13 ms·
Traefik's 10-year anniversary
- laz 1y agoAmusing that they don't mention xds at all. How did they "win" when xds, envoy's config, is becoming the defacto interface to LBs? Sure, Gateway API is kinda xds by not, but it's envoy all the way down.
- IOZ 1y agoCongrats, awesome product! Traefik saved me a lot of time when working with Docker Compose and certificates.
- mhogers 1y agoWas just taking a break from reading Traefik documentation - thank you for this amazing project.
- miiiiiike 1y agoTraefik's F/OSS projects are useless to me. Every single feature that I need to use is locked away in a closed source product. Close to the same issue with Varnish Enterprise. Why would I pay for Varnish Enterprise if I can't even review or extend the source? Know what I have to do with Varnish's source once a quarter? I have to look at it. Because the documentation is non-existent. The closed source version is going to make my life objectively worse. Aside from NGINX, Postgres, and memcached, I've had to patch every major piece of software in my stack at one point or another. I refuse to use any product that I can't fix myself. It's current year, why are JWTs only supported in the closed source/enterprise versions of Varnish, NGINX, and Traefik? I happily give $1,000/year to Django and lesser amounts to other projects that I depend on. Do you know how much I spend on projects that put features behind a closed source product? Zero. I will never pay for that.
- huflungdung 1y ago[dead]
- zukzuk 1y agoI don’t think this is representative of the majority of traefik’s users. Most of us use it as an HTTP entrypoint for a container stack (docker compose, in my case) or for local development, and the FOSS version works great for that, with better dev tooling than anything else i’ve seen.
- miiiiiike 1y agoI disagree. If you're a heavy Traefik user you're eventually going to need a feature that has been carefully omitted from the F/OSS projects.
- btreecat 1y ago> I disagree. If you're a heavy Traefik user you're eventually going to need a feature that has been carefully omitted from the F/OSS projects. Ok, I use it at home as part of my K8s cluster. I haven't once come close to needing a feature I don't have because it largely does what I need as a proxy and gets out of the way. What features do you feel a more average of the target audience is likely to need or want to pay for eventually?
- miiiiiike 1y ago> What features do you feel a more average of the target audience Auth and middleware packages that are essential for a production site. > I use it at home as part of my K8s cluster. That's not heavy use.
- nickstinemates 1y agoRunning it in production for free and complaining about the offering is a choice.
- fisf 1y agoThey are not complaining about the price, but about the closed source nature of the product.
- reactordev 1y agoCaddy my guy, caddy. Traefik is really only useful in k8s. Soon we’ll be replacing ours.
- andrewstuart2 1y ago> It's current year, why are JWTs only supported in the closed source/enterprise versions of Varnish, NGINX, and Traefik? I've found auth at the proxy to be a major antipattern. It adds a semblance of your backend being secure without adding the real user authentication and authorization it should have directly. VPN is the better tool if you want to keep certain projects hidden from the general public and your application should be handling the JWT (hopefully in current year we're talking OIDC or some additional open standard on top of JWT) itself in order to properly enforce access controls.
- miiiiiike 1y agoWith JWTs I don't do anything at the proxy beyond "This is a protected route. Is there a JWT? Is it valid? No to either? 403." This is one of the primary use cases for JWTs and it takes a majority of the load off of my application servers. The route is open to the public for authenticated and authorized users. You wouldn't use a VPN here.
- andrewstuart2 1y agoThat's really just added work, IMO, and likely room for security misconfiguration between backend and proxy. You should still be validating and everything on the application server to inspect identity and possibly attributes like roles, so in the cases where you have invalid tokens you do the work once, just in the proxy instead of the backend, and with valid tokens you will do the signature validation work twice.
- miiiiiike 1y agoSecurity starts at the edge. Have you used JWTs in production? Better to bounce a bad JWT with a server written in C/C++/Rust/Go at the edge than to pass it back and have it tie up a Python or Node process. Even in Python the time to validate a small JWT is negligible. At the edge it's nearly imperceptible.
