1

So I'm building a media server via docker that is supposed to be accessible from everywhere (the host, the whole host's LAN, the WAN). Basically i have a bunch of web interfaces each. Each interface is by default accessible under a specific port but µI want it accessible under a subdomain on port 80. and I want to use traefik as a reverse proxy so it would be the only container that is technically accessible from everywhere.

I guess accessing domains hosted on my network from my network may cause some problem. This is why I focus on WAN access first as I always have access to WAN but not LAN (4G).

If I want to access the server over the WAN, the request (plex.domain.tld:80) will go

  1. To a DNS server - DNS configured and pointing to my router IP
  2. To my router - Port 80 is forwarded to my docker host
  3. To my host - Problem I don't know how to redirect this to my traefik container. In my docker-compose.yml I defined a custom network with a subnet and i gave a static IP to my traefik container.
  4. To traefik - Warning I'm unsure wether my docker-compose.yml is correct. It should redirect request to plex.domain.tld on port 80 to my plex container but i couldn't test it yet.

My questions are: First, are my assumptions above corrects ? I'm far from a network guy and want to start on good basis. Second, If my only problem is redirecting the traffic comming to my host to a specific container i know th IP of; how do i redirect said traffic ?

docker-compose.yml: latest version

version: '3.2'

networks:
  proxy:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.16.238.0/24

services:
  traefik:
    image: traefik
    container_name: traefik
    hostname: traefik
    restart: unless-stopped  
    networks:
      proxy:
        ipv4_address: 172.16.238.2
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
    ports:
      - 8080:8080
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${ROOT_FOLDER}\\traefik\\config:/etc/traefik
      #- ${ROOT_FOLDER}\\traefik\\config\\acme.json:/acme.json
    labels:
      - "traefik.enable=false"
      - "traefik.docker.network=proxy"
      - "traefik.port=80"
      - "traefik.frontend.rule=Host:traefik.${DOMAIN_NAME}"
      - "traefik.frontend.rule=Host:${DOMAIN_NAME}"

  plex: # https://hub.docker.com/r/linuxserver/plex
    image: linuxserver/plex
    container_name: plex
    hostname: plex
    restart: unless-stopped
    networks:
      - proxy
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
      - PLEX_CLAIM=${PLEX_CLAIM}
      - VERSION=public
      - UMASK_SET=022
    ports:
      - 32400:32400/tcp
      - 3005:3005/tcp
      - 8324:8324/tcp
      - 32469:32469/tcp
      - 1900:1900/udp
      - 32410:32410/udp
      - 32412:32412/udp
      - 32413:32413/udp
      - 32414:32414/udp
    volumes:
      - "${ROOT_FOLDER}\\library:/library"
      - "${ROOT_FOLDER}\\plex\\database:/config"
      - "${ROOT_FOLDER}\\plex\\tmp\\transcode:/transcode"
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.port=80"
      - "traefik.frontend.rule=Host:plex.${DOMAIN_NAME}"
    depends_on:
      - traefik
Bancarel Valentin
  • 111
  • 1
  • 5

1 Answers1

0

You're assumptions are right, so

  1. first, the request will travel to a dns server, which is pointing to your public ip address
  2. Your router will forward the incoming request to your docker host on port 80
  3. On your docker host, traefik will listen to every request that is arriving on port 80
  4. Depending on your configuration, traefik will route the request to a specific docker container.

So first of all, you should add a docker network (proxynetwork), where traefik can find all of your docker containers

docker network create proxynetwork

Afterwards you should save the treafik config file on your traefik folder (${ROOT_FOLDER}\traefik\traefik.toml). Replace youremail@mail.com with your email address.

################################################################
#
# Configuration sample for Traefik v2.
#
# For Traefik v1: https://github.com/containous/traefik/blob/v1.7/traefik.sample.toml
#
################################################################

################################################################
# Global configuration
################################################################
[global]
  checkNewVersion = true
  sendAnonymousUsage = true

################################################################
# Entrypoints configuration
################################################################

# Entrypoints definition
#
# Optional
# Default:
[entryPoints]
  [entryPoints.web]
    address = ":80"

  [entryPoints.websecure]
    address = ":443"

################################################################
# Traefik logs configuration
################################################################

# Traefik logs
# Enabled by default and log to stdout
#
# Optional
#
[log]

  # Log level
  #
  # Optional
  # Default: "ERROR"
  #
  # level = "DEBUG"

  # Sets the filepath for the traefik log. If not specified, stdout will be used.
  # Intermediate directories are created if necessary.
  #
  # Optional
  # Default: os.Stdout
  #
  # filePath = "log/traefik.log"

  # Format is either "json" or "common".
  #
  # Optional
  # Default: "common"
  #
  # format = "json"

################################################################
# Access logs configuration
################################################################

# Enable access logs
# By default it will write to stdout and produce logs in the textual
# Common Log Format (CLF), extended with additional fields.
#
# Optional
#
# [accessLog]

  # Sets the file path for the access log. If not specified, stdout will be used.
  # Intermediate directories are created if necessary.
  #
  # Optional
  # Default: os.Stdout
  #
  # filePath = "/path/to/log/log.txt"

  # Format is either "json" or "common".
  #
  # Optional
  # Default: "common"
  #
  # format = "json"

################################################################
# API and dashboard configuration
################################################################

# Enable API and dashboard
[api]

  # Enable the API in insecure mode
  #
  # Optional
  # Default: false
  #
  # insecure = true

  # Enabled Dashboard
  #
  # Optional
  # Default: true
  #
  dashboard = true

################################################################
# Ping configuration
################################################################

