🔀 Traefik — Homelab Reverse Proxy

Host: Homelab · Compose: Homelab/Traefik/compose.yaml
Stack name: traefik

---

1. Overview

The primary Traefik v3 reverse proxy for the homelab. Handles all internal TLS termination for *.home-lab.micky.id.au and *.remote-lab.micky.id.au using ACME/Let's Encrypt DNS challenge. A Redis sidecar enables traefik-kop to push routing configurations from remote Docker hosts. A secure socket proxy prevents full Docker API exposure.

---

2. Architecture & Services

Service	Image	Port	Role
traefik	traefik:v3.7.5	80, 443, 8863	Core reverse proxy + ACME TLS
traefik_redis	redis:7.4	6379	Redis for traefik-kop label federation
socket-proxy	11notes/socket-proxy:2.1.7	2375	Secure Docker socket proxy

---

3. Networking

• traefik — External network. All services with traefik.enable=true must join this network.
• internal — Internal network connecting Traefik, Redis, and socket-proxy.
• Traefik listens on ports 80 (HTTP → HTTPS redirect), 443 (HTTPS), and 8863 (dashboard).

---

4. Persistent Storage

Container	Host Path	Description
traefik	/docker/data/traefik	traefik.yml, middlewares, routers config
traefik	/docker/data/traefik/traefik.log	Access log
traefik	/docker/data/traefik/acme.json	Let's Encrypt certificate store

---

5. Environment Variables

Loaded from .env alongside the compose file. Key variable:

Variable	Description
CF_DNS_API_TOKEN	Cloudflare API token for ACME DNS-01 challenge

---

6. Access & Usage

URL	Description
https://traefik.home-lab.micky.id.au	Traefik dashboard
http://localhost:8863	Dashboard (direct)

# Start
docker compose -f Homelab/Traefik/compose.yaml up -d

# Test routing
curl -I https://home-lab.micky.id.au

---

7. Maintenance & Backup

# Update
docker compose -f Homelab/Traefik/compose.yaml pull
docker compose -f Homelab/Traefik/compose.yaml up -d

# Backup ACME certs and config
rsync -av /docker/data/traefik/ /backup/traefik/

[!CAUTION] acme.json must have permissions 600. After any restore: chmod 600 /docker/data/traefik/acme.json