Absolutely brilliant tutorial, thanks so much! I currently use Nginx Proxy Manager. For this solution to cover all my needs and requirements, I would need to understand how traefik deals with external hosts not hosted on the local docker service? Any chance you could cover that? I have tried various configs with config.yaml, and white traefik does not error, I always get a 404 error :( Help :D
@@void.3133 I actually gave up on this reverse proxy as I cant make it work, I use CloudFlare Tunnel instead its easy to setup and will give you SSL as well. I move to proceed with other Home lab activity and maybe I'll get back on this in the future.
@@JPEO for the dashboard you will need a local DNS record. Something like PiHole, adguard, your firewall or hosts file. E.g. traefik.yourdomain.com dockerHostIP:443
Hi Jim... very detailed and I love that. I have one question, you ran your Traefik from Ubuntu, so obviously some of the commands wont work in Debian. How do I get to echo the password from Debian? echo $(htpasswd -nb "admin" "admin" | sed -e s/\\$/\\$\\$/g
@@Jims-Garage so your tutorial was installed on Ubuntu... I was trying to run it on Debian 12. So some of the commands will work but this one will not execute 😞.
Nginx proxy manager is easy but it has a rocky history with security vulnerabilities. I prefer Traefik for this reason as well as it's dynamic nature. Nginx is a solid choice, although it isn't dynamic.
great tutorial. i'm using almost identical traefik config/docker compose file that i got from techno tim. another amazing youtuber in the homelab community
1. Can you re do this video, but using NPM so that we can see the different? 2. Why are youtubers showing/teaching Traefik instead of Nginx Proxy Manager, which is much easier to used?
Perhaps, I might. The reason is because Traefik is more secure, and more container orientated. Nginx Proxy Manager has been riddled with security vulnerabilities for years, I cannot recommend that people use it.
Hi, new sub here, thanks for the very detailed videos! I just have two questions: 1) should I use the docker-compose from your Github page or the official "Docker-compose with Let's Encrypt: DNS Challenge" one? 2) if I don't specify my ip address on cloudflare (waiting to be able to follow your pihole guide), can I still run other containers through proxy and they will be encrypted?
17:27 After traefik docker compose up, I did not see the log message of loading the configuration file /traefik.yml in portainer. What happened...but acme.json is not empty, and the private key and Certificate were successfully verified. It's that right... Thanks for sharing, boss. 🤣
Hey, will this configuration create a unique certificate for each server? I plan on setting up multiple servers , each with its own traefik proxy and subset of websites in my domain. server 1 - sites a, b, c server 2 - sites d, e, f Will traefik on server one request the certs a.mydomain , b.mydomain , and c.mydomain ? A wildcard won’t work since I’d need 2 active wildcard certs.
@@Jims-Garage Oh sweet! Well, I’d rather have unique certs for each host, but if LE will issue multiple wildcard certs for the same domain, then that will work, too.
I followed this tutorial but I just keep on getting TRAEFIK DEFAULT CERT. I use adguard as dns and I have configure my domains in there. It resolve but does not get the lets encrypt cert
Hello hello! You homelab series is the best series for homelab progresses making (while other youtubers don't even have a progress series)! But I ran into issues following this video, my container log is keep giving me "command traefik error: yaml: line 32: found unexpected end of stream"; I saw another guy having the same issue as I do in the comments and I checked my yml file as what you told him to do, yet I don't see an issue. Would you mind to help me out here?
would you consider doing a video without having to purchase a domain, local.domain with Kubernetes, Traefik, DNS Server on local network, Let's Encrypt
Thanks for your cool site. Unfortunately I'm having a problem. In the Portainer logs for traefik I see: 2023/06/05 11:54:14 command traefik error: yaml: line 32: found character that cannot start any token. Any ideas?
Hi, very helpful videos!! But I have a problem with the cloudflare workaround. Is ist possible to change this to another provider like netcup (in my case)? If I try, it doesn't work.
Thanks, should work fine. I don't have a config to hand but converting the compose to swarm format should be all you need (I run this in Kubernetes which is similar)
Hey Jim, forst off tha ks for your videos, and the explanations. Have two questions: 1 when trying to run the traffic docker compose file got an error where it basically said the proxy network already exists and advised to change the network to external (like on the nginx compose file) changing this worked and the container was created. Just confirming this is correct as it was not the case in the video. 2 in the nginx compose file there is reference to a router middleware with jellyfin. I was seeing an error in tue traef8k dashboard and it only went away when this line was changed to nginx confirming I an correct with this.
