAltBox LogoMyAltBox
Back to services

Traefik

现代化的 HTTP 反向代理和负载均衡器，简化微服务部署，支持自动服务发现和 SSL 证书管理

View alternatives to Traefik
Suggest edit
网页服务器
Open source
Self-hostable
MIT
Visit websiteSource repo
Sign in to rate
Recent reviews

Alternatives

Tech stack

View only
No tech stack tags have been added to this service yet
💡 Tip: Log in to suggest adding or changing tech stack tags

Traefik 是一个现代化的 HTTP 反向代理和负载均衡器，专为简化微服务和容器化应用的部署而设计。它支持自动服务发现、动态配置和自动 SSL 证书管理，是云原生架构的理想选择。

核心特性

自动服务发现

  • Docker 集成：自动发现和配置 Docker 容器
  • Kubernetes 支持：原生 Kubernetes Ingress 控制器
  • Consul/Etcd/Zookeeper：支持各种服务注册中心
  • 文件配置：支持静态文件配置
  • API 配置：通过 HTTP API 动态配置路由

自动 SSL 管理

  • Let's Encrypt 集成：自动申请和续期 SSL 证书
  • 通配符证书：支持通配符域名证书
  • 多 CA 支持：支持多个证书颁发机构
  • ACME 协议：完整的 ACME 协议支持
  • 证书存储：灵活的证书存储选项

负载均衡

  • 多种算法：支持轮询、最少连接、加权等算法
  • 健康检查：主动和被动健康检查
  • 熔断器：防止级联故障的熔断机制
  • 重试机制：请求失败时的智能重试
  • 粘性会话：支持会话保持

中间件系统

  • 认证中间件：Basic Auth、Digest Auth、Forward Auth
  • 限流中间件：请求速率限制和并发限制
  • 重定向中间件：HTTP 到 HTTPS 重定向
  • 压缩中间件：自动内容压缩
  • CORS 中间件：跨域资源共享配置
  • 自定义中间件：支持开发自定义中间件

技术架构

核心组件

  • 入口点 (EntryPoints)：定义 Traefik 监听的端口
  • 路由器 (Routers)：分析请求并决定处理方式
  • 服务 (Services)：定义如何访问实际服务
  • 中间件 (Middlewares)：调整请求和响应
  • 提供者 (Providers)：发现服务和配置信息

支持的协议

  • HTTP/HTTPS：标准 Web 协议
  • HTTP/2：高性能 HTTP 协议
  • TCP/UDP：原始 TCP 和 UDP 代理
  • gRPC：高性能 RPC 框架支持
  • WebSocket：实时通信协议

部署配置

Docker Compose 基础配置

version: '3.8'

services:
  traefik:
    image: traefik:v3.0
    container_name: traefik
    restart: unless-stopped
    command:
      # Docker 配置
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      
      # 入口点配置
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      
      # Let's Encrypt 配置
      - [email protected]
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
      
      # API 和仪表板
      - --api.dashboard=true
      - --api.insecure=false
      
      # 日志配置
      - --log.level=INFO
      - --accesslog=true
      
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"  # 仪表板端口
      
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
      - ./config:/etc/traefik
      
    labels:
      # 仪表板配置
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.service=api@internal"
      
      # 仪表板认证
      - "traefik.http.routers.dashboard.middlewares=dashboard-auth"
      - "traefik.http.middlewares.dashboard-auth.basicauth.users=admin:$$2y$$10$$..."
      
      # HTTPS 重定向
      - "traefik.http.routers.web-redirect.rule=HostRegexp(`{any:.*}`)"
      - "traefik.http.routers.web-redirect.entrypoints=web"
      - "traefik.http.routers.web-redirect.middlewares=web-redirect"
      - "traefik.http.middlewares.web-redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.web-redirect.redirectscheme.permanent=true"

  # 示例应用
  whoami:
    image: traefik/whoami
    container_name: whoami
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.example.com`)"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls=true"
      - "traefik.http.routers.whoami.tls.certresolver=letsencrypt"

静态配置文件 (traefik.yml)

# 入口点配置
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entrypoint:
          to: websecure
          scheme: https
          permanent: true
  websecure:
    address: ":443"

# 证书解析器配置
certificatesResolvers:
  letsencrypt:
    acme:
      email: [email protected]
      storage: /letsencrypt/acme.json
      httpChallenge:
        entryPoint: web
  
  # DNS 挑战配置（Cloudflare 示例）
  letsencrypt-dns:
    acme:
      email: [email protected]
      storage: /letsencrypt/acme-dns.json
      dnsChallenge:
        provider: cloudflare
        delayBeforeCheck: 30s
        resolvers:
          - "1.1.1.1:53"
          - "8.8.8.8:53"

