7:46 p.m.
Hi all!
I'm having trouble getting an Apiman docker instance up and running.
The setup is a docker-compose coordinated set of containers in a single VM,
running on the cloud.
$ docker ps
CONTAINER ID IMAGE COMMAND
CREATED STATUS
PORTS NAMES
59a1047d84bd apiman/on-wildfly11 "/opt/jboss/wildfly/…" 25
minutes ago Up 25 minutes
8080/tcp apiman
ca8bd1e3bb99 traefik "/traefik" About an
hour ago Up 25 minutes 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp,
0.0.0.0:8080->8080/tcp traefik
2a11b776409c nginx:alpine "nginx -g 'daemon of…" About an
hour ago Up 25 minutes
80/tcp nginx
21f8c3d3e14e portainer/portainer "/portainer" 2 hours
ago Up 25 minutes
9000/tcp portainer
Traefik proxies all connections and provides SSL termination. I'm using a
LetsEncrypt wildcard certificate; each service has a DNS subdomain.
- API-project.domain.tld -> apiman
- WEB-project.domain.tld -> nginx (static pages)
- PORTAINER-project.domain.tld -> portainer
- TRAEFIK-project.domain.tld -> traefik
All of this works. I can see on my browser each service including apimanui
The problem starts with the apiman login form. The form itself has a HTTP
and not HTTPS action endpoint.
if I login with the admin/admin123! credentials and hit enter, I'll POST to
the auth backend, receive a 302 REDIRECT, follow the redirect and then just
prints Forbidden to the screen. Refresh or back now fails with Bad request
to the screen. The only way to retry is clearing cookies and local storage.
I tried running the single line docker apiman incantation and it works on
my laptop, but not when mixed with other containers. Here is my
docker-compose file
-------------------
version: '2.4'
services:
portainer:
image: portainer/portainer
container_name: portainer
mem_limit: 1G
restart: always
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /mnt/disks/SSD1/portainer:/data
networks:
- network1
labels:
- "traefik.enable=true"
- "traefik.backend=portainer"
- "traefik.frontend.rule=Host:portainer-project.domain.tld"
- "traefik.port=9000"
- "traefik.protocol=http"
apiman:
image: apiman/on-wildfly11
container_name: apiman
mem_limit: 3G
restart: always
#volumes:
# - /mnt/disks/SSD1/apiman:/opt/jboss/wildfly/standalone:rw
networks:
- network1
labels:
- "traefik.enable=true"
- "traefik.backend=apiman"
- "traefik.frontend.rule=Host:api-project.domain.tld"
- "traefik.port=8080"
- "traefik.protocol=http"
web:
image: nginx:alpine
container_name: nginx
mem_limit: 512M
restart: always
networks:
- network1
labels:
- "traefik.enable=true"
- "traefik.backend=web"
- "traefik.frontend.rule=Host:web-project.domain.tld"
- "traefik.port=80"
- "traefik.protocol=http"
reverse-proxy:
image: traefik # The official Traefik docker image
container_name: traefik
ports:
- "80:80" # The HTTP port
- "8080:8080" # The Web UI (enabled by --api)
- "443:443" # The Web UI (enabled by --api)
networks:
- network1
volumes:
- /var/run/docker.sock:/var/run/docker.sock # So that Traefik can
listen to the Docker events
- /mnt/disks/SSD1/traefik/traefik.toml:/etc/traefik/traefik.toml
- /mnt/disks/SSD1/certs:/certs
labels:
- "traefik.enable=true"
- "traefik.backend=traefik"
- "traefik.frontend.rule=Host:traefik-project.domain.tld"
- "traefik.port=8080"
- "traefik.protocol=http"
networks:
network1:
name: web
--------------------------------
My final questions are:
How can I configure apiman to be aware that it will be called from an https
schema?
In general, What are the caveats of placing Apiman behind a reverse proxy?
Thanks!
--
*J. Rubén Marrero V.*
GPG: 0x1D7087F7