DEV Community

Cover image for Functions as a Service With SSL Using OpenFaaS, Docker Swarm, Traefik 2 and a Socket Proxy
Sophia Brandt
Sophia Brandt

Posted on • Originally published at rockyourcode.com on

Functions as a Service With SSL Using OpenFaaS, Docker Swarm, Traefik 2 and a Socket Proxy

#docker #go #serverless

Self-deployed FaaS with Docker Swarm

Serverless is all the rage right now. Instead of maintaining a server and its infrastructure, you can create self-contained functions that do the job.

This can be a boon for front-end developers. A bespoke front-end client written in React.js or another framework can easily be enhanced with back-end code.

It's now trivial to add a secure integration with a payment provider like Stripe.

You don't have to write, deploy and maintain separate back-end code (e.g., a Node.js and Express.js server).

One of the often-touted advantages of FaaS (Functions as a service) is the price. You only pay for what you're using.

Some providers, like Netlify, even offer a generous free tier.

But what happens when you want to avoid lock-in?

That's where OpenFaaS comes in. OpenFaaS is an open-source framework for functions-as-a-service, using Docker Swarm, Kubernetes or OpenShift.

We can deploy OpenFaaS to a VPS (Virtual Private Server) provider like Upcloud1 or DigitalOcean1. A small instance, which costs around $3 to $5 US dollars, is enough for a self-hosted FaaS setup.

In this post I will show you how to use Docker Swarm to deploy an OpenFaaS cluster. We'll also use Traefik 2 to provision SSL certificates for our functions for free.

Prerequisites

You will need a running cloud server.

I particularly like Hetzner and Upcloud, but you can use what you like.

Upcloud1 has top-notch performance for the 5-dollar-tier and a friendly customer support.

Hetzner has very cheap offerings under USD \$3. Their smallest offering is not very performant, but sufficient for our use case. Keep in mind that Hetnzer's servers are located in Germany and Finland.

For alternatives, check VPSBenchmarks.

Provision an Ubuntu 20.04 server, create and connect an SSH key, and don't forget about basic security.

You'll also want to have a domain. Namecheap is one of the services I use for buying domains, and so far I've been satisfied with them.

You need to find a way to connect your domain to the cloud server you just spun up. How you do it depends on your domain registrar and your VPS provider.

You'll need 3 subdomains for the following services: Traefik dashboard, OpenFaaS dashboard, Prometheus dashboard.

Let's say your domain name is myfaas.xyz.

Create A records for traefik.myfaas.xyz, faas.myfaas.xyz and prometheus.myfaas.xzy.

(The names for the subdomains are up to you, of course).

Here's a guide that might help you out.

Software Installation

I suggest using a non-root user with sudo access instead of the default root user.

SSH into your cloud server and install the necessary packages:

# Install Docker (https://docs.docker.com/engine/install/ubuntu/)
sudo DEBIAN_FRONTEND=noninteractive apt -y install \
  apt-transport-https \
  ca-certificates \
  curl \
  git \
  gnupg-agent \
  software-properties-common
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io
Enter fullscreen mode Exit fullscreen mode

Give the current user the necessary permissions:

sudo groupadd -f docker
sudo usermod -aG docker "${USER}"
Enter fullscreen mode Exit fullscreen mode

Log out of the session, so that the changes to can take place.

Install OpenFaaS and faas-cli

We'll be using Docker Swarm for deployment.

The default option is Kubernetes because of its richer ecosystem. But right now, I have no clue how Kubernetes works. And this guide shows you a setup for hobby projects, so Kubernetes would be overkill anyway.

I'm familiar with Docker, so Docker Swarm it is.

You can also use faasd, a simpler alternative. faasd uses containerd instead of Docker.

But although Docker uses containerd, they are not the same.

That means that automatic SSL certificate generation via Traefik 2 does not work. Traefik works with a few providers like Docker or Kubernetes, but not with bare-bones containerd.

Edit: What you can do is add Terraform (infrastructure as code) and use it to install Caddy (a server) to provision SSL certificates. Guide here.

Thanks to Alex Ellis, creator of OpenFaaS & faasd, for pointing that out.

We'll now use the official deployment guide for Docker Swarm on the OpenFaaS docs.