- miiiiiike 1y agoIf you're concerned about misconfigurations, just verify/validate everything in tests.
- pjmlp 1y agoThey have to put bread on the table somehow.
- miiiiiike 1y agoIf I had access to the code I would pay for it. Create a private repo for paying customers.
- dewey 1y agoThe problem is that you would be one of the 1% doing that, the rest of the companies would just not bother with that and it will end like many open source problems that constantly have to come up with ways to get funding.
- pingoo-io 1y ago[dead]
- monster_truck 1y agoSame. At this point I've spent more time in devops moving away from shit that does this, and then doing it again, just to keep things as they are in a way that can be trusted. It fuckin sucks
- nodesocket 1y agoI’ve deployed Traefik in-front of Kubernetes on some moderately large traffic sites with and without enterprise licensing. Recently I switched to using Caddy though. I know the stigma is that Caddy is not “production” ready and battle tested but I haven’t encountered any issues with it in terms of performance. It just works. Let’s Encrypt with CloudFlare DNS verification is super easy to setup and the configuration is very intuitive.
- hoistbypetard 1y agoI don't generally use/need Traefik. But the cheese shirt makes me unreasonably happy, and if it appeared for sale on some easily accessible site for a decent price, I'd very likely order one.
- AceJohnny2 1y agoWell hey, if you can fix the ACME key reuse issue [1], which is just a Traefik mis-use of the underlying library (by the same authors!!!), you can just get one! [1] https://github.com/traefik/traefik/issues/10103 https://github.com/traefik/traefik/issues/10103
- wiether 1y agoI'm not familiar with Traefik's history, but I'm French, and seeing v1.1 labelled "Camenbert" on the tshirt design is triggering me. Apparently they wrote it correctly at the time, with an m: https://traefik.io/blog/introducing-distributed-cheese-traefik-1-1-camembert-is-out-fb19e05a48c8 https://traefik.io/blog/introducing-distributed-cheese-traef...
- jspdown 1y agoTraefik maintainer here. A significant portion of TraefikLabs' engineering team and maintainers are French. Before each new release, the team holds polls and spirited debates to determine which cheese would be the perfect fit for the version name. Staying true to French culinary tradition, the enterprise versions are given wine codenames, with each wine carefully selected to pair perfectly with its corresponding cheese release.
- BoredPositron 1y agoHorrible read. That whole post is nothing but gratuitous self-importance. Just don't use llms for something like this... it just gets over the top really easy.
- huflungdung 1y ago[dead]
- arrty88 1y agoI never understood why folks use Traefik. HAProxy feels more configurable and resilient.
- bingabingabinga 1y ago[dead]
- mirzap 1y agoEasy to configure, straightforward and intuitive. Clear and detailed documentation. Recently, I wanted to try HAProxy, but I gave up because I got lost in the config, and I don't trust AI agents to do things I don't understand.
- doctoboggan 1y agoI use it because it's built in to k3s.
- pjmlp 1y agoEasy to configure. We use Kong, and while it is quite powerful, oh boy better get some coffee when doing those rules.
- sofixa 1y agoHAProxy's documentation is pretty bad (almost entirely of the style "here are all the parameters and options available, no concrete complete examples)". Traefik has easy to parse docs with lots of examples, and mostly, it can autoconfigure itself based on a variety of sources. You can point it to your Kubernetes or Nomad or Consul, (and with small bits of info given when deploying your workloads to those places), and it just works.
- maherbeg 1y agoYeah, this is absolutely true. It can be configured to do anything, which means you really need to make sure you've configured everything correctly.
- diegoperini 1y ago
- satvikpendem 1y agoAnyone know of a Traefik alternative but in Rust? I'm looking to oxidize a lot of my stack so just curious.
