rybbit + docker + traefik

[ruibaby]

Hello everyone, I'd like to share my personal approach to using Traefik (docker mode) to proxy Rybbit. This is just for reference, and I hope it helps others who want to use this solution. I haven't encountered any issues with this method so far.

rybbit/docker-compose.yaml:

services:
  clickhouse:
    image: clickhouse/clickhouse-server:25.4.2
    volumes:
      - clickhouse-data:/var/lib/clickhouse
      - ./clickhouse_config:/etc/clickhouse-server/config.d
    networks:
      track:
    environment:
      - CLICKHOUSE_DB=${CLICKHOUSE_DB:-analytics}
      - CLICKHOUSE_USER=${CLICKHOUSE_USER:-default}
      - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD:-frog}
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:8123/ping",
        ]
      interval: 3s
      timeout: 5s
      retries: 5
      start_period: 10s
    restart: unless-stopped

  postgres:
    image: postgres:17.4
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-frog}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-frog}
      - POSTGRES_DB=${POSTGRES_DB:-analytics}
    networks:
      track:
    volumes:
      - postgres-data:/var/lib/postgresql/data
    restart: unless-stopped

  backend:
    image: ghcr.io/rybbit-io/rybbit-backend:${IMAGE_TAG:-latest}
    build:
      context: ./server
      dockerfile: Dockerfile
    networks:
      track:
      traefik:
    environment:
      - NODE_ENV=production
      - CLICKHOUSE_HOST=http://clickhouse:8123
      - CLICKHOUSE_DB=${CLICKHOUSE_DB:-analytics}
      - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD:-frog}
      - POSTGRES_HOST=postgres
      - POSTGRES_PORT=5432
      - POSTGRES_DB=${POSTGRES_DB:-analytics}
      - POSTGRES_USER=${POSTGRES_USER:-frog}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-frog}
      - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
      - BASE_URL=${BASE_URL}
      - DISABLE_SIGNUP=${DISABLE_SIGNUP}
    depends_on:
      clickhouse:
        condition: service_healthy
      postgres:
        condition: service_started
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.docker.network: traefik
      traefik.http.routers.backend-api.rule: "Host(`yourdomain.com`) && PathPrefix(`/api`)"
      traefik.http.routers.backend-api.tls: "true"
      traefik.http.routers.backend-api.tls.certresolver: myresolver
      traefik.http.services.backend-api.loadbalancer.server.port: 3001
      traefik.http.middlewares.strip-api-prefix.stripprefix.prefixes: /api
      traefik.http.routers.backend-api.middlewares: strip-api-prefix
      traefik.http.routers.backend-api.priority: 2

  client:
    image: ghcr.io/rybbit-io/rybbit-client:${IMAGE_TAG:-latest}
    networks:
      track:
      traefik:
    build:
      context: ./client
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_BACKEND_URL: ${BASE_URL}
        NEXT_PUBLIC_DISABLE_SIGNUP: ${DISABLE_SIGNUP}
    environment:
      - NODE_ENV=production
      - NEXT_PUBLIC_BACKEND_URL=${BASE_URL}
      - NEXT_PUBLIC_DISABLE_SIGNUP=${DISABLE_SIGNUP}
    depends_on:
      - backend
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.docker.network: traefik
      traefik.http.routers.client.rule: Host(`yourdomain.com`)
      traefik.http.routers.client.tls: "true"
      traefik.http.routers.client.tls.certresolver: myresolver
      traefik.http.services.client.loadbalancer.server.port: 3002
      traefik.http.routers.client.priority: 1

volumes:
  clickhouse-data:
  postgres-data:
networks:
  track:
  traefik:
    external: true

rybbit/.env:

DOMAIN_NAME=<yourdomain.com>
BASE_URL=<https://yourdomain.com>
BETTER_AUTH_SECRET=<please-change-this-secret>
DISABLE_SIGNUP=false
USE_WEBSERVER=true
HOST_BACKEND_PORT="127.0.0.1:3001:3001"
HOST_CLIENT_PORT="127.0.0.1:3002:3002"
IMAGE_TAG="v0.4.2"

traefik/docker-compose.yaml:

networks:
  traefik:
    name: traefik
    attachable: true

services:
  traefik:
    image: traefik:v2.11
    container_name: traefik
    networks:
      - traefik
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
      - ./logs:/var/log/traefik
    command: >
      --api.dashboard=true
      --entrypoints.web.address=:80
      --entrypoints.websecure.address=:443
      --entrypoints.web.http.redirections.entrypoint.to=websecure
      --entrypoints.web.http.redirections.entrypoint.scheme=https
      --providers.docker=true
      --providers.docker.watch=true
      --providers.docker.exposedbydefault=false
      --certificatesresolvers.myresolver.acme.httpchallenge=true
      --certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web
      --certificatesresolvers.myresolver.acme.email=<your@mail.com>
      --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json

      --accesslog=false
      --accesslog.filepath=/var/log/traefik/access.log
      --accesslog.format=json

Note: Using this approach, it's not necessary to clone the entire Rybbit repository or use the setup.sh script. You can simply create the docker-compose.yaml and .env files manually. Therefore, this method is suitable for people who have some familiarity with Docker.

[goldflag]

this is pretty cool! We might want to add it to the docs as well

[ruibaby]

Note, after upgrading to 1.0.0, you need to make some modifications to the Traefik configuration:

...
  backend:
    image: ghcr.io/rybbit-io/rybbit-backend:${IMAGE_TAG:-latest}
    build:
      context: ./server
      dockerfile: Dockerfile
    networks:
      track:
      traefik:
    environment:
      - NODE_ENV=production
      - CLICKHOUSE_HOST=http://clickhouse:8123
      - CLICKHOUSE_DB=${CLICKHOUSE_DB:-analytics}
      - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD:-frog}
      - POSTGRES_HOST=postgres
      - POSTGRES_PORT=5432
      - POSTGRES_DB=${POSTGRES_DB:-analytics}
      - POSTGRES_USER=${POSTGRES_USER:-frog}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-frog}
      - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
      - BASE_URL=${BASE_URL}
      - DISABLE_SIGNUP=${DISABLE_SIGNUP}
    depends_on:
      clickhouse:
        condition: service_healthy
      postgres:
        condition: service_started
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.docker.network: traefik
      traefik.http.routers.backend-api.rule: "Host(`yourdomain.com`) && PathPrefix(`/api`)"
      traefik.http.routers.backend-api.tls: "true"
      traefik.http.routers.backend-api.tls.certresolver: myresolver
      traefik.http.services.backend-api.loadbalancer.server.port: 3001
-     traefik.http.middlewares.strip-api-prefix.stripprefix.prefixes: /api
-     traefik.http.routers.backend-api.middlewares: strip-api-prefix
      traefik.http.routers.backend-api.priority: 2
...