This assessment ends level 1: you publish two web services behind Traefik from a need, with no command in front of you, then you prove each setting by what the system shows. It draws on the path of a request, automatic certificates, the Docker provider and recovery after a restart. Allow an hour. It is meant for someone who has followed the lessons of the common core and the "Traefik: publish" module.
What you will learn
The assessment teaches no new gesture: it teaches you to mobilise alone the gestures of level 1, brought together in a single scenario and scored on proof. You will be able to:
- Publish two services over HTTPS behind a single entry point
- Obtain and renew their certificates automatically
- Close what must not be reachable from the outside
- Bring back the services after a restart of the container engine
- Prove each constraint by an observable state
The need
A small web platform must expose two services under two names, with an HTTPS that nobody has to renew by hand. You work during a change window. The images of the two backends and the test ACME authority are already available on the machine: you have nothing to download.
Nobody dictates the method to you. You choose the structure of your files and your commands; only what the system shows at the end counts, observed from a client located outside the machine.
The constraints
Each constraint has an observable, and that is what is scored, not your intention. A configuration reread says what you meant to do; a request received from the outside says what the system really does.
| # | Constraint | What will be observed |
|---|---|---|
| 1 | Both services answer over HTTPS under their name | a request from an outside client, with the right certificate |
| 2 | The certificates are issued by the test authority and renewed automatically | the issuance, then a renewal observed |
| 3 | The backends are not directly reachable | a port refused from the outside |
| 4 | Traefik's administration is not exposed | no answer from the administration from the outside |
| 5 | Both services come back on their own after a Docker restart | both responses received after the restart |
What you must deliver
The final state of the machine is your deliverable: the check observes it, it does not read your report. Do keep dated notes of what you did and proved: they help you assess yourself and replay the approach.
The final check sends its requests from the control host, outside the machine, observes the issuance and the renewal of the certificates, verifies the blocked ports, then restarts Docker to confirm that both services come back.
How to assess yourself
Reread the five constraints one by one: each one is met or missed, with no halfway. A reachable backend or an open administration is not "almost" closed, and a service that does not come back after a restart is not durably published.
A missed constraint does not call for a ready-made solution: go back to the lesson that teaches the missing gesture, then start again from a clean state. The lab's automated check is authoritative: the assessment is passed when it passes.
Practice: take the assessment
The assessment takes place in the lab. It lasts 60 minutes and gives no hint. Start it when you have time to finish it in one sitting.
Key points
An assessment proves a state, not an intention.
- The two services answer over HTTPS from outside the machine.
- The certificates are issued and renewed with no intervention.
- The backends and the administration stay closed.
- The services restart on their own after a restart of the container engine.
- A missed constraint sends you back to the relevant lesson, then to a new attempt.