Traefik云原生反向代理配置与自动HTTPS证书管理实战

Traefik是专为云原生环境设计的HTTP反向代理和负载均衡器，原生支持Docker、Kubernetes、Consul等服务发现后端。与Nginx的手动配置reload不同，Traefik通过监听编排平台API实现动态路由更新，配合Let’s Encrypt集成可全自动签发和续期TLS证书。

Traefik架构设计与动态配置机制

Traefik的核心架构包含三个层次：Entrypoints（入口监听端口）、Routers（路由规则匹配）和Services（后端服务负载均衡）。配置来源分为静态配置（启动参数或traefik.yml）和动态配置（provider实时推送）。

静态配置示例：

# traefik.yml - 静态配置
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"
    http:
      tls:
        certResolver: letsencrypt
        domains:
          - main: "app.example.com"
          - main: "api.example.com"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: "web"
  file:
    filename: "/etc/traefik/dynamic.yml"

certificatesResolvers:
  letsencrypt:
    acme:
      email: "admin@example.com"
      storage: "/acme.json"
      httpChallenge:
        entryPoint: web

api:
  dashboard: true
  insecure: false

accessLog: {}

metrics:
  prometheus: {}

Docker Compose部署Traefik与容器自动路由

Traefik通过Docker provider自动发现容器并生成路由规则。容器通过labels声明路由配置，无需手动维护反向代理配置文件。

# docker-compose.yml
services:
  traefik:
    image: traefik:v3.1
    command:
      - "--configFile=/etc/traefik/traefik.yml"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./acme.json:/acme.json
      - ./dynamic.yml:/etc/traefik/dynamic.yml:ro
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$xxx"

  nginx-app:
    image: nginx:alpine
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nginx.rule=Host(`app.example.com`)"
      - "traefik.http.routers.nginx.entrypoints=websecure"
      - "traefik.http.routers.nginx.tls.certresolver=letsencrypt"
      - "traefik.http.services.nginx.loadbalancer.server.port=80"
      - "traefik.http.routers.nginx.middlewares=rate-limit,compress"

  api-server:
    image: myapi:latest
    deploy:
      replicas: 3
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`api.example.com`) && PathPrefix(`/v1`)"
      - "traefik.http.routers.api.entrypoints=websecure"
      - "traefik.http.routers.api.tls.certresolver=letsencrypt"
      - "traefik.http.services.api.loadbalancer.server.port=3000"
      - "traefik.http.services.api.loadbalancer.healthcheck.path=/health"
      - "traefik.http.services.api.loadbalancer.healthcheck.interval=10s"
      - "traefik.http.services.api.loadbalancer.healthcheck.timeout=3s"

networks:
  web:
    external: true

自动HTTPS证书签发与通配符证书配置

Traefik集成了ACME客户端，支持HTTP Challenge和DNS Challenge两种验证方式。HTTP Challenge适合单域名证书，DNS Challenge支持通配符证书但需要DNS服务商API凭据。

# DNS Challenge配置（以Cloudflare为例）
certificatesResolvers:
  letsencrypt-dns:
    acme:
      email: "admin@example.com"
      storage: "/acme.json"
      dnsChallenge:
        provider: cloudflare
        delayBeforeCheck: 30
        resolvers:
          - "1.1.1.1:53"
          - "8.8.8.8:53"

# 环境变量设置DNS API凭据
# CF_API_EMAIL=admin@example.com
# CF_API_KEY=your_cloudflare_api_key

# 通配符证书路由配置
# dynamic.yml
tls:
  certificates:
    - certFile: /certs/fullchain.pem
      keyFile: /certs/privkey.pem
  stores:
    default:
      defaultCertificate:
        certFile: /certs/fullchain.pem
        keyFile: /certs/privkey.pem

http:
  routers:
    wildcard-app:
      rule: "HostRegexp(`{subdomain:[a-z]+}.example.com`)"
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt-dns
        domains:
          - main: "*.example.com"
      service: catchall-service
  services:
    catchall-service:
      loadBalancer:
        servers:
          - url: "http://backend:8080"

中间件链式编排与限流压缩配置

Traefik的中间件（Middleware）支持链式组合，可在路由层面实现请求限流、压缩、重定向、头部操作、认证等功能。每个中间件独立声明，通过名称引用。

# dynamic.yml - 中间件配置
http:
  middlewares:
    rate-limit:
      rateLimit:
        average: 100
        burst: 200
        period: 1s

    compress:
      compress:
        excludedContentTypes:
          - "video/mp4"
          - "image/jpeg"

    secure-headers:
      headers:
        sslRedirect: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        frameDeny: true
        contentTypeNosniff: true
        referrerPolicy: "strict-origin-when-cross-origin"
        contentSecurityPolicy: "default-src 'self'"

    retry:
      retry:
        attempts: 3

  routers:
    secure-api:
      rule: "Host(`api.example.com`)"
      entryPoints:
        - websecure
      middlewares:
        - rate-limit
        - compress
        - secure-headers
        - retry
      service: api-service
      tls:
        certResolver: letsencrypt

Prometheus监控指标与告警规则

Traefik内置Prometheus metrics端点，暴露路由请求数、延迟分布、后端健康状态等指标。配合Grafana可实现完整的监控可视化。

# traefik.yml 开启metrics
metrics:
  prometheus:
    addEntryPointsLabels: true
    addServicesLabels: true
    addRoutersLabels: true
    entryPoint: traefik

# Prometheus告警规则
groups:
  - name: traefik
    rules:
      - alert: TraefikHighErrorRate
        expr: |
          sum(rate(traefik_service_requests_total{code=~"5.."}[5m])) by (service)
          / sum(rate(traefik_service_requests_total[5m])) by (service) > 0.05
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Traefik service error rate > 5%"

      - alert: TraefikCertExpiringSoon
        expr: |
          traefik_tls_certs_not_after < time() + 86400 * 7
        labels:
          severity: warning
        annotations:
          summary: "TLS certificate expiring in 7 days"

      - alert: TraefikDown
        expr: up{job="traefik"} == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Traefik instance is down"

Traefik v3.x在性能上有显著提升：相比v2.x，路由匹配速度提高约40%，WASM中间件执行延迟降低60%。生产部署建议将acme.json权限设置为600，配置文件通过版本管理维护，多实例部署时使用共享存储或KV后端（Consul/Redis）同步ACME证书状态，避免每个实例独立签发导致Let's Encrypt速率限制。