ginskill-init 2.7.0

package/skills/traefik/docs/docker-compose.md

@@ -0,0 +1,182 @@
+# Traefik Docker Compose Patterns
+
+## Production Docker Compose
+
+```yaml
+services:
+  traefik:
+    image: traefik:v3.6
+    container_name: traefik
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    ports:
+      - "80:80"
+      - "443:443"
+    environment:
+      - CF_DNS_API_TOKEN_FILE=/run/secrets/cf_api_token
+    secrets:
+      - cf_api_token
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./traefik.yml:/etc/traefik/traefik.yml:ro
+      - ./dynamic:/etc/traefik/dynamic:ro
+      - ./acme.json:/acme.json
+      - ./logs:/var/log/traefik
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      # Dashboard
+      - "traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)"
+      - "traefik.http.routers.dashboard.entrypoints=websecure"
+      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.dashboard.service=api@internal"
+      - "traefik.http.routers.dashboard.middlewares=dashboard-auth"
+      - "traefik.http.middlewares.dashboard-auth.basicauth.users=admin:$$apr1$$xyz$$hash"
+
+  # Backend service example
+  app:
+    image: myapp:latest
+    restart: unless-stopped
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.app.rule=Host(`app.example.com`)"
+      - "traefik.http.routers.app.entrypoints=websecure"
+      - "traefik.http.routers.app.tls.certresolver=letsencrypt"
+      - "traefik.http.services.app.loadbalancer.server.port=8080"
+      - "traefik.http.routers.app.middlewares=security-headers@file,rate-limit@file"
+
+secrets:
+  cf_api_token:
+    file: ./secrets/cf_api_token.txt
+
+networks:
+  proxy:
+    external: true  # docker network create proxy
+```
+
+## With Docker Socket Proxy (recommended)
+
+```yaml
+services:
+  socket-proxy:
+    image: tecnativa/docker-socket-proxy
+    container_name: socket-proxy
+    restart: unless-stopped
+    environment:
+      CONTAINERS: 1
+      SERVICES: 0
+      TASKS: 0
+      NETWORKS: 0
+      NODES: 0
+      IMAGES: 0
+      VOLUMES: 0
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - socket-proxy
+
+  traefik:
+    image: traefik:v3.6
+    container_name: traefik
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    depends_on:
+      - socket-proxy
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./traefik.yml:/etc/traefik/traefik.yml:ro
+      - ./dynamic:/etc/traefik/dynamic:ro
+      - ./acme.json:/acme.json
+    networks:
+      - proxy
+      - socket-proxy
+
+networks:
+  proxy:
+    external: true
+  socket-proxy:
+    internal: true  # No external access
+```
+
+In `traefik.yml`:
+```yaml
+providers:
+  docker:
+    endpoint: "tcp://socket-proxy:2375"
+    exposedByDefault: false
+    network: proxy
+```
+
+## Multiple Services Example
+
+```yaml
+services:
+  frontend:
+    image: frontend:latest
+    networks: [proxy]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.frontend.rule=Host(`example.com`)"
+      - "traefik.http.routers.frontend.entrypoints=websecure"
+      - "traefik.http.routers.frontend.tls.certresolver=letsencrypt"
+      - "traefik.http.services.frontend.loadbalancer.server.port=3000"
+
+  api:
+    image: api:latest
+    networks: [proxy]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.api.rule=Host(`example.com`) && PathPrefix(`/api`)"
+      - "traefik.http.routers.api.entrypoints=websecure"
+      - "traefik.http.routers.api.tls.certresolver=letsencrypt"
+      - "traefik.http.services.api.loadbalancer.server.port=8080"
+      - "traefik.http.routers.api.middlewares=strip-api"
+      - "traefik.http.middlewares.strip-api.stripprefix.prefixes=/api"
+
+  admin:
+    image: admin:latest
+    networks: [proxy]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.admin.rule=Host(`admin.example.com`)"
+      - "traefik.http.routers.admin.entrypoints=websecure"
+      - "traefik.http.routers.admin.tls.certresolver=letsencrypt"
+      - "traefik.http.services.admin.loadbalancer.server.port=3001"
+      - "traefik.http.routers.admin.middlewares=admin-auth@file"
+```
+
+## Key Docker Patterns
+
+- **Always** use `exposedByDefault: false` and explicit `traefik.enable=true`
+- **Always** use a shared external network (`docker network create proxy`)
+- Use `$$` to escape `$` in docker-compose labels (for htpasswd hashes)
+- Specify `loadbalancer.server.port` when container exposes multiple ports
+- Mount Docker socket read-only or use socket proxy
+- Use `security_opt: [no-new-privileges:true]` on Traefik container
+- Use Docker secrets for sensitive values, not environment variables
+- Set `restart: unless-stopped` for production reliability
+
+## Scaling Services
+
+```yaml
+services:
+  app:
+    image: myapp:latest
+    deploy:
+      replicas: 3
+    networks: [proxy]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.app.rule=Host(`app.example.com`)"
+      - "traefik.http.services.app.loadbalancer.server.port=8080"
+      - "traefik.http.services.app.loadbalancer.healthcheck.path=/health"
+      - "traefik.http.services.app.loadbalancer.healthcheck.interval=10s"
+```

