Skip to content

Instantly share code, notes, and snippets.

@francoism90

francoism90/README.md

Last active June 27, 2024 12:28
Show Gist options
  • Save francoism90/a0fee60a400096dfc2c8b711b40832a9 to your computer and use it in GitHub Desktop.
Save francoism90/a0fee60a400096dfc2c8b711b40832a9 to your computer and use it in GitHub Desktop.
Download ZIP
Cockpit + Traefik
Raw
README.md

Tested on CentOS Stream 9 with Cockpit and traefik v3.

A full working Podman Quadlet example, can be seen here: https://github.com/foxws/foxws/tree/main/podman

Overrule service

You need to overrule the Cockpit Web Service to not use TLS.

TLS is being offered by traefik in this example:

sudo systemctl edit cockpit.service

Enter the following to overrule:

[Service]
ExecStart=
ExecStart=/usr/libexec/cockpit-tls --no-tls

Create /etc/cockpit/cockpit.conf:

[WebService]
Origins = https://cockpit.example.com
ProtocolHeader = X-Forwarded-Proto
ForwardedForHeader = X-Forwarded-For
AllowUnencrypted = true
Raw
dynamic.yml
http:
services:
cockpit:
loadBalancer:
servers:
- url: "http://host.docker.internal:9090"
Raw
traefik.container
[Unit]
Description=Proxy container
Requires=podman.socket
After=podman.socket
[Service]
EnvironmentFile=%h/.config/containers/systemd/traefik/proxy.env
Restart=always
[Container]
Image=docker.io/library/traefik:latest
AutoUpdate=registry
Volume=${PODMAN_SOCKET}:/var/run/docker.sock:ro,z
Volume=./traefik/traefik.yml:/etc/traefik/traefik.yml:ro,Z
Volume=./traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro,Z
Volume=./traefik/acme:/etc/traefik/acme:rw,Z
SecurityLabelType=container_runtime_t
Network=traefik.network
PublishPort=80:80
PublishPort=443:443
Label=traefik.enable=true
Label=traefik.http.routers.mydashboard.entrypoints=websecure
Label=traefik.http.routers.mydashboard.rule="Host(`traefik.example.com`)"
Label=traefik.http.routers.mydashboard.tls=true
Label=traefik.http.routers.mydashboard.tls.certresolver=myresolver
Label=traefik.http.routers.mydashboard.service=api@internal
Label=traefik.http.routers.mydashboard.middlewares=myauth
Label=traefik.http.routers.cockpit.entrypoints=websecure
Label=traefik.http.routers.cockpit.rule="Host(`cockpit.example.com`)"
Label=traefik.http.routers.cockpit.tls=true
Label=traefik.http.routers.cockpit.tls.certresolver=myresolver
Label=traefik.http.routers.cockpit.priority=1000
Label=traefik.http.routers.cockpit.service=cockpit@file
Label=traefik.http.middlewares.myauth.basicauth.users=<see-htpasswd-command>
[Install]
WantedBy=multi-user.target default.target
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment