Traefik

Reverse proxy

Ansible vault

# traefik

hazzuk_core_traefik_enabled: true

hazzuk_core_traefik_stack:
  traefik:
    log_level: debug # trace, debug, info, warn, error, fatal, panic
    acme:
      staging_enabled: true
      email: cert@example.com
      zone_api_token: ""
      dns_api_token: ""
    dashboard:
      enabled: true
      forward_auth_enabled: true
      domain: "traefik.{{ karo_compose_root_domain }}"
  tinyauth:
    domain: "tinyauth.{{ karo_compose_root_domain }}"
    log_level: info # trace, debug, info, warn, error, fatal, panic
    oidc_client_id: ""
    oidc_client_secret: ""
  cetusguard:
    log_level: 7 # 0-7 (min to max verbosity)

See all defaults

Traefik - Reverse proxy

Traefik notes

The first time you run Traefik, you should keep ACME staging enabled. Once you've verified that your setup is correct, disable it to request valid TLS certificates. This is to avoid Let's Encrypt rate limits.
It's recommended to disable the Traefik dashboard when your server is exposed publicly.
Traefik is set to use TLS 1.3. Cipher suites are not configurable, supported ciphers are safe.
The Traefik dashboard can be useful when setting up other stacks. As you can check 'HTTP Routers' to ensure the availability of other services.

Traefik Cloudflare API tokens

Based on the Lego library docs.

Visit dash.cloudflare.com/profile/api-tokens
Select 'Create Token' > 'Create Custom Token'

traefik_acme_zone_api_tokentraefik_acme_dns_api_token

Token name

Traefik (example.com) - Resolve domain names to Zone IDs

Permissions: Zone, Zone, Read
Zone Resources: Include, Specific zone, example.com

Token name

Traefik (example.com) - Edit DNS for DNS-01 challenges

Permissions: Zone, DNS, Edit
Zone Resources: Include, Specific zone, example.com

Links

Tinyauth - Authentication middleware (forward auth)

Links

CetusGuard - Docker socket proxy

Links

Releases