Traefik¶
LXC: management lxc (CT 100) - reverse proxy for all internal services. See internal https for the HTTPS/cert architecture and entrypoint design.
Instance¶
| Setting | Value |
|---|---|
| Version | v3 |
| Dashboard | https://traefik.home.example.com/dashboard/ (trailing slash required) |
| Static config | /data/config/management/traefik/traefik.yml |
| Dynamic config dir | /data/config/management/traefik/config/ (hot-reloaded) |
| ACME storage | /data/config/management/traefik/acme/acme.json (must be 600) |
| Managed as | Komodo stack traefik |
Entrypoints¶
| Name | Port | Purpose |
|---|---|---|
web |
:80 |
HTTP (unused - no services on HTTP) |
websecure |
:443 |
User-facing services |
admin |
:<admin-port> |
Admin tools - restricted to tag:admin via Tailscale ACL |
Active Routes¶
User-facing (:443) - accessible to all Tailscale tags:
| Domain | Backend | Service |
|---|---|---|
glance.home.example.com |
:8081 | Glance |
seerr.home.example.com |
Seerr | |
jellyfin.home.example.com |
Jellyfin | |
game-panel.home.example.com |
Pterodactyl Panel |
Admin-only (:<admin-port>) - admin-only middleware applied:
| Domain | Backend | Service |
|---|---|---|
traefik.home.example.com:<admin-port> |
:8080 | Traefik dashboard |
komodo.home.example.com:<admin-port> |
:9120 | Komodo UI |
pihole.home.example.com:<admin-port> |
Pi-hole admin | |
files.home.example.com:<admin-port> |
:8082 | FileBrowser |
grafana.home.example.com:<admin-port> |
Grafana | |
prometheus.home.example.com:<admin-port> |
Prometheus | |
kuma.home.example.com:<admin-port> |
Uptime Kuma | |
sonarr.home.example.com:<admin-port> |
Sonarr | |
radarr.home.example.com:<admin-port> |
Radarr | |
prowlarr.home.example.com:<admin-port> |
Prowlarr | |
bazarr.home.example.com:<admin-port> |
Bazarr | |
dispatcharr.home.example.com:<admin-port> |
Dispatcharr | |
jellystat.home.example.com:<admin-port> |
Jellystat | |
downloads.home.example.com:<admin-port> |
qBittorrent | |
sabnzbd.home.example.com:<admin-port> |
SABnzbd | |
adsb.home.example.com:<admin-port> |
Ultrafeeder/tar1090 | |
piaware.home.example.com:<admin-port> |
Piaware | |
fr24.home.example.com:<admin-port> |
FlightRadar24 | |
zigbee.home.example.com:<admin-port> |
Zigbee2MQTT | |
homebridge.home.example.com:<admin-port> |
Homebridge | |
budget.home.example.com:<admin-port> |
Actual Budget | |
mealie.home.example.com:<admin-port> |
Mealie | |
freshrss.home.example.com:<admin-port> |
FreshRSS | |
grimmory.home.example.com:<admin-port> |
Grimmory | |
grocy.home.example.com:<admin-port> |
Grocy |
Route files live in /data/config/management/traefik/config/. Traefik hot-reloads on file change - no restart needed.
Docker Configuration Note¶
userland-proxy: false is required in /etc/docker/daemon.json on CT 100. Without it Docker NATs all connections to the bridge gateway, masking real client IPs and breaking ipAllowList middleware.
Adding a New Route¶
Create /data/config/management/traefik/config/<service>.yml on CT 100. Use:
- websecure entrypoint + tls: {} for user-facing services
- admin entrypoint + admin-only middleware for admin tools
No DNS or cert changes needed - the wildcard cert covers all *.home.example.com subdomains automatically.
Key Takeaways¶
- Trailing slash required on dashboard URL - bare root returns 404
- File-based routing only - no Docker label auto-discovery across LXCs
userland-proxy: falsemust remain in daemon.json oripAllowListbreaks- Route files hot-reload - no Traefik restart needed after adding/editing a route file