# Enable ping
[ping]

  # Name of the related entry point
  #
  # Optional
  # Default: "traefik"
  #
  # entryPoint = "traefik"

################################################################
# Docker configuration backend
################################################################

# Enable Docker configuration backend
[providers.docker]

  # Docker server endpoint. Can be a tcp or a unix socket endpoint.
  #
  # Required
  # Default: "unix:///var/run/docker.sock"
  #
  # endpoint = "tcp://10.10.10.10:2375"

  # Default host rule.
  #
  # Optional
  # Default: "Host(`{{ normalize .Name }}`)"
  #
  # defaultRule = "Host(`{{ normalize .Name }}.docker.localhost`)"

  # Expose containers by default in traefik
  #
  # Optional
  # Default: true
  #
  exposedByDefault = false

################################################################
# ACME configuration
################################################################

# Enable ACME (Let's Encrypt): automatic SSL.
[certificatesResolvers.sgfs-httpChallenge.acme]

  # Email address used for registration.
  #
  # Required
  #
  email = "youremail@mail.com"

  # File or key used for certificates storage.
  #
  # Required
  #
  storage = "${ROOT_FOLDER}\\traefik\\acme.json"

  # CA server to use.
  # Uncomment the line to use Let's Encrypt's staging server,
  # leave commented to go to prod.
  #
  # Optional
  # Default: "https://acme-v02.api.letsencrypt.org/directory"
  #
  # caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"

  # KeyType to use.
  #
  # Optional
  # Default: "RSA4096"
  #
  # Available values : "EC256", "EC384", "RSA2048", "RSA4096", "RSA8192"
  #
  # keyType = "RSA4096"

  # Use a TLS-ALPN-01 ACME challenge.
  #
  # Optional (but recommended)
  #
  #[certificatesResolvers.sgfs.acme.tlsChallenge]

  # Use a HTTP-01 ACME challenge.
  #
  # Optional
  #
  [certificatesResolvers.sgfs-httpChallenge.acme.httpChallenge]

    # EntryPoint to use for the HTTP-01 challenges.
    #
    # Required
    #
    entryPoint = "web"

  # Use a DNS-01 ACME challenge rather than HTTP-01 challenge.
  # Note: mandatory for wildcard certificate generation.
  #
  # Optional
  #
  # [certificatesResolvers.sample.acme.dnsChallenge]

    # DNS provider used.
    #
    # Required
    #
    # provider = "digitalocean"

    # By default, the provider will verify the TXT DNS challenge record before letting ACME verify.
    # If delayBeforeCheck is greater than zero, this check is delayed for the configured duration in seconds.
    # Useful if internal networks block external DNS queries.
    #
    # Optional
    # Default: 0
    #
    # delayBeforeCheck = 0

    # Use following DNS servers to resolve the FQDN authority.
    #
    # Optional
    # Default: empty
    #
    # resolvers = ["1.1.1.1:53", "8.8.8.8:53"]

    # Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready.
    #
    # NOT RECOMMENDED:
    # Increase the risk of reaching Let's Encrypt's rate limits.
    #
    # Optional
    # Default: false
    #
    # disablePropagationCheck = true

After that, you can set up traefik (v2.0) with the following docker-compose file

version: "3.3"

services:
  traefik:
    image: traefik:latest
    restart: always
    container_name: traefik
    hostname: traefik
    domainname: "domain.tld"
    networks:
      - proxynetwork
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${ROOT_FOLDER}\\traefik\\traefik.toml:/etc/traefik/traefik.toml
      - ${ROOT_FOLDER}\\traefik\\acme.json:/etc/traefik/acme.json
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    labels:
      - traefik.enable=true
      - traefik.http.routers.api.rule=Host(`traefik.domain.tld`)
      - traefik.http.routers.api.service=api@internal
      - traefik.http.routers.api.middlewares=sgfs-auth
      - traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"

networks:
  proxynetwork:
    external: true

Change the password and the username on the line:

  • traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"

You can generate the credentials for example on this site.

So now you should be able to access the traefik dashboard with the following url.

traefik.domain.tld

So last step, you can set up your media docker container. Use for this the following docker-compose file


version: "3.3"

services:
  plex: # https://hub.docker.com/r/linuxserver/plex
    image: linuxserver/plex
    container_name: plex
    hostname: plex
    restart: unless-stopped
    networks:
      - proxynetwork
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
      - PLEX_CLAIM=${PLEX_CLAIM}
      - VERSION=public
      - UMASK_SET=022
    ports:
      - 32400:32400/tcp
      - 3005:3005/tcp
      - 8324:8324/tcp
      - 32469:32469/tcp
      - 1900:1900/udp
      - 32410:32410/udp
      - 32412:32412/udp
      - 32413:32413/udp
      - 32414:32414/udp
    volumes:
      - "${ROOT_FOLDER}\\library:/library"
      - "${ROOT_FOLDER}\\plex\\database:/config"
      - "${ROOT_FOLDER}\\plex\\tmp\\transcode:/transcode"
    labels:
      - traefik.enable=true
      - traefik.docker.network=proxynetwork
      - traefik.http.routers.plex.rule=Host(`plex.domain.tld`)
      - traefik.http.routers.plex.entrypoints=web

networks:
  proxynetwork:
    external: true

I hope this works for you.

M4SX5
  • 13
  • 1
  • 7