- nokun7 1y agoWhile there is pingora https://blog.cloudflare.com/how-we-built-pingora-the-proxy-that-connects-cloudflare-to-the-internet/ https://blog.cloudflare.com/how-we-built-pingora-the-proxy-t..., I would recommend checking out envoy. Although not rust based, envoy has gained quite the repute for being extremely versatile and robust.
- satvikpendem 1y agoThanks, I'm looking specifically for a Rust based one, as I know there are lots of proxies in other languages but few in Rust, and I'm just curious if anyone has suggestions on that.
- rirze 1y agoThere's a handful but not mature IMO: https://github.com/sadoyan/aralez https://github.com/sadoyan/aralez https://github.com/junkurihara/rust-rpxy https://github.com/junkurihara/rust-rpxy I'm interested in the space, but until they have automatic certificate management and middleware for managing DNS records in Cloudflare (for example), then I'm reluctant to switch over.
- vovavili 1y agoLooking for a Rust-based alternative to a battle-tested industry-standard tool written in a memory-safe language that can get about 75-90% of the speed of Rust is kind of pointless outside embedded context.
- satvikpendem 1y agoNot really, sometimes it's just a curiosity. And 15% is nothing to scoff at in terms of speed, if it's available why not take the extra speed, is my opinion.
- mindcrash 1y agoWith Envoy (https://www.envoyproxy.io/ https://www.envoyproxy.io/) and Contour (https://projectcontour.io/ https://projectcontour.io/) being official CNCF sanctioned projects in the Service Proxy space, Istio (https://istio.io/ https://istio.io/) and Linkerd (https://linkerd.io/ https://linkerd.io/) being official CNCF sanctioned projects in the Service Mesh space and Emissary Ingress (https://emissary-ingress.dev/ https://emissary-ingress.dev/) the same in the API Gateway space, just to name a few, naming yourself a standard are some pretty big words... ... Traefik is pretty good yes, but a standard? Hell no.
- __turbobrew__ 1y agoYea, envoy is the premier open source (not open core+ paid features) proxy right now in my opinion. Modern, well supported, big community, reliable. If I was making a bet long term I would be looking at envoy and not some open core crap where they can rug pull you at any moment.
- LtdJorge 1y agoTraefik is proper OSS tho, not Open Core
- __turbobrew__ 1y agoIs it? Features are blocked behind a subscription: https://traefik.io/solutions/kubernetes-ingress https://traefik.io/solutions/kubernetes-ingress
- FridgeSeal 1y agoA whole bunch of the other ingress/k8s gateway offering also just…wrap envoy, so you may as well just use envoy directly these days. Especially given that configuring it, wasn’t any worse than configuring a wrapper with the additional benefit of not having anything between you and envoy to get in the way.
- tecleandor 1y agoIs envoy usable outside containers? For example, with VMs.
- denysvitali 1y agoSo much hate for Traefik here. I don't get it. I personally use it and find it amazing, but I read elsewhere that their enterprise offering is prohibitively expensive. I wish them to succeed, Traefik has been one of my favorite choices for Kubernetes for a long time now :)
- mike_d 1y agoThey consider caching and TLS to be enterprise features. If you can't get the basics right, you stay at the kids table forever.
- denysvitali 1y agoWdym TLS is an enterprise feature? I'm using mTLS and TLS in their OSS version. The certificates are generated via cert-manager. If you expect something like Caddy's auto-provision of certs, then (AFAIK) neither HAProxy nor NGINX have it
- jspdown 1y agoTraefik maintainer here. I can confirm that bring-your-own certificates, ACME, and mTLS are all included in the OSS version. For enterprise users, Traefik Hub also provides seamless integration with HashiCorp Vault. Regarding the cache middleware: like many of our more advanced middlewares, you have two options. You can use a community-maintained plugin (such as Souin), or your organization can purchase an enterprise license to access TraefikLabs' officially maintained built-in middleware as part of Traefik Hub API Gateway or Traefik Hub API Management.
