Kamal 2 proxy vs traefik, add host to accessory

[hholtmaat]

In Kamal v1 with traefik it was possible to add a host to an accessory. This can be used if you want to add a host to an accessory like the Grafana dashboard.

accessories:
  grafana:
    image: grafana/grafana
    env:
      clear:
        GF_SERVER_ROOT_URL: https://grafana.example.com
        GF_INSTALL_PLUGINS: grafana-clock-panel,grafana-simple-json-datasource
    labels:
      traefik.enable: true
      traefik.http.routers.grafana.rule: Host(`grafana.example.com`)
      traefik.http.routers.grafana.service: namespace-grafana@docker
      traefik.http.routers.grafana.middlewares: redirect-to-https
      traefik.http.routers.grafana.priority: 250
      traefik.http.routers.grafana.tls: true
      traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: https
    directories:
      - data/grafana:/var/lib/grafana
    options:
      user: 0
    roles:
      - web

Is it an idea to add kamal-proxy to an accessory? So that it deploys an additional service: kamal-proxy deploy accessory-grafana --target namespace-grafana:3000 --host grafana.example.com

The configuration could look like this:

  grafana:
    image: grafana/grafana
    env:
      clear:
        GF_SERVER_ROOT_URL: https://grafana.example.com
        GF_INSTALL_PLUGINS: grafana-clock-panel,grafana-simple-json-datasource
    proxy:
      host: grafana.example.com
      target_port: 3000
      ssl: true     
    directories:
      - data/grafana:/var/lib/grafana
    options:
      user: 0
    roles:
      - web

[perepechin]

Has anyone found a workaround for this limitation in kamal-proxy? I want to host multiple applications/accessories in a single environment, such as Typesense and Grafana. Ideally, I would like to configure separate hosts and SSL certificates for each accessory. Any suggestions or best practices would be appreciated!

[perepechin]

I found a workaround. With Kamal 2, we can deploy multiple apps to the same VM, so if your accessory should be exposed to the public with its host, e.g., grafana.example.com, we can deploy it as an app instead of an accessory.

For example, in my case, the Dockerfile for the TypeSense looks like this:

Dockerfile:

FROM typesense/typesense:27.1

RUN apt-get update && apt-get install -y \
    curl \
    unzip \
    && rm -rf /var/lib/apt/lists/*

config/deploy.yml

# Name of your application. Used to uniquely configure containers.
service: typesense
# Name of the container image.

image: REGISTRY_USERNAME/typesense

# Deploy to these servers.
servers:
  web:
    - 5.161.196.100

# Credentials for your image host.
registry:
  # Specify the registry server, if you're not using Docker Hub
  # server: registry.digitalocean.com / ghcr.io / ...
  username:
    - KAMAL_REGISTRY_USERNAME

  # Always use an access token rather than real password (pulled from .kamal/secrets).
  password:
    - KAMAL_REGISTRY_PASSWORD
# Configure builder setup.
builder:
  arch: amd64

env:
  TYPESENSE_DATA_DIR: /data
  TYPESENSE_API_KEY: $TYPESENSE_API_KEY
  TYPESENSE_ENABLE_CORS: true

proxy:
  host: search.example.com
  ssl: true
  app_port: 8108
  forward_headers: true
  healthcheck:
    path: /health
    interval: 1
    timeout: 5

volumes:
  - ./typesense-data:/data

After deployment, I can access my Typesense service via HTTPS, e.g., https://search.example.com/health

Please do it for all other required accessories, but make sure to use a unique name for the service parameter in the config/deploy.yml

I am using separate folders for each app, e.g.

- app
      Dockerfile
   - config
         deploy.yml

- typesense
      Dockerfile
   - config
          deploy.yml      

[vinguyen-micepad]

It'll better if we can remove Dockerfile from typesense

[adenta]

this seems annoying. accessories in general seem not that fleshed out. I will let this thread know if I can solve for typesense/melisearch

[adenta]

I went ahead and create a new repo for meilisearch:
Dockerfile:

# Use the official Meilisearch image
FROM getmeili/meilisearch:v1.11.3

# Expose the default Meilisearch port
EXPOSE 7700

# Set the entrypoint to run Meilisearch
ENTRYPOINT ["meilisearch"]

deploy.yml

service: search

image: adenta/search

servers:
  web:
    - 123.456.789.012

proxy:
  ssl: true
  host: search.denta.co
  app_port: 7700
  forward_headers: true
  healthcheck:
    path: /health
    interval: 1
    timeout: 5

# Credentials for your image host.
registry:
  server: ghcr.io
  username: adenta

  # Always use an access token rather than real password when possible.
  password:
    - KAMAL_REGISTRY_PASSWORD

# Configure the image builder.
builder:
  arch: amd64

I'll still need to go back and wire up ENV's and the like.

Unsure exactly what separates an accessory and a new service. Because search infrastructure needs to be secure and accessible directly from the frontend, it makes sense for it to have its own qualified domain name, separate from the app.

Where does @dhh think about drawing that line? It's a blurry line IMO. Maybe instead of accessories, Kamal should support some sort of nested service scheme.