package/skills/traefik/docs/ha-performance.md

@@ -0,0 +1,177 @@
+# High Availability & Performance Tuning
+
+## High Availability Setup
+
+### Multi-Instance Deployment
+- Deploy minimum 3 Traefik instances across different nodes/zones
+- Front with a cloud NLB (AWS NLB, GCP TCP LB) or DNS round-robin
+- Share config via Kubernetes API, Consul, or etcd
+
+### Kubernetes HA
+
+```yaml
+# Helm values
+deployment:
+  replicas: 3
+
+affinity:
+  podAntiAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: traefik
+        topologyKey: topology.kubernetes.io/zone
+    preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 100
+        podAffinityTerm:
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+          topologyKey: kubernetes.io/hostname
+
+topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: topology.kubernetes.io/zone
+    whenUnsatisfiable: DoNotSchedule
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: traefik
+```
+
+### ACME in HA
+
+Problem: Multiple instances requesting duplicate certificates.
+
+Solutions:
+- **Traefik Enterprise**: Built-in distributed ACME
+- **cert-manager**: External cert management (recommended for K8s)
+- **Shared KV store**: Consul/etcd for cert state (community workaround)
+
+```yaml
+# Use cert-manager instead of Traefik ACME in HA K8s
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-cert
+spec:
+  secretName: wildcard-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - "example.com"
+    - "*.example.com"
+```
+
+Reference in IngressRoute:
+```yaml
+tls:
+  secretName: wildcard-tls  # Instead of certResolver
+```
+
+## Performance Tuning
+
+### Connection Pool
+```yaml
+serversTransport:
+  maxIdleConnsPerHost: 200  # Default is low; increase for high-throughput
+  forwardingTimeouts:
+    dialTimeout: 10s
+    responseHeaderTimeout: 10s
+    idleConnTimeout: 90s
+```
+
+### Resource Allocation
+
+```yaml
+resources:
+  requests:
+    cpu: 500m
+    memory: 256Mi
+  limits:
+    cpu: "2"
+    memory: 1Gi
+```
+
+Traefik is Go-based — benefits from multiple CPU cores via GOMAXPROCS.
+
+### Access Log Optimization
+
+For high-throughput, buffer or disable access logs:
+```yaml
+accessLog:
+  bufferingSize: 100
+  filters:
+    statusCodes: ["400-599"]  # Only log errors
+```
+
+Or disable entirely for maximum performance:
+```yaml
+# Don't include accessLog section
+```
+
+### Routing Optimization
+
+- Minimize regex-heavy routing rules
+- Use exact `Host()` and `Path()` over `HostRegexp()` and `PathRegexp()`
+- Reduce middleware chain depth
+- Use `priority` to short-circuit matching for common routes
+
+### Label Cardinality
+
+```yaml
+metrics:
+  prometheus:
+    addEntryPointsLabels: true
+    addServicesLabels: true
+    addRoutersLabels: false  # Disable if too many routers (high cardinality)
+```
+
+### HTTP/3
+
+Enable for reduced connection latency:
+```yaml
+entryPoints:
+  websecure:
+    address: ":443"
+    http3: {}
+```
+
+## Cloud Provider Integration
+
+### AWS
+- Use NLB (Network Load Balancer) for TCP/TLS passthrough
+- Set `service.beta.kubernetes.io/aws-load-balancer-type: nlb`
+- Enable proxy protocol on both NLB and Traefik
+- Use IAM roles for service accounts (IRSA) for Route53 ACME
+
+### GCP
+- GKE auto-provisions TCP LB for LoadBalancer Service
+- Integrate Cloud Armor for WAF/DDoS in front of Traefik
+- Use Workload Identity for Cloud DNS ACME
+
+### Azure
+- AKS with Azure Load Balancer
+- Static IP: `service.beta.kubernetes.io/azure-load-balancer-resource-group`
+- Azure DNS for cert-manager ACME challenges
+
+## Benchmarking
+
+Test with:
+```bash
+# wrk
+wrk -t12 -c400 -d30s https://app.example.com/
+
+# k6
+k6 run --vus 100 --duration 30s loadtest.js
+
+# hey
+hey -n 10000 -c 100 https://app.example.com/
+```
+
+Key metrics to monitor during load tests:
+- Request latency (P50, P95, P99)
+- Requests per second
+- Error rate
+- CPU/memory usage of Traefik
+- Open connections

