Run Martin on subpath with Traefik proxy

[justb4]

Hopefully this is more a question than a feature request: I am trying to integrate Martin using Docker (Compose) with a Traefik proxy front-end. From the documentation I understand how this is realised with Nginx but somehow I can't get this scenario to work with Traefik. Connection to DB is ok. Problem: the returned TileJSON contains the external host+port but not the sub-path. This image should make the problem somewhat clearer:

Traefik runs here at http://localhost:8000 (or in production on HTTPS, Martin in Docker Container on 0.0.0.0:3000). So the external protocol://host:port is handled ok. Here the subpath is /vt. As you can see in the TileJSON, that subpath is not present. This is a recurring problem with proxied services. For example in Python Flask apps one can set an env var SCRIPT_NAME, and there are many other 'tricks' or mostly config settings like BasePath, but via HTTP Headers is more elegant.

In the Nginx setup it looks like a HTTP Header X-Rewrite-URL does the trick, but can't find an equivalent setting for Traefik. As Traefik is a widely used frontend, IMHO it is useful to figure out, maybe even extend the Martin config, or at least extend the docs how to setup with Traefik.

My Docker Compose file is like (with some env vars like SERVICE_NAME=martin), so the prefix path to the martin container is /vt, which is stripped before forwarding to the martin Container:

version: "3"

services:

  martin:
    image: ghcr.io/maplibre/martin:v0.13.0
    container_name: martin
.
.
    environment:
      - DATABASE_URL=postgresql://${PG_USER}:${PG_PASSWORD}@....
      - RUST_LOG=debug

    labels:
      # Enable Traefik routing on overlay service network
      - "traefik.enable=true"
      - "traefik.docker.network=service-network"
      # strip prefix
      - "traefik.http.middlewares.martin-stripprefix.stripprefix.prefixes=/vt"

      # Define local http router
      - "traefik.http.routers.${SERVICE_NAME}_http.rule=Host(`localhost`) && PathPrefix(`/vt`)"
      - "traefik.http.routers.${SERVICE_NAME}_http.entrypoints=http"
      - "traefik.http.routers.${SERVICE_NAME}_http.middlewares=martin-stripprefix@docker"

      # Define SSL/https router
      - "traefik.http.routers.${SERVICE_NAME}_https.rule=Host(`${TRAEFIK_SSL_DOMAIN}`) && PathPrefix(`/vt`)"
      - "traefik.http.routers.${SERVICE_NAME}_https.entrypoints=https"
      - "traefik.http.routers.${SERVICE_NAME}_https.tls=${TRAEFIK_USE_TLS}"
      - "traefik.http.routers.${SERVICE_NAME}_https.tls.certresolver=${TRAEFIK_SSL_CERT_RESOLVER}"
      - "traefik.http.routers.${SERVICE_NAME}_https.tls.options=my_default@file"
      - "traefik.http.routers.${SERVICE_NAME}_https.middlewares=secure-headers@file,martin-stripprefix@docker"
.
.

[justb4]

AFAICS X-Rewrite-URL is not an 'official' HTTP Header. I found no way in Traefik docs and other sources to dynamically set this HTTP Header (though Scheme, Host and Port is passed and interpreted by Martin).

It may still be valuable to have an optional BasePath config also for other frontends. For example pg_tileserv has a similar config option. My Rust is 'rusty', otherwise would have submitted a PR....

[nyurik]

Hi @justb4, thx for all the info!

I agree, we have to figure out how to help non-nginx proxies to the external PATH.

The Actix framework already handles the Forwarded header (including the X-Forwaded-* variants) -- schema and host.

It appears that Traefik has something similar - see X-Forwarded-URI discussion - perhaps that can be reused? It seems there is no standard for this due to various security issues(?).

So I agree, lets introduce a new feature, tracked in #1185 - it should be very easy to add - and I will be happy to guide you on implementing it. Rust is easy - it simply won't compile if you make a mistake 🤣

[justb4]

Hi @nyurik,
Also dived further into Traefik, and stumbled on security issues with X-REWRITE-URL.

A recurring issue, found over and over, where a service, a lot geospatial, is behind a proxy and needs to return full URLs in metadata (viz OGC W*S, OGC API). Some solutions are very inflexible for multi-env deployment (DTAP, K8s, etc), like configuring a full "Base/ProxyURL". I noticed that Martin interprets X-REWRITE-URL explicitly. As Nginx can set this header dynamically, that works and is flexible, not touching the Martin config. Traefik cannot, unless including a custom Middleware module, populate such a custom/dynamic HTTP Header.

Though we could introduce an optional BasePath config value as in #1185, an alternative is to have a proxy optionally create/send a fixed HTTP Header value, usually named X-SCRIPT-NAME with the base path like /martin. In the Python-world this is directly interpreted by e.g. MapProxy and think Django. Almost all proxy-frontends (nginx, Apache, Traefik, haproxy, Varnish, ..) can configure/forward this header. Like X-REWRITE-URL, it is the frontend that dictates the deployment env. The (Rust) implementation would follow the same pattern as X-REWRITE-URL, though one needs also the Scheme/Host/Port (also needed for "BasePath" option) , but these are usually forwarded by front-end proxies. (Interestingly: it looks like Martin parses X-REWRITE-URL to only extract the tiles_path...)

Just thinking loud here. If Martin-devs prefer "BasePath config", also ok.