Setting up a local reverse proxy on Proxmox with Traefik and Cloudflare

May 8, 2024

After setting up my AI homelab and various other services in a previous blog post, my friend Nader and I experimented with how to access some of these services using a domain instead of the IP address without exposing our home IP or opening ports.

In this blog post, I will guide you through setting up a local reverse proxy on Proxmox with Traefik v3 and Cloudflare. This setup will allow you to access your services with a domain name and also secure them with SSL certificates.

What is a reverse proxy?

A reverse proxy is a server that sits between clients and servers. It forwards client requests to the appropriate backend server and then returns the server’s response to the client. This allows you to host multiple services on a single server and route traffic based on the domain name.

Reverse Proxy

In this simplified diagram, the user wants to access “MyService.MyDomain.tld”, the requests goes through the DNS resolver, which gets a local IP address from Cloudflare and then the reverse proxy forwards the request to the correct service.

My Proxmox setup

On my Proxmox setup I have a few LXC containers running various services. I have a dedicated LXC container for Traefik v3, which is an underprivileged Alpine Linux container with Docker installed. This setup is, in my opinion, the most stable way to run Traefik on Proxmox.

If you want to replicate the setup I used the ttek script to create the LXC container. You should accept the docker compose installation and the script will install Docker and Docker Compose for you.

1
bash -c "$(wget -qO - https://github.com/tteck/Proxmox/raw/main/ct/alpine-docker.sh)"

Setting up Traefik on Docker

From this point on the setup is heavily inspired by the excellent video tutorial of Techno Tim. Inside the Traefik LXC container, create a folder for the Traefik configuration

1
mkdir traefik
2
cd traefik
3
touch docker-compose.yml

1
services:
2
  traefik:
3
    image: traefik:latest  # Use the latest Traefik image
4
    container_name: traefik  # Name of the container
5
    restart: unless-stopped  # Ensures the container restarts if it stops unexpectedly
6
    security_opt:
7
      - no-new-privileges:true  # Prevents the container from gaining additional privileges
8
    networks:
9
       proxy:  # Connects to the predefined external network named 'proxy'
10
    ports:
11
      - 80:80  # HTTP port
12
      - 443:443  # HTTPS port
13
      - 8080:8080  # Traefik dashboard port
14
    environment:
15
      - CF_API_EMAIL=YOUR_CLOUDFLARE_ACCOUNT_EMAIL  # Cloudflare account email for API access
16
      - CF_DNS_API_TOKEN=YOUR_CLOUDFLARE_API_TOKEN_HERE  # Cloudflare DNS API token
17
    volumes:
18
      - /etc/localtime:/etc/localtime:ro  # Sync time with the host
19
      - /var/run/docker.sock:/var/run/docker.sock:ro  # Allows Traefik to interact with Docker
20
      - /root/traefik/data/traefik.yml:/traefik.yml:ro  # Traefik configuration file
21
      - /root/traefik/data/acme.json:/acme.json  # SSL certificate file
22
      - /root/traefik/data/config.yml:/config.yml:ro  # Additional configuration file
23
      - /root/traefik/data/logs:/var/log/traefik  # Log directory
24
    labels:
25
      - "traefik.enable=true"  # Enable Traefik on this service
26
      - "traefik.http.routers.traefik.entrypoints=http"  # Define HTTP entrypoint
27
      - "traefik.http.routers.traefik.rule=Host(`traefik.MyDomain.TLD`)"  # Host rule for routing
28
      - "traefik.http.middlewares.traefik-auth.basicauth.users=traefik:$2y$$05$$fkKKsDM0LEQAG6nPuk7dxeJElSkGJxCeuCsZgwoQWqPzyZdRkfYeK"  # Basic auth for security traefik for username/pass
29
      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"  # Redirect HTTP to HTTPS
30
      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"  # Set forwarded headers for SSL
31
      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"  # Apply HTTPS redirect middleware
32
      - "traefik.http.routers.traefik-secure.entrypoints=https"  # Secure entrypoint for HTTPS
33
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik.MyDomain.TLD`)"  # Host rule for secure routing
34
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"  # Apply authentication middleware
35
      - "traefik.http.routers.traefik-secure.tls=true"  # Enable TLS for secure connection
36
      - "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare"  # Use Cloudflare for SSL certificate resolution
37
      - "traefik.http.routers.traefik-secure.tls.domains[0].main=MyDomain.TLD"  # Main domain for SSL certificate
38
      - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.MyDomain.TLD"  # SANs for SSL certificate
39
      - "traefik.http.routers.traefik-secure.service=api@internal"  # Internal service for Traefik API
40

41
networks:
42
  proxy:
43
    name: proxy  # Specifies the external network to connect to
44
    external: true  # Indicates that the network is external