1. Install faas-cli 

curl -sL https://cli.openfaas.com | sudo sh
Enter fullscreen mode Exit fullscreen mode

2. Docker Swarm Setup

In preparation for the Traefik 2 setup, we'll create the necessary environment variables. The following section is more or less a copy of the guide from dockerswarm.rocks.

docker swarm init
Enter fullscreen mode Exit fullscreen mode

We will use the docker socket proxy by Tecnativa to protect our Docker unix socket.

The socket proxy is a security measure that's encouraged by Traefik.

Get the Swarm node ID of the current node and store it in an environment variable:

export NODE_ID=$(docker info -f '{{.Swarm.NodeID}}')
Enter fullscreen mode Exit fullscreen mode

Now we'll add a tag to the node to ensure that we'll always deploy to the same node. Why?

We need a way to ensure that the SSL certificates are available to the Docker node that runs Traefik (which handles the provision of the certificates).

docker node update --label-add traefik-public.traefik-certificates=true $NODE_ID
Enter fullscreen mode Exit fullscreen mode

Now we need to find a way to create an admin username and password for both the Traefik admin dashboard and the Prometheus monitoring service.

OpenFaaS will automatically provide basic auth for the functions dashboard.

In my example, I will use environment variables. You can also use docker secrets, which is a more secure approach. But it's also trickier to set up and harder to change as Docker secrets are immutable.

export TRAEFIK_ADMINS=admin:$(openssl passwd -apr1)
Enter fullscreen mode Exit fullscreen mode

Here, admin is your desired username for login. Change it to something else if you like. You will be prompted for a password. The command will hash the password for you.

We'll do the same for the Prometheus dashboard:

export PROMETHEUS_ADMINS=admin:$(openssl passwd -apr1)
Enter fullscreen mode Exit fullscreen mode

We will use Let's Encrypt to generate SSL certificates. Provide an email as unique identifier:

export EMAIL=myemail@email.com
Enter fullscreen mode Exit fullscreen mode

Next up, we'll add the domains for the services. Assuming we want to deploy the Traefik dashboard to traefik.myfaas.xyz, we create the environment variable like this:

export TRAEFIK_DOMAIN=traefik.myfaas.xyz
Enter fullscreen mode Exit fullscreen mode

Don't forget the Prometheus dashboard and also the domain for the functions:

export PROMETHEUS_DOMAIN=prometheus.myfaas.xyz
export FAAS_DOMAIN=functions.myfaas.xyz
Enter fullscreen mode Exit fullscreen mode

3. Download OpenFaaS

You should be in the home directory of your (non-root) user on your VPS.

Let's use git to get a copy of OpenFaaS:

git clone https://github.com/openfaas/faas && cd faas
Enter fullscreen mode Exit fullscreen mode

4. Prepare for Traefik and Docker Socket Proxy

The OpenFaaS stack provides you with a docker-compose.yml. We now need to tweak it for our needs.

This step is quite tricky, because it's easy to get indentation errors when editing yaml files.

First, open the ready-made docker-compose.yml file and take a look around. You will find several services for the OpenFaaS gateway, Prometheus, etc.

4.1. Adjust Existing Configuration

The default network is functions. We'll need to add another network for the services that Traefik should make public (the Traefik dashboard, the Prometheus dashboard and the OpenFaaS dashboard).

Find the networks section at the end of the file and add a new network. Also add a volume forThe SSL certificates:

networks:
+    traefik-public:
+        driver: overlay
+        attachable: true
    functions:
        driver: overlay
        attachable: true
        labels:
            - "openfaas=true"

+volumes:
+    traefik-public:
Enter fullscreen mode Exit fullscreen mode

Add the traefik-public network to all service that we can reach via the internet: gateway, prometheus, and later traefik.

Also remove the external facing ports from the services gateway and prometheus. Traefik will handle that for us:

  gateway:
        image: openfaas/gateway:0.18.18
-        ports:
-            - 8080:8080
        networks:
             - functions
+            - traefik-public

...


  prometheus:
      image: prom/prometheus:v2.11.0
      ...
-      ports:
-          - 9090:9090
      networks:
           - functions
+          - traefik-public
Enter fullscreen mode Exit fullscreen mode

