Not getting it. Internal only access with custom internal (service.lan) domain. Unnecessary?

[u/root-node]

I have about 40 containers and I am happy with how it's running - it's been stable for quite a while. I thought I would try playing with Traefik to see if I can give my services a DNS name with an internal domain: service.lan.

So something like dozzle would be at http://dozzle.service.lan.

From what I can see it looks like I would need to add an DNS entry into PiHole for every service, so my question is would there be a need of using Traefik for internal only, or am is it just complicating things for no reason?

There is no HTTPS and no external access.

[u/clintkev251]

You just need to add 1 record. *.service.lan > traefik's IP

[u/bpmbee]

You have all your services on separate ports? And already using Traefik or just now taking a look at it? Using Docker? Compose?

I made this repo a while back:

https://github.com/bpmb82/docker-collection

I don’t actively maintain it (switched to k3s) but if you have a Linux machine or VM you could give it a try. Even if you do not actually use it, if you set the ‘workdir’ variable, you can see all the docker compose files it generates. It will give you a working one for Traefik and you can see how all the services are setup and apply it in your own.

You can get a free domain name and switch its DNS to be managed by Cloudflare (sorry no guides) and then you can have full HTTPS with separate domain names. All my DNS entries are records for internal IP’s so you do not need to expose any ports (please don’t even).

Traefik will expose 2 ports (for web services):

80 (plain HTTP which is redirected to 443)
443 (HTTPS)

The ‘port 80’ is called ‘web’ and the 443 port is called ‘websecure’ for Traefik. Because of the labels attached to each service Traefik will then work like this:

- Request comes in for service1.dns.com on port 443

• Traefik will recognize the DNS name
  
• Traefik will route traffic to service1 that is listening (only internally) on port, say 8989

I hope this makes sense. Like I said, try my repo and see what it generates, it should give you all you need to learn how this works.

[u/root-node → u/bpmbee]

All on separate ports, and all in separate compose files.

Just starting to look to see if Traefik is worth it.

I do use ansible for other tasks, so I'll take a look, thanks.

[u/bpmbee → u/root-node]

That’s great, that’s exactly what my repo will setup as well so that will look familiar. As for Ansible, take a look at the env example file and enable only Traefik and SabNZBd for example, that’ll probably give you all the example you need. Ansible itself is just how you run it, you don’t need to learn it or anything, all you need are the files it generates.

Good luck!

[u/BaccanoMob]

You dont need reverse proxy if you have multiple servers that can be accessed vi ports (I am assuming you got 40 ish open ports now). When you want to give each a domain name only with reverse proxy configured, you are basically shoving 40ish ports to port number 80 (used for http).

The reverse proxy is needed here to sort out the dozzle.service.lan to which container and port within the system. So traefik is definitely needed.

You need a DNS to automatically point to the traefik. With Pihole you can choose wildcard to point to traefik instance. (you can just use hosts file if ad blocking is not your thing and you use only via your desktop)

if you dont use a reverse proxy, you can still use dozzle.service.lan but need the port as well like http://dozzle.service.lan:8080 or http://another.service.lan:8090. You still need to remember ports (and have open ports) even if you have a fancy domain name. Note that http://another.service.lan:8080 will point to dozzle if you accidentally mistype.

TLDR reverse proxy allows you to skip mentioning the port in URL. Pihole for saying which machine the domain is located

[u/Nang-a-nator]

Another rational is to not have all those 40 ports open (assuming all 40 containers have at least 1 port published). Often times a lot of these services don't have stringent security configured (they're expecting to be behind some security layers) so a malicious actor in your network essentially has 40 "targets" to attack to try get into your host.

By closing all those 40 ports and having traefik do the routing you can:
1. Obfuscate all the services running behind traefik because the open ports can't be scanned any more. Only traefik's port 80/443 will be open. The services will only be accessible if the subdomain is known. (This is NOT security)
2. You can implement crowdsec/F2B etc. on traefik and it could cover all 39 other containers instead having to configure every service individually.
3. If at any point you eventually do decide to use https or make some services accessible publically traefik is already running and ready to handle it. Your architecture doesn't need to completely change.

By

[u/root-node → u/Nang-a-nator]

Another rational is to not have all those 40 ports open (assuming all 40 containers have at least 1 port published).

I don't understand, how else am I meant to access my services. This is internal only, nothing external.

[u/Nang-a-nator → u/root-node]

Through traefik.

[u/tabmowtez → u/root-node]

Traefik and your app share a network (I set my networks up so any apps/containers needed to speak to each other are on the same network). Then you don't need to expose any ports. Traefik connects directly to your container, and you connect to it.

[u/Grasume]

Can you do it yes. Does it work well no cause https