1) That looks fine. You only need to create the network once, then specify it afterwards for subsequent containers. 2) That's an error in the video (shh! 🤫). Please always refer to the GitHub for the latest files where it has been rectified. Please let me know if you have any further questions.
The problem with Let's Encrypt is that the certificates are only valid for 90 days so if you're device doesn't support one of their automated update services/methods, such as a Synology NAS for example, then it can become a headache to manage.
This video is great but too high level for me. I feel lot of abstractions there. I am not very much confident over docker compose, so I want you to do a video which deploys multiple apps (maybe frontend and backend) with docker, docker-compose, traefik, some IaaS like linode etc. Can you do that video please? Considering those who know just docker (not even docker compose) you will explain every line of config and then deploy (add) one more app after everything is working.
How did you managed to create an A record (or a CNAME) on cloudflare for your subdomain and point it to your home ip? And isn't your home ISP IP dynamic? Did I miss any step? Thank you.
@@Jims-Garage in my current setup I use duckdns on a docker. I'll check your suggestion. Thank you for your support and please keep posting new videos 💪💪
Hi Jim, appreciate your video! So well put. I followed your tutorial all the way, but like other comments here, could not access the traefik dashboard. Not under 8080 (http) or 443 (https). Do you happen to know if traefik changed something since then? Thanks.
Hi James, Thanks for the great videos. You have covered some very interesting topics. One observation regarding traefik. I have deployed traefik ingress routes for many services in my k3s cluster. All of them work fine and ssl is also working as expected. But strangely on the traefik pod logs, I can see all the services deployed show an error that the cert-tls secret is not found in the namespace of that application. I only deployed the secret in the traefik namespace. Bit confused at the moment. If the cert is needed in the individual namespaces, why would my tls work correctly at the moment? If it is not needed, why would the traefik logs be reporting these errors...
@@Jims-Garage actually figured it out. The ingress route created for each individual app, doesn't need the tls-secret set. Once I removed and redeployed, logs are clean. :)
Firstly this was a great video to follow. I have 2 questions: 1) I do not understand the need for the nginx container. Is the nginx container used to simplify importing the CA certificates? 2) For the password hash, I have used argon2id to hash a password when setting up the admin portal for vaultwarden. Is it possible to get that to work so that you can run a temp docker container to hash the password and not require the install of apache2-utils?
To expand on the first question: When I was first learning I started with NPM and then tried Traefik but it was too complicated while I was just learning. I am now trying to get back to learning Traefik but I do not remember needed an nginx container when I set up Traefik in the past. I remember being confused importing the certs into Traefik. Is the nginx container used to simplify importing the CA certificates?
Hey, thanks for the feedback. The nginx is merely a lightweight example of using the cert. You can ignore it if you want. I'm not sure about using the container for password generation. Anything could do it in theory that supports base64 encodings.
@@Jims-Garage I was under the impression Traefik had that functionality built in. I will end up circling back once I finalize the plans for my home-lab and will think more on how it will all come together. As for the password hash I used argon2id and I just had to double the “$” for escaping. Argon2 is supposed to be more resilient than BCrypt or MD5. echo -n "YourSuperSecretPassword" | argon2 "$(openssl rand -base64 32)" -e -id -k 65540 -t 3 -p 4
@jims-garage thanks for putting this together! Been following along and am having issues executing sudo docker compose up -d @21:10 (nginx container creation). My first error was: yaml: line 5: could not find expected ':'. My code is: container_name:homelab. After putting space after : I received services.web Additional property secuity_opt is not allowed and have had other errors that seem to point to my yaml formatting. Any ideas what this might be?