Let's now setup Traefik and the Docker socket proxy services:

services:
+  socket-proxy:
+    image: 'tecnativa/docker-socket-proxy:latest'
+    environment:
+      # required permissions
+      NETWORKS: 1
+      SERVICES: 1
+      TASKS: 1
+      POST: 1
+    deploy:
+      restart_policy:
+        condition: on-failure
+      placement:
+        constraints:
+          - node.role == manager
+    networks:
+      - traefik-public
Enter fullscreen mode Exit fullscreen mode

Let's use the security-enhanced socket in the faas-swarm service:

  faas-swarm:
    image: 'openfaas/faas-swarm:0.9.0'
    networks:
      - functions
+     - traefik-public
    environment:
      read_timeout: 5m5s
      write_timeout: 5m5s
      DOCKER_API_VERSION: '1.30'
+     DOCKER_HOST: 'tcp://traefik-public:2375'
      basic_auth: '${BASIC_AUTH:-false}'
Enter fullscreen mode Exit fullscreen mode

The Traefik setup is significantly more complicated. Explaining all the moving parts is beyond the scope of this post.

I suggest these two posts and the official Traefik documentation to get started.

+    traefik:
+        image: traefik:v2.2
+        command:
+          - --entrypoints.web.address=:80
+          - --entrypoints.websecure.address=:443
+          - --providers.docker=true
+          - --providers.docker.swarmMode=true
+          - --providers.docker.network=faas_traefik-public
+          - --providers.docker.exposedByDefault=false
+          - --providers.docker.endpoint=tcp://socket-proxy:2375
+          - --api.dashboard=true
+          - --log.level=ERROR
+          - --certificatesresolvers.letsencrypt.acme.email=${EMAIL?Variable not defined}
+          - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
+          - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
+       deploy:
+         restart_policy:
+           condition: on-failure
+         placement:
+           constraints:
+             - node.labels.traefik-public.traefik-certificates == true
+             - node.role == manager
+         labels:
+             # Redirect to https
+             - traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)
+             - traefik.http.routers.http-catchall.entrypoints=web
+             - traefik.http.routers.http-catchall.middlewares=redirect-to-https
+             - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
+             - traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true
+
+             # Dashboard
+             - traefik.http.routers.api.entrypoints=websecure
+             - traefik.http.routers.api.rule=(Host(`${TRAEFIK_DOMAIN?Variable not defined}`)
+             - traefik.http.routers.api.middlewares=api-auth
+             - traefik.http.middlewares.api-auth.basicauth.users=${TRAEFIK_ADMINS?Variable not set}
+             - traefik.http.routers.api.service=api@internal
+             - traefik.http.services.gateway.loadbalancer.server.port=8080
+           ports:
+             - 80:80
+             - 443:443
+           networks:
+             - traefik-public
+           volumes:
+               - traefik-certificates:/letsencrypt
+               - /home/$USER/traefik/traefik_conf:/traefik_conf
Enter fullscreen mode Exit fullscreen mode

Finally, we'll need to tell Traefik which containers it should make publicly available. For that feat, we must add labels to the services gateway and prometheus:

    gateway:
        image: openfaas/gateway:0.18.18
        ...
        deploy:
+           labels:
+               - traefik.enable=true
+               - traefik.constraint-label=traefik-public
+               - traefik.http.routers.gateway.entrypoints=websecure
+               - traefik.http.routers.gateway.rule=Host(`${FAAS_DOMAIN?Variable not set`)
+               - traefik.http.routers.gateway.tls.certresolver=letsencrypt
+               - traefik.http.services.gateway.loadbalancer.server.port=8080
Enter fullscreen mode Exit fullscreen mode

The same for the Prometheus dashboard:

    prometheus:
    ...
        deploy:
+           labels:
+               - traefik.enable=true
+               - traefik.constraint-label=traefik-public
+               - traefik.http.routers.gateway.entrypoints=websecure
+               - traefik.http.routers.gateway.rule=Host(`${PROMETHEUS_DOMAIN?Variable not set`)
+               - traefik.http.routers.gateway.tls.certresolver=letsencrypt
+               - traefik.http.services.gateway.loadbalancer.server.port=9090
Enter fullscreen mode Exit fullscreen mode

4.2. Final Configuration

This is the final docker-compose.yml.

