Tricot, a replacement for Traefik
Go to file
Alex cca85653b1
Write up how Tricot works
2022-01-13 12:11:32 +01:00
src Make nodes aware of where they are and use that to priorize backends 2022-01-13 11:36:52 +01:00
.dockerignore Use self-signed certificates if necessary 2021-12-08 12:02:39 +01:00
.gitignore Add support for custom headers 2021-12-07 18:19:51 +01:00
Cargo.lock Add support for Consul TLS 2021-12-30 20:08:10 +01:00
Cargo.toml Add support for Consul TLS 2021-12-30 20:08:10 +01:00
Dockerfile Support totally ignoring backend HTTPS certificate stuff 2021-12-08 23:45:24 +01:00
Makefile First commit to Tricot, a replacement for Traefik v1 2021-12-06 23:08:22 +01:00 Write up how Tricot works 2022-01-13 12:11:32 +01:00
rustfmt.toml First commit to Tricot, a replacement for Traefik v1 2021-12-06 23:08:22 +01:00


Tricot is a reverse-proxy for exposing your services via TLS that integrates well with Consul and Nomad.

Tricot does the following things:

  • Find the services running on your cluster that expose an HTTP or HTTPS access point, by listing the Consul catalog
  • Request TLS certificats via Let's Encrypt for the domain names you are exposing
  • Store these certificates in Consul's key-value store
  • Renew these certificates when they reach half of their designated lifetime
  • Expose an HTTPS port where all of the requests are forwarded to one of the back-end services, based on matching rules (see below)
  • Expose an HTTP port that redirects everything to the HTTPS port (the HTTP port is mandatory as it is also used for Let's Encrypt validation)
  • Optionnally, compress data comming from the backend before forwarding it to the client

Configuring Tricot

Tricot uses the following environment variables for its configuration (they can also be passed as command line arguments, see --help):

  • TRICOT_LETSENCRYPT_EMAIL (mandatory): the e-mail address used to register a Let's encrypt account
  • TRICOT_NODE_NAME (mandatory): the name in Consul of the node on which this instance of Tricot is running
  • TRICOT_CONSUL_HOST (default: the HTTP or HTTPS address at which the Consul catalog can be reached
  • TRICOT_CONSUL_CA_CERT, TRICOT_CONSUL_CLIENT_CERT, TRICOT_CONSUL_CLIENT_KEY (optional): parameters necessary to access Consul over HTTPS when cluster TLS is enabled
  • TRICOT_CONSUL_KV_PREFIX (default: tricot/): the prefix in Consul's key-value store under which Tricot stores its data (the certificates it obtained from Lets Encrypt)
  • TRICOT_HTTP_BIND_ADDR (default: the HTTP address and port on which Tricot listens
  • TRICOT_HTTPS_BIND_ADDR (default: the HTTPS address and port on which Tricot listens
  • TRICOT_ENABLE_COMPRESSION (default: false): whether to enable transparent compression of data coming back from backends
  • TRICOT_COMPRESS_MIME_TYPES (default: text/html,text/plain,text/css,text/javascript,text/xml,application/javascript,application/json,application/xml,image/svg+xml,font/ttf): comma-separated list of MIME types for which Tricot will do compression

Adding and priorizing backends

Backends are configured by adding tags of the following form to the services in Consul:

  • tricot indicates that Tricot should get a TLS certificate for domain and route traffic for this domain to this service
  • tricot 10: same but with a priority of 10. This is lower than the default priority value of 100, so Tricot will only use this rule if no higher-priority services are available.
  • tricot same but indicates that only requests whose paths start with /path/to/subresource should be routed to this service
  • tricot 10: combining the previous two examples
  • tricot-https same, but indicates that the backend service handling the request expects an HTTPS request and not an HTTP request. In this case, Tricot will do everything in its power to NOT verify the backend's TLS certificate (ignore self-signed certificate, ignore TLS hostname, etc).
  • tricot-add-header Access-Control-Allow-Origin *: add the Access-Control-Allow-Origin: * header to all of the HTTP responses when they are proxied back to the client

Any number of such rules can be combined freely.

How Tricot matches backends

Tricot priorizes backend nodes in the following order:

  1. Select rule with the highest explicitly set priority value
  2. Select rule with the longest path prefix that matches the incoming request
  3. Select rule that redirects request to the same node Tricot is running on
  4. Select rule that redirects request to a node that is running in the same site (geographical region, datacenter, whatever) than the node Tricot is running on, based on the metadata key site in Consul's node information, if such information is available
  5. Round-robin selection of backend nodes