Tailscale¶

为内部 Tailscale 服务配置 TLS 证书。

要使用 TLS 保护服务，需要由公共证书颁发机构签发的证书。除了提供 VPN 功能外，Tailscale 还可以为 Tailscale 网络中的机器提供证书。

配置示例¶

要从 Tailscale 守护进程获取 TLS 证书，需要按如下方式配置 Tailscale 证书解析器。

启用 Tailscale 证书解析

文件 (YAML)

entryPoints:
  web:
    address: ":80"

  websecure:
    address: ":443"

certificatesResolvers:
  myresolver:
    tailscale: {}

文件 (TOML)

[entryPoints]
  [entryPoints.web]
    address = ":80"

  [entryPoints.websecure]
    address = ":443"

[certificatesResolvers.myresolver.tailscale]

CLI

--entrypoints.web.address=:80
--entrypoints.websecure.address=:443
# ...
--certificatesresolvers.myresolver.tailscale=true

从路由器规则获取域名的示例

Docker & Swarm

labels:
  - traefik.http.routers.blog.rule=Host(`monitoring.yak-bebop.ts.net`) && Path(`/metrics`)
  - traefik.http.routers.blog.tls.certresolver=myresolver

Docker (Swarm)

deploy:
  labels:
    - traefik.http.routers.blog.rule=Host(`monitoring.yak-bebop.ts.net`) && Path(`/metrics`)
    - traefik.http.routers.blog.tls.certresolver=myresolver

Kubernetes

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: blogtls
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`monitoring.yak-bebop.ts.net`) && Path(`/metrics`)
      kind: Rule
      services:
        - name: blog
          port: 8080
  tls:
    certResolver: myresolver

文件 (YAML)

## Dynamic configuration
http:
  routers:
    blog:
      rule: "Host(`monitoring.yak-bebop.ts.net`) && Path(`/metrics`)"
      tls:
        certResolver: myresolver

文件 (TOML)

## Dynamic configuration
[http.routers]
  [http.routers.blog]
  rule = "Host(`monitoring.yak-bebop.ts.net`) && Path(`/metrics`)"
  [http.routers.blog.tls]
    certResolver = "myresolver"

从路由器 tls.domain 获取域名的示例

Docker & Swarm

labels:
  - traefik.http.routers.blog.rule=Path(`/metrics`)
  - traefik.http.routers.blog.tls.certresolver=myresolver
  - traefik.http.routers.blog.tls.domains[0].main=monitoring.yak-bebop.ts.net

Docker (Swarm)

deploy:
  labels:
    - traefik.http.routers.blog.rule=Path(`/metrics`)
    - traefik.http.routers.blog.tls.certresolver=myresolver
    - traefik.http.routers.blog.tls.domains[0].main=monitoring.yak-bebop.ts.net

Kubernetes

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: blogtls
spec:
  entryPoints:
    - websecure
  routes:
    - match: Path(`/metrics`)
      kind: Rule
      services:
        - name: blog
          port: 8080
  tls:
    certResolver: myresolver
    domains:
      - main: monitoring.yak-bebop.ts.net

文件 (YAML)

http:
  routers:
    blog:
      rule: "Path(`/metrics`)"
      tls:
        certResolver: myresolver
        domains:
          - main: "monitoring.yak-bebop.ts.net"

文件 (TOML)

## Dynamic configuration
[http.routers]
  [http.routers.blog]
    rule = "Path(`/metrics`)"
    [http.routers.blog.tls]
      certResolver = "myresolver"
      [[http.routers.blog.tls.domains]]
        main = "monitoring.yak-bebop.ts.net"

引用证书解析器

定义证书解析器并不意味着路由器会自动使用它。每个需要使用此解析器的路由器或入口点都必须显式引用它。

域名定义¶

证书解析器根据以下规则，从路由器推导出一组域名，并为其请求证书：

如果路由器设置了 tls.domains 选项，证书解析器就会从 tls.domains 的 main 选项推导出此路由器的域名。
否则，证书解析器会从路由器规则中的任意 Host() 或 HostSNI() 匹配器推导出域名。

Tailscale 域名格式

仅处理 Tailscale 专属域名，即格式为 machine-name.domains-alias.ts.net 的域名。

Tailscale 证书续期¶

Traefik 会自动跟踪所获取的每张 Tailscale 证书的到期时间，并在到期前 14 天开始续期，以符合 Tailscale 守护进程的续期策略。