Deploy Traefik on Northflank to proxy microservices

In this guide, you will learn how to use Traefik proxy to route 2 Northflank services on a single domain.

By default, Northflank operates everything you would normally need to deploy your infrastructure. Load-balancing, routing, TLS, DNS, basic HTTP & IP based authentication, service mesh, and so on. But sometimes you may still need more control – and using a service like Traefik proxy allows you to configure and deliver your own HTTP gateway.

For the sake of this guide, we will deploy 2 services: web and api. These services do nothing more than run a basic HTTP server and respond with a message when we GET /, using the strm/helloworld-http Docker image.

When creating your microservices, make sure that public networking is disabled on your ports.

We can imagine these to be our applications front-end and API services. If we want to route traffic to both of these services on the same domain, we can use Traefik to set up routing as follows:

• example.com/api/* -> API service
• example.com/* -> web service

In this case, any traffic to /api/* will be routed to our API service, and any other traffic will be routed to our web service.

The next thing we need to do is create our Traefik service. Create a new service, select deployment, and enter traefik:v2.9 as the image path.

Port 80 will be detected automatically and added to your ports configuration. Leave this port public.

Create the service. It will not do anything yet, next we need to configure it.

Navigate to your newly created Traefik service, click 'Environment', and add a 'secret file'. Secret files are files that will be injected into your services when they run.

In the path field, enter /config/traefik.yml. This is the path where the file will be available inside your running containers.

Now, we need to enter our configuration.

traefik.yml

http:
  services:
    api:
      loadBalancer:
        servers:
          - url: http://api:80
    web:
      loadBalancer:
        servers:
          - url: http://web:80

  routers:
    api:
      service: api
      entryPoints:
        - main
      rule: "PathPrefix(`/api`)"
      middlewares:
        - removeApiPrefix
        - apiHostHeaderSet
    web:
      service: web
      entryPoints:
        - main
      rule: "PathPrefix(`/`)"
      middlewares:
        - webHostHeaderSet

  middlewares:
    removeApiPrefix:
      stripPrefix:
        prefixes:
          - /api
    webHostHeaderSet:
      headers:
        customRequestHeaders:
          Host: "web"
    apiHostHeaderSet:
      headers:
        customRequestHeaders:
          Host: "api"

This configuration file does 3 things:

1. Defines services

   The names of these services do not necessarily have to match the names of our Northflank services, but it may help to keep them related. Each service has a URL property, which must be set to the private networking address of the corresponding Northflank service, which can be found on the Northflank dashboard.

   

2. Defines routers

   Again, the names of the routers here do not have to match the names of either the Traefik services, or the corresponding Northflank services. However each router has a service property, which does need to be the name of a Traefik service defined in the section above. Routers also define rules, and reference any middleware that should apply. In this case, we create a PathPrefix rule on each router containing the path we would like each one to match. We also reference some middleware, which we define next.

3. Defines middleware

   The names of these middlewares should match how we referenced them in our router definitions. We create 3 middlewares here:

   • The webHostHeaderSet and apiHostHeaderSet middlewares which set the Host header for both our web and API services, respectively. For the routing to work properly on Northflank, the Host header here must be set to just the name part of the Northflank services private address – omitting the protocol and the port.
   • The removeApiPrefix middleware that contains a stripPrefix instruction. This is only referenced on the API service router, and serves to remove the /api part of the pathname before requests reach your API service. This means you do not need to include /api in your routes when designing and building your actual API service.

You can read more about services, routers and middleware in the Traefik docs.

Next, we need to override the default command to tell the Traefik service to pick up our config file.

Still within your Traefik service, navigate to 'CMD override' and set the CMD override value to:

traefik --providers.file=true --providers.file.filename=/config/traefik.yml --entrypoints.main.address=:80

This tells Traefik to use a config file, where to find it, and to create the main entrypoint we referenced in the config file on port 80.

With everything configured, you are good to go! Navigate to the public endpoint on your Traefik service and try hitting / and /api – you should get a different response from each.