- mike_d 1y ago> I can confirm that bring-your-own certificates, ACME, and mTLS are all included in the OSS version If I open a pull request for distributed Lets Encrypt, you'd accept it? > Regarding the cache middleware ... purchase an enterprise license Literally what I said. Also the oddest thing to strip out to get people to pay for enterprise.
- bingabingabinga 1y ago[dead]
- germandiago 1y agoI just wanted to sincerely say: congratulations for this project. When a person is determined it can go very far. These things do not happen just by pure chance.
- ktosobcy 1y agoQuite a bold claim there about being "standard" :D At one point I was using nginx for my local RPi deployment handling of various services with docker-compose but ultimatelly switched to Caddy and it made everything so simple :)
- xyst 1y agoIt’s modern day age of aura farming/seo hacking/clout chasing. Just claim you are standard and then LLM crawlers pick up on it. The next generation is trained to just ask ChatGPT/Claude/Gemini/{w/e dogshit LLM} and they will unfortunately believe it. Throw in some more keywords and signals like GH stars, docker container downloads to sell it. Might not work now but it’s a small gamble that may pay off in the future.
- aprdm 1y ago> Just claim you are standard and then LLM crawlers pick up on it That's very interesting. Hadn't thought about this PoV. LLMs definitely /can/ empower the wrong kind of behaviour, just like SEO did... and they amplify it a lot by not really showing sources. Thanks for sharing the thought
- 9029 1y agoLLM rizzmaxxing is crazy
- marginalia_nu 1y agoTo be fair this predates LLMs, SEO crowd was doing this even before to try to get into Google Answers, and before that to have a favorable-looking summary under their blue link. The entire industry is full of tricks that may or may not work, seems closer to magic rituals than anything else. It's genuinely pretty difficult to analyze how well SEO tricks perform, so there's a lot of "wow, this site is doing well, let's try to copy the success by emulating its patterns randomly" going around.
- dang 1y agoOk, we've made the title non-standard by switching to the HTML doc title above.
- pjmlp 1y agoStandard where? We use Kong on our projects, when not using the preferred gateway from the respective cloud vendor.
- mynegation 1y agoI agree “standard” is not the right word here. Traefik is very popular in self hosting community, probably the most popular proxy in my experience, followed by NPM (nginx proxy manager) and Caddy as distant third.
- coredog64 1y agoIs there a way to use Envoy with common self-hosting software stacks like Docker Swarm?
- LtdJorge 1y agoIsn’t Docker Swarm dead?
- mkesper 1y agoDocker swarm v1 is dead, v2 ("swarmkit") is usable. Although, if you want to use it in production, you're probably better of with K8s. Don't get me started on docker using "the same" (but subtly different) file format for its different offerings (compose v2, swarm v2). For smaller setups maybe look into podman with K8s config files (did not try myself yet).
- gaanbal 1y agoisn't that just a way of running containers? yeah you can run envoy
- gethly 1y agoI use Traefik for local development on daily basis, where I have to run double digit https services. It works, but it was a pain to set up. The documentation sucks ** and the config is confusing AF. I would never recommend this to anyone. If i will have to reinstall my computer one day, Traefik will not be welcomed back.
- tracker1 1y agoI use caddy similarly, but it's a pretty straight forward setup.
- theSuda 1y agoAs a self-hosting noob, I never got traefik to work properly, then caddy just worked and has been working since.
- wkat4242 1y agoYeah same here. Caddy is so well designed. I hated traefik from the start and even though it works now I still hate it. The moment I used caddy everything was clear and just worked. Basically what nginx used to be 15 years earlier. But it didn't really keep up with the times and they care more about the commercial thing now.
- skibbityboop 1y agoYeah, kinda have to agree. I like traefik fine but getting mTLS working with it was a serious pain and the docs for doing so were _terrible_, had to keep searching around and piecing together bits from various third party blogs. Coming from haproxy where the documentation is _so_ _much_ better and things like e.g. mTLS are vastly easier, it was not a fun experience but we did finally get traefik to work as we needed.
