Note
This is a security-hardened fork of the original attachmentgenie/puppet-traefik2 module. All credit for the baseline codebase goes to the original author, attachmentgenie.
Deploy and configure traefik2 on a node.
Traefik is an open-source Edge Router that makes publishing your services a fun and easy experience. It receives requests on behalf of your system and finds out which components are responsible for handling them.
All options and configuration can be done through interacting with the parameters on the main traefik2 class. These are now documented via Puppet Strings
You can view example usage in REFERENCE.
See REFERENCE.
This fork contains critical security enhancements to run Traefik as a secure, unprivileged system user instead of root.
- Unprivileged Execution: The Traefik process runs under a dedicated
traefikuser and group. - Privileged Ports: Ambient capabilities (
CAP_NET_BIND_SERVICE) are assigned to the systemd service unit. This allows the unprivileged Traefik process to bind directly to standard web ports (80 and 443) without root access. - Configuration Security: Configuration files are restricted with
0640permissions, ensuring only thetraefikprocess and root can read them.
You can configure the user and group settings via the main traefik2 class:
user: The system user name (default:'traefik').group: The system group name (default:'traefik').manage_user: Boolean to control whether the module creates the system user and group account (default:true).
This is where you list OS compatibility, version compatibility, etc.
This project contains tests for both rspec-puppet and litmus to verify functionality. For detailed information on using these tools, please see their respective documentation.
pdk bundle install
pdk bundle exec rake 'litmus:provision_list[puppet8]'
pdk bundle exec rake 'litmus:install_agent[puppet8]'
pdk bundle exec rake 'litmus:install_module'
pdk bundle exec rake 'litmus:acceptance:parallel'
pdk bundle exec rake 'litmus:tear_down'