I've updated the docker version to 3.8 and ran the file through a yaml prettifier to avoid indentation errors.

version: '3.8'
services:
  socket-proxy:
    image: 'tecnativa/docker-socket-proxy:latest'
    environment:
      NETWORKS: 1
      SERVICES: 1
      TASKS: 1
      POST: 1
    deploy:
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.role == manager
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock:ro'
    networks:
      - traefik-public
  traefik:
    image: 'traefik:v2.2'
    restart: unless-stopped
    command:
      - '--entrypoints.web.address=:80'
      - '--entrypoints.websecure.address=:443'
      - '--providers.docker=true'
      - '--providers.docker.swarmMode=true'
      - '--providers.docker.endpoint=tcp://socket-proxy:2375'
      - '--providers.docker.network=faas_traefik-public'
      - '--providers.docker.exposedByDefault=false'
      - '--api.dashboard=true'
      - '--log.level=ERROR'
      - >-
        --certificatesresolvers.letsencrypt.acme.email=${EMAIL?Variable not
        defined}
      - '--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json'
      - '--certificatesresolvers.letsencrypt.acme.tlschallenge=true'
    deploy:
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.labels.traefik-public.traefik-certificates == true
          - node.role == manager
      labels:
        - 'traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)'
        - traefik.http.routers.http-catchall.entrypoints=web
        - traefik.http.routers.http-catchall.middlewares=redirect-to-https
        - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
        - >-
          traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true
        - traefik.http.routers.api.entrypoints=websecure
        - >-
          traefik.http.routers.api.rule=(Host(`${TRAEFIK_DOMAIN?Variable not
          defined}`)
        - traefik.http.routers.api.middlewares=api-auth
        - >-
          traefik.http.middlewares.api-auth.basicauth.users=${TRAEFIK_ADMINS?Variable
          not defined}
        - traefik.http.routers.api.service=api@internal
        - traefik.http.services.gateway.loadbalancer.server.port=8080
    ports:
      - '80:80'
      - '443:443'
    networks:
      - traefik-public
    volumes:
      - 'traefik-certificates:/letsencrypt'
      - '/home/$USER/traefik/traefik_conf:/traefik_conf'
  gateway:
    image: 'openfaas/gateway:0.18.18'
    networks:
      - functions
      - traefik-public
    environment:
      functions_provider_url: 'http://faas-swarm:8080/'
      read_timeout: 5m5s
      write_timeout: 5m5s
      upstream_timeout: 5m
      dnsrr: 'true'
      faas_nats_address: nats
      faas_nats_port: 4222
      direct_functions: 'true'
      direct_functions_suffix: ''
      basic_auth: '${BASIC_AUTH:-false}'
      secret_mount_path: /run/secrets/
      scale_from_zero: 'true'
      max_idle_conns: 1024
      max_idle_conns_per_host: 1024
      auth_proxy_url: '${AUTH_URL:-}'
      auth_proxy_pass_body: 'false'
    deploy:
      labels:
        - traefik.enable=true
        - traefik.constraint-label=traefik-public
        - traefik.http.routers.gateway.entrypoints=websecure
        - >-
          traefik.http.routers.gateway.rule=Host(`${FAAS_DOMAIN?Variable not
          defined}`)
        - traefik.http.routers.gateway.tls.certresolver=letsencrypt
        - traefik.http.services.gateway.loadbalancer.server.port=8080
      resources:
        reservations:
          memory: 100M
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 20
        window: 380s
      placement:
        constraints:
          - node.platform.os == linux
    secrets:
      - basic-auth-user
      - basic-auth-password
  basic-auth-plugin:
    image: 'openfaas/basic-auth-plugin:0.18.18'
    networks:
      - functions
    environment:
      secret_mount_path: /run/secrets/
      user_filename: basic-auth-user
      pass_filename: basic-auth-password
    deploy:
      placement:
        constraints:
          - node.role == manager
          - node.platform.os == linux
      resources:
        reservations:
          memory: 50M
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 20
        window: 380s
    secrets:
      - basic-auth-user
      - basic-auth-password
  faas-swarm:
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock:ro'
    image: 'openfaas/faas-swarm:0.9.0'
    networks:
      - functions
    environment:
      read_timeout: 5m5s
      write_timeout: 5m5s
      DOCKER_API_VERSION: '1.30'
      basic_auth: '${BASIC_AUTH:-false}'
      secret_mount_path: /run/secrets/
    deploy:
      placement:
        constraints:
          - node.role == manager
          - node.platform.os == linux
      resources:
        reservations:
          memory: 100M
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 20
        window: 380s
    secrets:
      - basic-auth-user
      - basic-auth-password
  nats:
    image: 'nats-streaming:0.17.0'
    command: '--store memory --cluster_id faas-cluster'
    networks:
      - functions
    deploy:
      resources:
        limits:
          memory: 125M
        reservations:
          memory: 50M
      placement:
        constraints:
          - node.platform.os == linux
  queue-worker:
    image: 'openfaas/queue-worker:0.11.2'
    networks:
      - functions
    environment:
      max_inflight: '1'
      ack_wait: 5m5s
      basic_auth: '${BASIC_AUTH:-false}'
      secret_mount_path: /run/secrets/
      gateway_invoke: 'true'
      faas_gateway_address: gateway
    deploy:
      resources:
        limits:
          memory: 50M
        reservations:
          memory: 20M
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 20
        window: 380s
      placement:
        constraints:
          - node.platform.os == linux
    secrets:
      - basic-auth-user
      - basic-auth-password
  prometheus:
    image: 'prom/prometheus:v2.11.0'
    environment:
      no_proxy: gateway
    configs:
      - source: prometheus_config
        target: /etc/prometheus/prometheus.yml
      - source: prometheus_rules
        target: /etc/prometheus/alert.rules.yml
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
    networks:
      - functions
      - traefik-public
    deploy:
      labels:
        - traefik.enable=true
        - traefik.constraint-label=traefik-public
        - traefik.http.routers.gateway.entrypoints=websecure
        - >-
          traefik.http.routers.gateway.rule=Host(`${PROMETHEUS_DOMAIN?Variable
          not defined}`)
        - traefik.http.routers.gateway.tls.certresolver=letsencrypt
        - traefik.http.services.gateway.loadbalancer.server.port=8080
      placement:
        constraints:
          - node.role == manager
          - node.platform.os == linux
      resources:
        limits:
          memory: 500M
        reservations:
          memory: 200M
  alertmanager:
    image: 'prom/alertmanager:v0.18.0'
    environment:
      no_proxy: gateway
    command:
      - '--config.file=/alertmanager.yml'
      - '--storage.path=/alertmanager'
    networks:
      - functions
    deploy:
      resources:
        limits:
          memory: 50M
        reservations:
          memory: 20M
      placement:
        constraints:
          - node.role == manager
          - node.platform.os == linux
    configs:
      - source: alertmanager_config
        target: /alertmanager.yml
    secrets:
      - basic-auth-password
configs:
  prometheus_config:
    file: ./prometheus/prometheus.yml
  prometheus_rules:
    file: ./prometheus/alert.rules.yml
  alertmanager_config:
    file: ./prometheus/alertmanager.yml
networks:
  traefik-public:
    driver: overlay
    attachable: true
  functions:
    driver: overlay
    attachable: true
volumes:
  traefik-public: null
secrets:
  basic-auth-user:
    external: true
  basic-auth-password:
    external: true
Enter fullscreen mode Exit fullscreen mode

