Traefik

Traefik lives under the Proxmox section because it fronts services running across the lab. It is the piece that turns internal services into predictable URLs and keeps routing rules out of each individual app.

Role in the Lab

• Provide a single ingress point for web services.
• Keep internal hostnames consistent even when services move.
• Handle TLS and routing rules centrally.
• Add middleware where it belongs, instead of repeating the same access patterns per app.

Setup Notes

Traefik should come online after DNS is stable and before user-facing services are published. The important pieces are entry points, certificate handling, middleware, and a route layout that stays readable after the tenth service is added.

Traffic Layout

The lab uses separate Traefik instances for internal and external traffic. The internal proxy handles services that should only be reachable from the home network, while the external proxy handles the small set of public routes that enter through Cloudflare.

Keeping those paths separate prevents a public-side mistake from exposing infrastructure tools like the NAS, Proxmox UI, or monitoring dashboards.

Internal

• Home automation, media, monitoring, and infrastructure dashboards.
• Protected with Tinyauth as a lightweight Forward Auth layer.
• Uses predictable internal hostnames, such as https://*.homelab.internal.

External

• Public portfolio, auth portal, and any external APIs.
• Protected with Authentik where OIDC, audit history, sessions, or MFA matter.
• Reached through Cloudflare Tunnel before traffic lands on the external Traefik instance.

Service Discovery

Local containers are discovered through the Traefik Docker provider. Services on other Docker hosts are discovered through Traefik Kop, which watches the remote host’s Docker socket and publishes Traefik-compatible route data into Redis.

That gives the central Traefik instances a single discovery source without mounting every host’s Docker socket into one container.

providers:
  docker:
    exposedByDefault: false
  redis:
    endpoints:
      - "traefik-internal-redis:6379"
    rootKey: "traefik"
  file:
    directory: /config/dynamic
    watch: true

Remote services only need labels that describe their route and namespace:

services:
  my-app:
    image: my-app:latest
    labels:
      traefik.enable: "true"
      traefik.http.routers.my-app.rule: "Host(`app.homelab.internal`)"
      kop.namespace: "internal"

Static Routes

Not everything belongs in Docker. Appliances and host-level tools, such as TrueNAS, Proxmox, and UniFi, should stay in file-provider config so their routes remain explicit and easy to audit.

Public Edge

The external proxy does not listen directly on a public IP. Cloudflare Tunnel maintains the outbound connection to Cloudflare, and Cloudflare handles edge TLS and DDoS protection before requests reach the lab.

CrowdSec reads Traefik access logs and sends block decisions back to the external proxy. It is not a replacement for auth, but it adds a useful layer against noisy scanners and repeated bad requests.

Boot Order

Docker restart policies are not enough for this stack. Traefik depends on shared Docker networks, Redis, and discovery agents being available in the right order.

Each core stack is wrapped in a systemd service so boot is deterministic:

[Unit]
Description=Traefik Internal Proxy
Requires=docker.service homelab-networks.service
After=docker.service homelab-networks.service

[Service]
Type=oneshot
RemainAfterExit=true
WorkingDirectory=/opt/traefik-internal
ExecStart=/usr/bin/docker compose up -d
ExecStop=/usr/bin/docker compose down
Restart=on-failure
RestartSec=15
TimeoutStartSec=300

The expected order is networks first, then Traefik and Redis, then discovery and security services, then applications.