# 提供者配置
providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: traefik
  
  file:
    directory: /etc/traefik/dynamic
    watch: true

# API 和仪表板
api:
  dashboard: true
  insecure: false

# 日志配置
log:
  level: INFO
  filePath: "/var/log/traefik/traefik.log"

accessLog:
  filePath: "/var/log/traefik/access.log"
  
# 指标配置
metrics:
  prometheus:
    addEntryPointsLabels: true
    addServicesLabels: true

# 全局配置
global:
  checkNewVersion: false
  sendAnonymousUsage: false

动态配置示例

# 中间件配置
http:
  middlewares:
    # 认证中间件
    auth:
      basicAuth:
        users:
          - "admin:$2y$10$..."
    
    # 限流中间件
    rateLimit:
      rateLimit:
        burst: 100
        average: 50
    
    # 安全头中间件
    securityHeaders:
      headers:
        customRequestHeaders:
          X-Forwarded-Proto: "https"
        customResponseHeaders:
          X-Frame-Options: "SAMEORIGIN"
          X-Content-Type-Options: "nosniff"
        sslRedirect: true
        sslHost: "example.com"
        sslForceHost: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
    
    # CORS 中间件
    cors:
      cors:
        accessControlAllowMethods:
          - GET
          - OPTIONS
          - PUT
          - POST
        accessControlAllowOriginList:
          - "https://example.com"
        accessControlMaxAge: 100
        addVaryHeader: true

  # 路由配置
  routers:
    api:
      rule: "Host(`traefik.example.com`)"
      tls:
        certResolver: letsencrypt
      middlewares:
        - auth
        - securityHeaders
      service: api@internal

  # 服务配置
  services:
    backend:
      loadBalancer:
        servers:
          - url: "http://192.168.1.100:8080"
          - url: "http://192.168.1.101:8080"
        healthCheck:
          path: "/health"
          interval: "30s"
          timeout: "3s"

# TCP 路由配置
tcp:
  routers:
    ssh:
      rule: "HostSNI(`*`)"
      entryPoints:
        - ssh
      service: ssh-service
  
  services:
    ssh-service:
      loadBalancer:
        servers:
          - address: "192.168.1.100:22"

高级功能

Kubernetes 集成

apiVersion: v1
kind: Service
metadata:
  name: traefik-service
spec:
  selector:
    app: traefik
  ports:
    - protocol: TCP
      port: 80
      name: web
    - protocol: TCP
      port: 443
      name: websecure
    - protocol: TCP
      port: 8080
      name: admin
  type: LoadBalancer

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: traefik-deployment
spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      containers:
      - name: traefik
        image: traefik:v3.0
        args:
          - --providers.kubernetescrd
          - --entrypoints.web.address=:80
          - --entrypoints.websecure.address=:443
        ports:
        - name: web
          containerPort: 80
        - name: websecure
          containerPort: 443
        - name: admin
          containerPort: 8080

服务网格集成

# Consul Connect 配置
providers:
  consulCatalog:
    endpoints:
      - "consul:8500"
    rootKey: "traefik"
    connectAware: true
    connectByDefault: true
    
# Jaeger 链路追踪
tracing:
  jaeger:
    samplingServerURL: "http://jaeger:14268/api/sampling"
    localAgentHostPort: "jaeger:6831"

插件系统

# 插件配置
experimental:
  plugins:
    geoblock:
      moduleName: "github.com/PascalMinder/geoblock"
      version: "v0.2.7"

# 插件使用
http:
  middlewares:
    geoblock:
      plugin:
        geoblock:
          silentStartUp: false
          allowLocalRequests: true
          logLocalRequests: false
          logAllowedRequests: false
          api: "https://get.geojs.io/v1/ip/country/{ip}"
          allowedCountries:
            - "US"
            - "CN"

监控与日志

Prometheus 指标

# Prometheus 配置
metrics:
  prometheus:
    addEntryPointsLabels: true
    addServicesLabels: true
    addMiddlewaresLabels: true
    addRoutersLabels: true
    buckets:
      - 0.1
      - 0.3
      - 1.2
      - 5.0

# Grafana 仪表板
# 导入官方仪表板 ID: 4475

结构化日志

log:
  level: INFO
  format: json
  filePath: "/var/log/traefik/traefik.log"

accessLog:
  format: json
  filePath: "/var/log/traefik/access.log"
  bufferingSize: 100
  filters:
    statusCodes:
      - "400-499"
      - "500-599"
    retryAttempts: true
    minDuration: "10ms"
  fields:
    defaultMode: keep
    names:
      ClientUsername: drop
    headers:
      defaultMode: keep
      names:
        User-Agent: redact
        Authorization: drop
        Content-Type: keep