Configuring Traefik v3 with our services

Get your Cloudflare DNS API key with a restricted scope for the zone you want to use. Add a docker-compose.yml file with the following content:

In the data folder we need 3 files:

1
mkdir data
2
cd data

Add a traefik.yml file with the following content:

1
api:
2
  dashboard: true
3
  debug: true
4
entryPoints:
5
  http:
6
    address: ":80"
7
    http:
8
      redirections:
9
        entryPoint:
10
          to: https
11
          scheme: https
12
  https:
13
    address: ":443"
14
  traefik:
15
    address: ":8080"
16
serversTransport:
17
  insecureSkipVerify: true
18
providers:
19
  docker:
20
    endpoint: "unix:///var/run/docker.sock"
21
    exposedByDefault: false
22
  file:
23
    filename: config.yml
24
certificatesResolvers:
25
  cloudflare:
26
    acme:
27
      email: YOUR_CLOUDFLARE_ACCOUNT_EMAIL
28
      storage: acme.json
29
      dnsChallenge:
30
        provider: cloudflare
31
        # uncomment this if you have issues pulling certificates through cloudflare, By setting this flag to true disables the need to wait for the
32
        #disablePropagationCheck: true
33
  resolvers:
34
    - "1.1.1.1:53"
35
    - "1.0.0.1:53"

Add a config.yml file with the following content:

1
http:
2
 #region routers
3
  routers:
4
    dashboard:
5
      entryPoints:
6
        - "https"
7
      rule: "Host(`MyDomain.TLD`)"
8
      middlewares:
9
        - default-headers
10
        - https-redirectscheme
11
      tls: {}
12
      service: dashboard
13
 #endregion
14

15
  #region services
16
  services:
17
    dashboard:
18
      loadBalancer:
19
        servers:
20
          - url: "http://192.168.1.200:8080"
21
        passHostHeader: true
22
  #endregion
23

24
  #region middlewares
25
  middlewares:
26
    https-redirectscheme:
27
      redirectScheme:
28
        scheme: https
29
        permanent: true
30

31
    default-headers:
32
      headers:
33
        frameDeny: true
34
        browserXssFilter: true
35
        contentTypeNosniff: true
36
        forceSTSHeader: true
37
        stsIncludeSubdomains: true
38
        stsPreload: true
39
        stsSeconds: 15552000
40
        customFrameOptionsValue: SAMEORIGIN
41
        customRequestHeaders:
42
          X-Forwarded-Proto: https
43

44
    default-whitelist:
45
      ipWhiteList:
46
        sourceRange:
47
        - "10.0.0.0/8"
48
        - "192.168.0.0/16"
49
        - "172.16.0.0/12"
50

51
    secured:
52
      chain:
53
        middlewares:
54
        - default-whitelist
55
        - default-headers
56
  #endregion

Add a blank acme.json file:

1
touch acme.json
2
chmod 600 acme.json

At start this file will be empty, but Traefik will populate it with the SSL certificates it gets from certbot and the DNS verification through Cloudflare.

Setting up your domain with Cloudflare

Before running Traefik, it’s essential to configure your domain’s DNS settings on Cloudflare to ensure that your services are accessible via your domain name and secured with SSL. Here are the steps to set up the necessary DNS records:

Log in to your Cloudflare account and select the domain you want to configure.
Navigate to the DNS section of your Cloudflare dashboard.
Add the following DNS records:
- A Record: This should point to the local IP address of your Traefik container. Set the name to @ to represent your root domain (e.g., MyDomain.TLD).
- CNAME Record: Create a CNAME record for each subdomain that points to your root domain. For example, if you have a service accessible at MyService.MyDomain.TLD, create a CNAME record with the name MyService and the value MyDomain.TLD.
Ensure Proxy Status: Set the proxy status to ‘DNS Only’ for these records.
SSL/TLS Configuration:
- Go to the SSL/TLS section of your Cloudflare dashboard.
- Ensure that the SSL/TLS encryption mode is set to ‘Full (strict)’. This ensures that the connection between Cloudflare and your server is secure.

Starting Traefik

In your root folder `/traefik, run the following command to start the Traefik container:

1
docker network create proxy
2
docker compose up -d --force-recreate

At this point you should be able to access the Traefik dashboard at https://traefik.MyDomain.TLD with the username/password you set in the docker-compose.yml file.

Traefik Dashboard

Conclusion

Setting up a local reverse proxy using Proxmox, Traefik, and Cloudflare enhances the security and accessibility of your services. By following the steps outlined in this guide, you can achieve a robust setup that protects your services with SSL certificates and makes them accessible via domain names instead of IP addresses.

If you found this guide useful you can also check the previous ones about Using venv, pyvenv-autoenv, and macOS and Abstracting local development environments through containers.