Hey Jim, I'm a bit confused. I've set everything in my homelab just like in your video, but i cannot access my domain name from the internet. I'm connected to a lan zone vlan while my docker vm is on a separated dmz vlan. I can access the urls i've set in traefik and pihole only from the host vm they are running on. What did I miss in my configuration that prevents me from accessing the docker services by the urls? Btw I've set a dns a record in my cloudflare accout to direct my root domain to my public ip, and configured dnat as shown. Thank you for your awesome content
@@Jims-Garage I'm pretty sure my ISP doesn't block any port forwarding since the only hardware I use that's provided by the ISP is a simple modem with a single fiber to eth port. Just to clarify the structure of my network: internet -> ISP modem -> proxmox server running sophos (vlan 10) and docker vm (vlan 80 - DMZ). The docker vm is configured in proxmox to be on the DMZ vlan that is managed by the sophps vm. All my vlans have a firewall rule that allows WAN connection but no interVlan connections. I've added the DNAT rule for the static ip address I've set for the docker vm in sophos. Should there be any routing rules set in sophos? Should I set a domain for the DMZ vlan that matches my cloudflare domain name in sophos? Should there be any additional configuration set in the hosting proxmox server? I tried to stick to your instructions as much as possible, but I cannot access the docker vm by either domain name nor its ip address from my other machines. Your help is very much appreciated, thanks again :)
Traefik log is giving me these errors: level=error msg="Error while starting server: accept tcp [::]:80: use of closed network connection" entryPointName=http and time="2023-06-01T01:00:04Z" level=error msg="accept tcp [::]:443: use of closed network connection" entryPointName=https. I did the port forward but notice the wan port on sopho has a default IP that is different than my ISP dynamic public IP, also using pihle DNS i can't get any site to resolve i'm getting error 404 page not found.
Check if nginx is already using port 80, if so you have a clash. Either change the port of nginx in the docker compose, or just remove it as it'll be routed through traefik once you update the labels.
@@Jims-Garage I'm doing a brand new setup following your series from the Promox install video, only thing i have install on this VM is docker, portainer, traefik and pihole i haven't gotten to the part to install nginx
@@GPPi-j7x just checked, I believe it's caused by the wrong IP on your wan. You'll want to update that to your actual IP. (You can setup dynamic DNS with Sophos and Cloudflare so it checks and updates if necessary every 5 mins).
@@GPPi-j7x i now it should be and old issue for you, but how you fixed it? Im going mad here with the sample problem of closed network connection. Thanks!
So I did the htpasswd thing and did not save the string it spit out and can not find the file location. When I rerun the htpaswd command it just sits there thinking
@@GrooveNook no, don't think so. I don't use Cloudflare Tunnels for privacy reasons. AFAIK the tunnel negates the need for a proxy. Use this video without a Cloudflare Tunnel.
Hi Jim, thank you for your work. quick question, how did you set up your local dns entry in pihole for your containers that are using traefik? I dont want to expose my containers outside my network.
Go to local DNS in PiHole and add your subdomains. Set the IP to your proxy IP (likely your docker VM IP). Make sure your PC then has the PiHole set as its DNS resolver (windows network settings). Strongly recommend using Cloudflare proxy for any external domains/subdomains on the same IP as it will hide it. Otherwise people could manually assign the IP and try to guess internal subdomains. A more thorough measure would be to use IP whitelisting in Traefik to limit access to containers using network blocks (I'll get onto this in a later video). You could also setup separate entrypoints for different services. E.g., secure on port 443 for internal, and web-secure on port 444 for external. You'd then portforward 444 to 443 and thus no internal services are accessible externally.
@@Jims-Garage Thank you for your response. I have my Pihole set up for network-wide dns resolver using my unifi udm-pro router. I was confused as to what ip address to use for A record entry. I will play around with it. I look forward to your upcoming content. I appreciate it.
@@Jims-Garage Thanks Jim for replying. I got it sorted out and ya, I think it had to do with not having a domain record. I did a lot of troubleshooting, so I'm not exactly sure what solved it, but I am good now. I was able to replicate this setup twice, so now I think I have it all figured out (famous last words). Thanks again. You have some great content. Keep up to the good work.
@@Jims-GarageHi Jim, I also met some trouble and be confused while trying to use traefik reverse proxy along side with headscale😢 Seems like you have updated the compose file for traefik, while the label used in headscale with traefik is still based on the old one. It would be good if there is also a updated version of headscale compose file as well… 🙏 Can’t really figure out the correct set up, the gui is working just fine, but the machine/register is not… seems like some of the traffic has not passed through the proxy?
I think I found the answer: (1) Traefik leverages Let's Encrypt for certificate issuance: It uses the ACME protocol to automatically request and renew certificates from Let's Encrypt, a widely trusted certificate authority. (2) Cloudflare is not a certificate authority: It doesn't issue certificates directly.
Hello, I have a question about Sophos. After installing nginx and Trafik, my site displays fine, is it necessary to configure Sophos or in what cases would it be? I used the Cloudflare api to generate the ssl...
Sorry, i don't understand under what situation should one expose home servers to the internet? It feels very insecure. Why not protect all internal home servers with a VPN like Wireguard?