Deploy Functions

You can deploy new functions via the dashboard. It's available under the url of the FAAS_DOMAIN environment variable.

openfaas ui

OpenFaaS automatically created an admin user with password. You should have seen the credentials in your terminal. If don't have have them, check the troubleshooting guide for forgetting the gateway password.

You can also use the faas-cli command-line utility. It offers pre-made templates and convenience wrappers for pushing to a container registry.

More info on the official website.

Final Thoughts

Docker Swarm, Traefik 2 and OpenFaaS play very well together. OpenFaaS offers you an agnostic framework for serverless functions without vendor lock-in. The faas-cli and the dashboard are very user-friendly.

Traefik 2 shows all its power as a load-balancer and edge router with automatic provisioning of SSL certificates via Let's Encrypt. It plays well with the OpenFaaS architecture.

You should give it a try.

Further Reading

  1. affiliate links - you'll get free credit and I also get some - thank you! ↩

Top comments (0)

Read next

notharshhaa profile image

Writing a Dockerfile: Beginners to Advanced

H A R S H H A A -

pmbanugo profile image

How We Moved from AWS to Fly.io

Peter Mbanugo -

johnantony92 profile image

Why serverless is no magic wand?

John Antony -

rakibtweets profile image

Dockerizing an Express App with MongoDB Database

Rakib Hasan -