Install Pando

Traefik

traefik Gives apps their own hostnames through a Traefik Pando runs on ports 80 and 443, with certificates.

Setup

  1. Choose who runs Traefik

    Settings managed

  2. Point your Traefik at Pando's routes

    1. Start Traefik with --providers.file.directory set to a directory, and --providers.file.watch=true.
    2. Mount that directory into Pando at /etc/traefik/dynamic.
    3. Copy the name of a resolver under certificatesResolvers in Traefik's static configuration.

    Open Traefik's certificate resolver docs

    Settings cert_resolver · Only when managed is false

  3. Choose a domain

    1. At your DNS provider, add A records for the base domain, *. plus the base domain, and the console hostname, pointing at this machine's public IP address.

    Settings base_domain, console_hostname

  4. Choose how certificates are issued

    Settings certificates, acme_email · Only when managed is true

  5. Create DNS provider credentials

    1. At the provider that hosts the base domain, create a credential with this access:
      ProviderAccessVariables
      CloudflareAPI token with Zone / Zone / Read and Zone / DNS / EditCF_DNS_API_TOKEN
      Amazon Route 53IAM user access key allowed route53:GetChange, route53:ListHostedZonesByName, route53:ListResourceRecordSets and route53:ChangeResourceRecordSetsAWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION
      DigitalOceanPersonal access token with the domain:create, domain:read and domain:delete scopesDO_AUTH_TOKEN
      PorkbunAPI key, with API Access turned on in the domain's detailsPORKBUN_API_KEY, PORKBUN_SECRET_API_KEY
      NamecheapAPI access, with this machine's IPv4 address whitelistedNAMECHEAP_API_USER, NAMECHEAP_API_KEY
    2. For another provider, find its code and variables in the lego DNS provider list.
    3. Enter each variable below as NAME=value, one to a line. For Route 53, add AWS_REGION=us-east-1.

    Open Cloudflare API tokensOpen AWS IAM usersOpen DigitalOcean tokensOpen Porkbun API accessOpen Namecheap API accessOpen lego DNS providers

    Settings dns_provider, dns_credentials · Only when certificates is dns

Settings (18)
base_domainBase domain

Apps are served at <app>.<base domain>. Point this domain and *.<base domain> at this machine.

string · For example apps.example.com

console_hostnameConsole hostname

Where the console is served over HTTPS.

string · For example pando.example.com

certificatesCertificates
  • http One per hostname — Let's Encrypt checks each hostname over port 80, which has to be reachable from the internet.
  • dns One wildcard for the base domain — Covers every app before it exists. Needs your DNS provider's credentials.
  • none None — Apps are served over plain HTTP on port 80.

one of the values above · Default none

acme_emailCertificate email

The address Let's Encrypt registers the account to.

string · For example [email protected] · Used when certificates is http or dns

dns_providerDNS provider

Who hosts the base domain's DNS. Another provider is entered as its code, such as gcloud or ovh.

  • cloudflare Cloudflare
  • route53 Amazon Route 53
  • digitalocean DigitalOcean
  • porkbun Porkbun
  • namecheap Namecheap
  • or another value

one of the values above · Used when certificates is dns

dns_credentialsDNS provider credentialsCredential

One NAME=value per line. Cloudflare: CF_DNS_API_TOKEN, or CF_API_EMAIL and CF_API_KEY. Amazon Route 53: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_REGION (AWS_REGION can be us-east-1 for any standard AWS account, since Route 53 is global). DigitalOcean: DO_AUTH_TOKEN. Porkbun: PORKBUN_API_KEY and PORKBUN_SECRET_API_KEY. Namecheap: NAMECHEAP_API_USER and NAMECHEAP_API_KEY. For another provider, the variables Traefik's documentation lists for it.

string · Used when certificates is dns

managedPando runs Traefik

Off for a Traefik already running on this machine.

bool · Default true

http_portHTTP portAdvanced

The host port Traefik takes for HTTP.

int · Default 80 · Used when managed is true

https_portHTTPS portAdvanced

The host port Traefik takes for HTTPS.

int · Default 443 · Used when managed is true

imageTraefik imageAdvanced

Set to run a different Traefik release than this Pando ships with.

string · Default traefik:v3.7.15 · Used when managed is true

deliveryRoute deliveryAdvanced

How routes reach Traefik. Use IngressRoutes with the Kubernetes runtime.

  • shared_mount Files — Route files in a directory Traefik mounts. The Docker runtime.
  • kubernetes_api IngressRoutes — IngressRoute objects Traefik watches in the cluster's API. The Kubernetes runtime.

one of the values above · Default shared_mount

namespaceIngressRoute namespaceAdvanced

The namespace Pando writes IngressRoute objects to, which Traefik watches.

string · Default pando-edge · Used when delivery is kubernetes_api

kubeconfigKubeconfig fileAdvanced

A kubeconfig file, for reaching the cluster from outside it.

string · Default The cluster Pando runs in · Used when delivery is kubernetes_api

api_qpsAPI requests a secondAdvanced

The most requests a second each Pando replica makes to the cluster's API for routes.

int · Default 100 · Used when delivery is kubernetes_api

api_burstAPI request burstAdvanced

How many requests a replica may make at once above that rate. At least the requests a second.

int · Default 200 · Used when delivery is kubernetes_api

dirConfiguration directoryAdvanced

Where Pando writes Traefik's route files.

string · Default /etc/traefik/dynamic

entrypointEntry pointAdvanced

The entry point of your Traefik that apps are served on.

string · Default websecure · Used when managed is false

cert_resolverCertificate resolver

The certificate resolver your Traefik has configured. Empty asks for no certificates.

string · For example letsencrypt · Used when managed is false