- trenchpilgrim 1y agoI was once tasked with looking into using Traefik and yeah the documentation at the time was so bad I couldn't figure it out. Ended up using Envoy IIRC.
- brainzap 1y agofunny and sad how ingress-nginx loses all users by going into maintenance mode, and once we switched we dont care about their new project
- stackskipton 1y agoHas ingress-nginx lost all users? We are still rocking here at work because I see Gateway API in Kubernetes and go "Ingress works, don't care"
- tux3 1y agoIt hasn't, Gateway is still in development with most features being experimental.
- firesteelrain 1y agoManaged Nginx is standard for AKS. I wouldn’t say it’s gone.
- kachapopopow 1y agoThe first this I ever do when setting up k3s is pass --disable-traefik I don't know what it is, I never used it, never had the motivation to look into what I am losing out because everything else I am familiar with already works and I don't have many complains. I do not remember why I have this opinion, but I usually only treat software like this when they're trying to sell themselves too hard.
- cmckn 1y agoTraefik is used by k3s for ingress.
- kardianos 1y agoI use traefik quite a bit. Easy to use, easy to understand. Optional dashboard for understanding the current state of the configuration.
- tecleandor 1y agoThere's a lot of mentions to Caddy here. Haven't used it as, back in the day, there was something funny about its license and binary distribution. AFAIK that's not a problem anymore, isn't it? From people that migrated from Traefik to Caddy... What are the main differences? Anything you really miss? I use Traefik in a bunch of small deployments, sometimes pointing to Docker stuff, sometimes outside of Docker, Kubernetes, or anything similar.
- justsomehnguy 1y agoI found autoconfig in Docker (using labels) working better in Caddy+lucaslorentz. It is still PITA (it's a nested JSON expressed as YAML) but it was easier for me than Traefik, somehow.
- aborsy 1y agoCaddy is dead simple. Like, send https://example.com https://example.com to 1.2.3.4:5000. That’s it! Certificate provisioning, TLS configs, TLS termination, mTLS and client certificates, sticking in middlewares, … are all simple. The config is a straightforward text file. Really good webserver! Traefik is docker centric, and had various obscure labels. Too much text for a simple proxy. The debugging can be an issue if it doesn’t work. It also takes more resources. But it can probably do more, if you have a complex need. My main issue with Traefik was the debugging.
- Ajedi32 1y agoDoes Caddy automatically detect when you deploy a new Docker service and reconfigure itself to route traffic to that service? That's pretty much the main value preposition of Traefik for me. I don't want to be messing with config files when I'm deploying.
- sph 1y agoCaddy is a webserver like Apache or nginx. Integration with Docker is a higher-level layer. There’s caddy-docker-proxy but I haven’t tried it.
- Vaslo 1y agoWhen I wanted to move to something besides NGINX proxy manager, it was caddy or traefik. At the time, tutorials for the clueless like myself were way more abundant for Traefik. Thats the way I went. Now I also have Authentik up in front and it works great.
- Jnr 1y agoI am actually playing around with something similar to nginx proxy manager but for Traefik. It's quite early version but already now it's nice for quickly sharing some services with people temporarily. https://github.com/Janhouse/traefik-proxy-admin https://github.com/Janhouse/traefik-proxy-admin I personally use it in homelab together with docker label based configuration. Adding headscale in the mix allows easily serving my development services with outside world.
- ctippett 1y agoI use and appreciate both Traefik and Caddy. I like that Traefik includes TLS termination, whereas the equivalent functionality with Caddy requires compiling a separate module with xcaddy.
- mpyne 1y agoI'm pretty sure that's how I'm already using Caddy, and I didn't compile anything separate. Maybe it's packaged automatically as part of the Caddy Docker image?
