Setting up Docker, Rancher, and Traefik with Monitoring Tools in a Secure Environment

This Cloud-Init script facilitates a robust deployment of Docker, Rancher, Traefik, and integrates Prometheus, Grafana, and Loki for comprehensive monitoring within an isolated environment, leveraging the ubuntu/jammy/cloud LXD image. Meticulous attention has been given to fortify the infrastructure, implementing strict access controls, minimal container permissions, and automated SSL provisioning via Traefik integrated with Cloudflare for seamless certificate renewal.

Requirements

• Operational knowledge of LXD, Docker, Rancher, and Cloudflare.
• Access to the ubuntu/jammy/cloud LXD image.
• Additionally, refer to Monitoring Stack Gist for deploying the monitoring stack.

Instructions

1. Environment Setup:

   Ensure availability of the ubuntu/jammy/cloud image in your LXD environment:

   lxc remote list

   If missing, import the image:

   lxc image copy images:ubuntu/jammy/cloud local: --alias=ubuntu-jammy-cloud

2. Repository Cloning:

   Clone the repository housing the Cloud-Init script:

   git clone https://gist.github.com/9ba10e20df02e8ed278e0688cdc21f82.git

3. Configuration Customization:

   Tailor the .env file with your specific configuration:

   RANCHER_HOSTNAME=rancher.example.com
   CLOUDFLARE_EMAIL=[email protected]
   CLOUDFLARE_API_KEY=your-cloudflare-api-key

4. SSH Key Integration:

   Add your SSH public key to the ssh-authorized-keys section in cloud-config.yaml:

   ssh_authorized_keys:
     - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB... user@host

5. Loki Logging Configuration:

   Configure the loki-url in /etc/docker/daemon.json for Loki logging:

   {
     "log-driver": "loki",
     "log-opts": {
       "loki-url": "http://<LOKI-HOST>:<LOKI-PORT>/loki/api/v1/push"
     }
   }

6. Infrastructure Deployment:

   Initiate the environment using the Cloud-Init script and ubuntu/jammy/cloud image:

   lxc launch ubuntu-jammy-cloud your-container-name --config user.user-data="$(cat cloud-config.yaml)"

7. Post-Deployment Access:

   Access the deployed services and endpoints:

   • Rancher: https://rancher.example.com/
   • Traefik Dashboard: https://rancher.example.com/traefik
   • Traefik Ping: https://rancher.example.com/traefik/ping
   • Traefik Metrics: https://rancher.example.com/traefik/metrics
   • Node Exporter Metrics: https://rancher.example.com/node-exporter/metrics

8. Rancher Dashboard Login:

   Log in to the Rancher dashboard using:

   • Username: root
   • Password: Utilize CATTLE_BOOTSTRAP_PASSWORD generated during deployment.

Auto-Generated Configuration

Auto-generated values for seamless integration:

• METRICS_AUTH_USER: Basic authentication username for Metrics endpoints.
• METRICS_AUTH_PASS: Basic authentication password for Metrics endpoints.
• CATTLE_BOOTSTRAP_PASSWORD: Password for Rancher dashboard access.

These credentials are essential for accessing and securing the Metrics endpoints within your deployed environment.

Post-Deployment Configuration Update

After creating the virtual machine, update the Prometheus scrape configurations for seamless integration with the deployed environment. Add the following scrape configuration to the prometheus.yml file in your monitoring stack, replacing <REPLACE_WITH_METRICS_AUTH_USER> and <REPLACE_WITH_METRICS_AUTH_PASS> with the auto-generated values for basic authentication:

scrape_configs:
- job_name: rancher.example.com
  scrape_interval: 5s
  scrape_timeout: 5s
  static_configs:
    - targets:
      - rancher.example.com
      labels:
        __metrics_path__: /traefik/metrics
    - targets:
      - rancher.example.com
      labels:
        __metrics_path__: /node-exporter/metrics
  basic_auth:
    username: <REPLACE_WITH_METRICS_AUTH_USER>
    password: <REPLACE_WITH_METRICS_AUTH_PASS>

Ensure to replace <REPLACE_WITH_METRICS_AUTH_USER> and <REPLACE_WITH_METRICS_AUTH_PASS> with the corresponding auto-generated values. This configuration ensures proper scraping of metrics from Traefik and Node Exporter with the specified basic authentication credentials.

Dashboard Views

Rancher Dashboard

The Rancher dashboard provides a comprehensive overview of your containerized environment, enabling easy management and monitoring of Docker containers.

Traefik Dashboard

The Traefik dashboard offers insights into your network infrastructure, routing, and HTTP services, ensuring efficient traffic management.

Grafana Dashboard

Grafana provides visually appealing and informative graphs and charts, presenting data collected by Prometheus, facilitating in-depth analysis and monitoring.

Customization & Further Enhancements

Tailor the setup according to specific requirements and incorporate additional functionalities as needed.