Traefik Dashboard子域名访问404问题排查与解决

问题现象 #

尝试将Traefik Dashboard配置在子域名traefik.example.com下时，访问traefik.example.com/dashboard出现404页面未找到错误，但traefik.example.com/api/rawdata可正常访问。

原始配置 #

version: '3.7'
services:
  traefik:
    image: traefik:v2.9.6
    container_name: traefik
    hostname: traefik
    restart: always
    ports:
      - 80:80
      - 8080:8080
    command:
      - --api.insecure=true
      - --api.dashboard=true
      - --api.debug=true
      - --log.level=DEBUG
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=traefikweb
      - --entrypoints.web.address=:80
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - traefikweb
    labels:
      - traefik.enable=true
      - traefik.http.routers.dashboard.rule=Host(`traefik.example.com`) && PathPrefix(`/dashboard`)
      - traefik.http.routers.dashboard.service=dashboard@internal
      - traefik.http.routers.dashboard.entrypoints=web
      - traefik.http.routers.api.rule=Host(`traefik.example.com`) && PathPrefix(`/api`)
      - traefik.http.routers.api.service=api@internal
      - traefik.http.routers.api.entrypoints=web
networks:
  traefikweb:
    external: true

问题原因 #

Traefik的Dashboard内部路由基于根路径设计，当配置PathPrefix(/dashboard)规则时，Dashboard的静态资源会请求/dashboard/static/...这类路径，但Traefik的内部dashboard@internal服务并未处理该前缀的映射，导致路由不匹配，最终返回404。而API的/api是Traefik原生路径，PathPrefix(/api)规则可以正常匹配API端点，因此能正常访问。

解决方案配置 #

基于社区回答调整后的配置如下：

version: '3.7'
services:
  traefik:
    image: traefik:v2.9.6
    container_name: traefik
    hostname: traefik
    restart: always
    ports:
      - 80:80
    command:
      - --api.insecure=true
      - --api.dashboard=true
      - --api.debug=true
      - --log.level=DEBUG
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=traefikweb
      - --entryPoints.web.address=:80
      - --accessLog.filePath=/dev/stderr
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - traefikweb
    labels:
      - traefik.enable=true

      - traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)
      - traefik.http.routers.dashboard.service=dashboard@internal
      - traefik.http.routers.dashboard.entrypoints=web

      - traefik.http.routers.api.rule=Host(`traefik.example.com`) && PathPrefix(`/api`)
      - traefik.http.routers.api.service=api@internal
      - traefik.http.routers.api.entrypoints=web

networks:
  traefikweb:
    external: true

使用说明 #

• http://traefik.example.com -> 直接访问Dashboard
• http://traefik.example.com/api/rawdata -> 访问API端点

配置中移除了8080端口的转发，现在只能通过子域名访问Dashboard和API，后续可进一步对访问进行安全加固。

内容的提问来源于stack exchange，提问作者huber.duber