Websites and routing
Routing web requests
Note
This page assumes that you have SSH access to the IN-SMN server. It may still be useful if you do not have access but are developing software that will be deployed to our servers.
We use Traefik to handle routing to our websites and to apply middleware.
It is usually configured through container labels
defined in project compose files, with the exception of when we need to route data to IN-ITK.
In this case we use YAML configs located in /root/SMN/traefik/conf/.
The Traefik admin dashboard is hosted at traefik.kth.it for those with access.
Basic configuration
Most required labels are boilerplate and will not vary significantly between deployments.
The easiest approach to get up and running is to copy the labels of /home/deploy/example-app and modify them to fit the new deployment.
Adding authentication
There are two types of authentication commonly used for deployments: HTTP Basic Auth and Authentik. Both are added by defining middleware with a Traefik label. To leave a site available to the entire internet, omit the middleware label.
Note
To access a site with the Authentik middleware, it must be properly configured through the Authentik dashboard. For details, see the SSO docs.
# Label
- "traefik.http.routers.<APP_NAME>.middlewares=authentik@docker"SSL encryption
We use Let's Encrypt to obtain signed SSL certificates. Traefik automatically requests these for the domains and subdomains we use.
Since these certificates are issued per subdomain rather than for all of *.kth.it,
the browser will warn about a self-signed certificate if visiting a subdomain where nothing is served.
Adding new domains
Ensure that the DNS record points to IN-SMN.
This can be checked by pinging both the domain and server.kth.it and comparing the IPs.
You might need to wait a long while for the DNS propagation to finish.
[Insert meme about DNS propagation being slow]
Note that for unused *.kth.it domains this step is already taken care of.
Setup the Host(...) rule(s) on the traefik configuration.
Start the container. Traefik will automatically detect the Hosts and request SSL certificates for them.
These certificates last for 90 days and are automatically renewed.