Renew a server's Traefik

$ grim server:upgrade-traefik vps1

Traefik is the one container every project on a production server shares, and grim server:setup never touches it again once it runs. A fix to the Traefik template therefore reaches new servers only. This command carries it to an existing one.

You reach for it in two situations. After a grim self-update whose notes mention Traefik. And when the server shows the symptoms of a Traefik that is down or blind: every project answers with 502 while its own containers are healthy, Traefik returns 404 for a domain that is certainly configured, or grim server:status shows the Traefik container restarting over and over.

Usage

$ grim server:upgrade-traefik vps1                            # new file, new container, health check
$ grim server:upgrade-traefik vps1 --no-restart               # new file only
$ grim server:upgrade-traefik vps1 --email=ssl@example.com    # render with another email

Run it from anywhere. The server must be in your ~/.grim/servers.json. The third line replaces the Let's Encrypt email recorded at setup for this one render.

Arguments and options

Re-render and redeploy the system Traefik docker-compose to pick up grim-cli template fixes

Usage

grim server:upgrade-traefik [--email EMAIL] [--no-restart] [--] <host>

Arguments

Options

What it actually does

1. Backs up the current file to /opt/traefik/docker-compose.yml.bak.
2. Uploads the new docker-compose.yml, rendered from the template of the grim you have installed.
3. Recreates the container with docker compose up -d --force-recreate, so that changed start-up flags take effect even when the image is the same. Skipped with --no-restart.
4. Waits for Traefik to come up. It asks Docker for the container's status for up to thirty seconds and fails when it never reaches Up.

The summary names the backup. Every project on the server is unreachable for the few seconds between the old container and the new one.

Pitfalls

It is for production servers only

The file it writes puts Traefik on ports 8080 and 8443, behind the host's nginx. On a shared dev box, where Traefik owns 80 and 443 itself, that takes every project off the air. A dev box gets its Traefik from grim server:dev:setup.

A server with its own certificate has no email

No acme_email recorded for this server and no --email passed. is what a server set up with --cert and --key answers. Do not pass --email to get past it. The file would then be rendered for Let's Encrypt, which is not the mode that server runs in.

Traefik does not come up

The step fails with Traefik did not reach Up state within 30s — check `docker compose logs traefik` on the host. Read those logs on the server, in /opt/traefik. To go back, copy docker-compose.yml.bak over docker-compose.yml there and run docker compose up -d.

There is one backup, not a history

Each run overwrites the .bak with the file that was live when it started. Run the command twice in a row and the backup is the new file, not the one you started with.

After it finishes

Look at the server once more, then open one of its sites.

$ grim server:status vps1

Related spells