性能优化

连接配置

# 连接池配置
serversTransport:
  insecureSkipVerify: false
  maxIdleConnsPerHost: 200
  dialTimeout: "30s"
  responseHeaderTimeout: "0s"
  idleConnTimeout: "90s"
  disableHTTP2: false

# 入口点配置
entryPoints:
  websecure:
    address: ":443"
    transport:
      lifeCycle:
        requestAcceptGraceTimeout: "10s"
        graceTimeOut: "10s"
    proxyProtocol:
      trustedIPs:
        - "127.0.0.1/32"
        - "192.168.1.0/24"

缓存配置

http:
  middlewares:
    cache:
      plugin:
        traefik-cache:
          ttl: "300s"
          vary:
            - "Accept-Encoding"
            - "Authorization"

安全配置

TLS 安全

tls:
  options:
    default:
      minVersion: "VersionTLS12"
      cipherSuites:
        - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
        - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
        - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
      sniStrict: true
      
  stores:
    default:
      defaultCertificate:
        certFile: "/etc/traefik/certs/default.crt"
        keyFile: "/etc/traefik/certs/default.key"

访问控制

http:
  middlewares:
    ipWhitelist:
      ipWhiteList:
        sourceRange:
          - "127.0.0.1/32"
          - "192.168.1.0/24"
          - "172.16.0.0/12"
    
    forwardAuth:
      forwardAuth:
        address: "http://authelia:9091/api/verify?rd=https://authelia.example.com"
        trustForwardHeader: true
        authResponseHeaders:
          - "Remote-User"
          - "Remote-Name"
          - "Remote-Groups"

故障排除

常见问题

  1. 证书申请失败

    • 检查 DNS 配置
    • 验证端口 80 可访问性
    • 确认邮箱地址有效

  2. 服务发现失败

    • 检查 Docker 标签配置
    • 验证网络连接
    • 确认 Traefik 有 Docker socket 访问权限

  3. 负载均衡问题

    • 检查后端服务健康状态
    • 验证负载均衡算法配置
    • 确认服务端口正确

调试技巧

# 启用调试日志
--log.level=DEBUG

# 检查配置
traefik version --format=json

# 查看路由信息
curl -s "http://localhost:8080/api/http/routers" | jq

# 健康检查
curl -s "http://localhost:8080/ping"

适用场景

微服务架构

  • API 网关：统一的服务入口
  • 服务发现：自动发现新服务实例
  • 负载均衡：智能流量分发
  • 熔断保护：防止级联故障

容器化部署

  • Docker 集成：无缝 Docker 支持
  • Kubernetes 原生：完整的 K8s 集成
  • 多环境支持：开发、测试、生产环境

传统应用现代化

  • 混合部署：新旧应用共存
  • 渐进式迁移：平滑的应用迁移
  • SSL 终端：统一的 SSL 管理

优势特点

相比传统反向代理

  • ✅ 自动服务发现，无需手动配置
  • ✅ 内置 SSL 证书管理
  • ✅ 现代化的 API 和仪表板
  • ✅ 丰富的中间件生态系统

相比云负载均衡器

  • ✅ 完全开源，无厂商绑定
  • ✅ 本地部署，数据完全可控
  • ✅ 自定义功能扩展
  • ✅ 无使用限制和费用

Traefik 是现代化应用架构的理想选择，特别适合需要自动化、可扩展和易于管理的反向代理解决方案。其强大的功能集和云原生设计使其成为微服务和容器化应用的完美伴侣。

Discover more

Nginx Proxy Manager Logo

Nginx Proxy Manager

简单易用的 Nginx 代理管理界面，支持反向代理、SSL 证书管理等功能

反向代理
SSL
+2
Aastro Logo

Aastro

Extensible API Gateway written in Go. Load custom plugins to extend functionality.

Apache-2.0
Go
+1
Algernon Logo

Algernon

Small self-contained pure-Go web server with Lua, Markdown, HTTP/2, QUIC, Redis and PostgreSQL support.

BSD-3-Clause
Go
+1
Answer Logo

Answer

Knowledge-based community software. You can use it to quickly build your Q&A community for product technical support, customer support, user communication, and more.

Apache-2.0
Docker
+1
Anubis Logo

Anubis

Weighs the soul of incoming HTTP requests to stop AI crawlers

MIT
Docker
+2
AnyCable Logo

AnyCable

Realtime server for reliable two-way communication over WebSockets, Server-sent events, etc.

MIT
Go
+1