package/skills/traefik/docs/kubernetes.md

@@ -0,0 +1,278 @@
+# Traefik Kubernetes CRDs
+
+## Installation
+
+```bash
+# Helm
+helm repo add traefik https://traefik.github.io/charts
+helm repo update
+helm install traefik traefik/traefik -n traefik --create-namespace \
+  --set "ports.websecure.tls.enabled=true" \
+  --set "providers.kubernetesCRD.enabled=true" \
+  --set "providers.kubernetesCRD.allowCrossNamespace=true"
+```
+
+## IngressRoute
+
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: app
+  namespace: apps
+spec:
+  entryPoints: [websecure]
+  routes:
+    - kind: Rule
+      match: Host(`app.example.com`) && PathPrefix(`/api`)
+      priority: 200
+      middlewares:
+        - name: strip-api
+          namespace: apps
+        - name: rate-limit
+          namespace: traefik
+      services:
+        - kind: Service
+          name: app-backend
+          port: 8080
+          weight: 100
+          passHostHeader: true
+    - kind: Rule
+      match: Host(`app.example.com`)
+      priority: 100
+      services:
+        - kind: Service
+          name: app-frontend
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+    domains:
+      - main: example.com
+        sans: ["*.example.com"]
+```
+
+## Middleware CRD
+
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: security-headers
+  namespace: traefik
+spec:
+  headers:
+    frameDeny: true
+    browserXssFilter: true
+    contentTypeNosniff: true
+    stsSeconds: 31536000
+    stsIncludeSubdomains: true
+    stsPreload: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: rate-limit
+  namespace: traefik
+spec:
+  rateLimit:
+    average: 100
+    burst: 50
+    period: 1s
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: strip-api
+  namespace: apps
+spec:
+  stripPrefix:
+    prefixes: [/api]
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: traefik
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+# Chain middleware
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: secured
+  namespace: traefik
+spec:
+  chain:
+    middlewares:
+      - name: redirect-https
+      - name: security-headers
+      - name: rate-limit
+```
+
+## TLSOption CRD
+
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: TLSOption
+metadata:
+  name: default  # "default" applies globally
+  namespace: traefik
+spec:
+  minVersion: VersionTLS12
+  sniStrict: true
+  cipherSuites:
+    - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+    - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+    - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+```
+
+## ServersTransport CRD
+
+For mTLS or custom TLS to backend services:
+
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mtls-backend
+  namespace: apps
+spec:
+  serverName: "backend.internal"
+  insecureSkipVerify: false
+  rootCAsSecrets: [backend-ca]
+  certificatesSecrets: [client-cert]
+  maxIdleConnsPerHost: 10
+  forwardingTimeouts:
+    dialTimeout: 5s
+    responseHeaderTimeout: 10s
+    idleConnTimeout: 90s
+```
+
+## TraefikService (Weighted Round Robin / Mirroring)
+
+```yaml
+# Canary deployment
+apiVersion: traefik.io/v1alpha1
+kind: TraefikService
+metadata:
+  name: app-canary
+spec:
+  weighted:
+    services:
+      - name: app-stable
+        port: 80
+        weight: 90
+      - name: app-canary
+        port: 80
+        weight: 10
+---
+# Traffic mirroring
+apiVersion: traefik.io/v1alpha1
+kind: TraefikService
+metadata:
+  name: app-mirror
+spec:
+  mirroring:
+    name: app-main
+    port: 80
+    mirrors:
+      - name: app-shadow
+        port: 80
+        percent: 20
+```
+
+## IngressRouteTCP
+
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: postgres
+  namespace: databases
+spec:
+  entryPoints: [postgres]
+  routes:
+    - match: HostSNI(`db.example.com`)
+      services:
+        - name: postgres
+          port: 5432
+  tls:
+    passthrough: true
+```
+
+## IngressRouteUDP
+
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteUDP
+metadata:
+  name: dns
+spec:
+  entryPoints: [dns-udp]
+  routes:
+    - services:
+        - name: coredns
+          port: 53
+```
+
+## Helm Values (production)
+
+```yaml
+# values.yaml
+deployment:
+  replicas: 3
+  podAnnotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "8082"
+
+affinity:
+  podAntiAffinity:
+    preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 100
+        podAffinityTerm:
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+          topologyKey: kubernetes.io/hostname
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+  limits:
+    cpu: "1"
+    memory: 512Mi
+
+ports:
+  web:
+    redirections:
+      entryPoint:
+        to: websecure
+        scheme: https
+  websecure:
+    tls:
+      enabled: true
+  metrics:
+    port: 8082
+    expose:
+      default: false
+
+providers:
+  kubernetesCRD:
+    enabled: true
+    allowCrossNamespace: true
+  kubernetesIngress:
+    enabled: false
+
+metrics:
+  prometheus:
+    entryPoint: metrics
+
+ingressRoute:
+  dashboard:
+    enabled: false  # Create your own with auth
+```