Fabio Orefice Amez's questions

In the end, after a LOT of time spent on configuration, I’m out of ideas. Something that’s supposed to be quite simple is becoming rather complicated. Hopefully, someone else can help me find the solution.

I’m trying to run a container with Traefik. Instead of putting all the configuration in the container's docker-compose file (docker-compose.yml), as many people do, I’m placing the configuration in a dedicated file (traefik.yml) since that’s more flexible for me.

I have the following docker-compose.yml file for Traefik:

version: "3.8"

services:
  traefik:
    image: traefik:latest
    hostname: traefik
    container_name: traefik
    restart: unless-stopped
    command:
      - "--configFile=/traefik.yml"
    networks:
      - traefik_gw_bridge
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    volumes:
      - ./traefik.yml:/traefik.yml
      - logs:/logs
      - letsencrypt:/letsencrypt
      - /var/run/docker.sock:/var/run/docker.sock:ro
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 10s
      timeout: 6s
      retries: 2
      start_period: 5s

networks:
  traefik_gw_bridge:
    driver: bridge
    external: true

volumes:
  letsencrypt:
  logs:

And these are the configuration parameters I am using for traefik.yml:

api:
  dashboard: true     
  insecure: false    

ping:
  entryPoint: web      

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false 

entryPoints:
  web:
    address: ":80"   
  websecure:
    address: ":443"   
  traefik:
    address: ":8080" 

http:
  routers:
    dashboard:
      rule: "Host(`traefikdash.mydomain.com`)" 
      entryPoints:
        - traefik
      service: api@internal
      middlewares:
        - auth

  middlewares:
    auth:
      basicAuth:
        users:
          - "admin:$apr1$Nzj4xQwY$QiXQ/eYHzKTFS.Lx.6XG71"

log:                              
  filePath: "/logs/traefik.log"
  format: json
  level: DEBUG

accessLog:                        
  filePath: "/logs/access.log"
  bufferingSize: 150

certificatesResolvers:
  le:    
    acme:
      email: "[email protected]"    
      storage: "/letsencrypt/acme.json"  
      httpChallenge:
        entryPoint: "web" 

Logically, in the following part of the configuration file, I am trying to define a router to set up basic authentication with a username and password for the Dashboard:

http:
  routers:
    dashboard:
      rule: "Host(`traefikdash.mydomain.com`)"  # Reemplaza `yourdomain.com` con tu dominio
      entryPoints:
        - traefik
      service: api@internal
      middlewares:
        - auth

  middlewares:
    auth:
      basicAuth:
        users:
          - "admin:$apr1$Nzj4xQwY$QiXQ/eYHzKTFS.Lx.6XG71"

I am unable to get the result I want. When I access traefikdash.mydomain.com or traefikdash.mydomain.com:8080 or traefikdash.mydomain.com:8080/dashboard / traefikdash.mydomain.com/dashboard, I simply get the following responses from Traefik and my browser:

• HTTP 404 Page not found
• Error connection refused

After trying various types of configurations, I simply can't find much more information on how to implement HTTP basic auth to access the Traefik Dashboard.

You will see, I have a little problem with the execution of an Ansible task, since I am giving it the same command that I work with in the Mikrotik shell, but the result is a little different and I just don't understand why.

You will see, I am trying to write a few concrete subnets to make permissive passage with SSH from those subnets, a "Available From" of all life, to allow connection only from the subnets that I indicate.

The execution of the command from the Mikrotik shell is as follows:

/ip service set ssh address=10.0.0.0/8,172.16.0.0/12,19
2.168.0.0/16

And the result is the following:

- hosts: Mikrotik-Routers_TestSenseLlum
  remote_user: admin
  gather_facts: no
  connection: network_cli
  tasks:

    - name: Allow ssh only inside the private networks
      routeros_command:
        commands: /ip service set ssh address=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

The result is wrong, only enter the first subnet, 10, but the others, do not enter them.

I don't know exactly what the problem is, has something similar happened to someone?

I have had a small problem that I did not find in the Ansible documentation, I would like to be able to attack several ssh ports with my playbooks, is there a way to tell Ansible that, apart from port 22, attack more ports?

It seems to me that the most logical thing would be to do it with variables in the Ansible playbooks, but I can't find too much information about this, does anyone have the same problem?

I have a problem that I cannot understand how to solve ...

From my ansible central machine I have written a routine for Mikrotik, to execute a series of configuration commands and thus auto provision my RBs, but it returns the following error, and I just don't know how to pass the OS detection configuration to me asks, do I have to pass it to it as a variable in the Ansible configuration file? About Ansible's own script? I just couldn't find much info about it.

Error :

fatal: [10.0.21.10]: FAILED! => {"msg": "Unable to automatically determine host network os. Please manually configure ansible_network_os value for this host"}

If someone has already worked on Ansible + Mikrotik automation I would really appreciate the clarification!

I have a small problem / doubt about the use of Samba4 as a central authenticator of external applications, I explain, I am instantiating a Samba4 server as a PDC for domain authentication for some computers with W10, but already taking advantage of it I wanted to configure it as a central authenticator for applications .

In many applications I see that they allow LDAP / AD connection, but it is not clear to me if it differs between LDAP and Active Directory, may it be necessary to use Samba4 in combination with OpenLDAP as a backend to authenticate applications? Or can only Samba4 be used for everything?

After trying to authenticate the logins of the applications through Samba4 (PHPIPAM, NextCloud, Proxmox, Nagios) I have only achieved a good user authentication in Proxmox, the other applications give me many problems.

In summary, someone who has experience configuring central authentication environments can clarify how I can mount the server and if I have to do it using Samba4 and LDAP, or only Samba4?

I have a problem with my proxmox node, I have to reconfigure the server disks, since having them badly configured, I cannot perform snapshots quickly since they are badly mounted and the io is very slow, therefore, I have migrated all my machines out of the server, with the intention of I compress virtual disks myself using the proxmox vma format together with lzo compression, but I can't find anywhere, how to make vma backups via command line.

Does anyone know how vma backups are made by command line?