- ctippett 1y agoMy original comment probably wasn't clear enough, I meant to say that caddy doesn't support layer 4 TLS termination without third-party modules. For example, if I wanted a reverse proxy in front of a Gitea instance that would terminate and route TCP packets to/from port 22... this is something Traefik can do out of the box.
- francislavoie 1y agoWe plan to move layer4 into the standard Caddy distribution eventually. We're still stabilizing it, and once we're happy with it (and have the time and energy to) we'll bring it in.
- ctippett 1y agoExciting! Looking forward to it. I end up needing xcaddy for a few other modules so it's not that big of a deal, but I always feel better using first-party functionality over relying on third-party modules.
- wkat4242 1y agoThere's even a great docker with caddy and the cloudflare DNS-01 module built in which was just what I needed. That saved me having to deal with xcaddy (it was ok, but compiling was slow)
- drnick1 1y agoI host a couple of web services like Nextcloud and Overleaf instances (Docker) and I use nginx as a reverse proxy. What would be the benefit of using Traefik instead? Traefik can handle things such as TLS certificates automatically, but that seems a rather weak reason to move away from a robust and modular setup where each component complies with the Unix philosophy or doing one thing well.
- chrisandchris 1y agoI use nginx as Gateway (Reverse Proxy) and have several VMs with services deployed using Docker Stack. Traefik acts as reverse proxy on the VMs. Main benefit IMHO: configuring services/routing using docker labes and because they run in dedicated networks, no need to expose any port (Internet -> Nginx -> Traefik -[> Service ] ; wheras [ ] indicates a docker overlay network.
- gh02t 1y agoYeah, I don't use Traefik I use Caddy with https://github.com/lucaslorentz/caddy-docker-proxy https://github.com/lucaslorentz/caddy-docker-proxy to achieve configurations by labels, but that is really a killer feature. All the config to set up an app can go in a docker-compose file and I just have one point of configuration for it. Editing or deleting it doesn't involve editing configurations in 3-4 places.
- jprd 1y agoSigh. Congrats and all that, but this just makes me feel old.
- evnix 1y agoLetsencrypt Https should be a default like caddy. Mounting certs, opening right ports and mapping them right is really not what I want to mess around with just to get SSL.
- gerdesj 1y agoUsual tribal bollocks in the comments. Personally, I generally rock Apache but Traefik, Caddy, ngnix and co are all superb projects. If you are going to get tribal about web servers, I suggest you think really hard about your career choice. Use the tool that works for the job in hand.
- ggm 1y agoMy main takeaway was "traefik has worse docs and more complex configuration but if you grok it, the fit with docker is fantastic"
- slj 1y agoUsed Traefik a couple times in my homelab, would’ve been circa 2017/2018. Worked great when it worked, otherwise it tended toward breaking ungracefully and confusingly. Tried it again for a short time in 2022, rock solid, no complaints. I’m glad to see the project’s maturity has kept up! Congratulations on ten years!
- JanMa 1y agoCongratulations on the 10 year anniversary. Having used Traefik for multiple years in a large Micro-Service Setup (200+ services) I must say I have made mixed experiences. If your requirements match the very opinionated way Traefik does things then it's great. But as soon as they don't you're going to have a hard time getting things to work. That's why shortly after migrating to Traefik I started to maintain an internal fork to add support for unique request ID headers which I maintained for two years until we migrated to HaProxy. The GitHub issue I opened for this in 2019 is still open. To be fair I used Traefik back when it was still version 1.7 so maybe things have improved by now.
- djhworld 1y agoI use traefik in my home network as the main reverse proxy. I don't use any of the dynamic features though like labels in docker containers etc, all of it is configured using the static configuration. It's been working well but I don't think about it really.
- telliott1984 1y agoCongrats on a decade! Time flies. I think I first heard about Traefik from a GopherCon talk, and it quickly became a default for me when working with Kubernetes. Still not entirely sure how to pronounce the name though...
- robertdaniels 1y ago[dead]