[{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1gphgmz","num_comments":10,"author_fullname":"t2_edyfrpe","url":"https://www.reddit.com/r/Traefik/comments/1gphgmz/i_need_help_getting_users_original_ip_in_reverse/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1731406034,"title":"I need help getting users' original IP in reverse proxy","selftext":"I have been pulling my hair on this. I have traefik handling SSL for HTTP docker container. But I cannot seem to get the users' real IP both in X-Forwarded-For and Real-IP headers. They all come as the container IP. I have tried enabling proxy protocol both for version 1 and 2 but to no avail.\n\nHere is my docker compose\n\n services:\n traefik:\n image: traefik:v3.2\n command:\n - --api.insecure=true #remove in production!\n - --api.dashboard=true #remove in production!\n - --providers.docker\n - --providers.docker.exposedByDefault=false\n - --log.level=ERROR\n - --entryPoints.web.address=:80\n - --entrypoints.websecure.address=:443\n - --certificatesresolvers.myresolver.acme.tlschallenge=true\n # - --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory\n - --certificatesresolvers.myresolver.acme.email=${WEBMASTER_EMAIL}\n - --certificatesresolvers.myresolver.acme.storage=/ssl/acme.json\n ports:\n - \"80:80\"\n - \"8080:8080\"\n - \"443:443\"\n volumes:\n - /var/run/docker.sock:/var/run/docker.sock:ro\n - ./ssl:/ssl\n labels:\n - traefik.enable=true\n - traefik.http.routers.traefik.rule=Host(`traefik.$BASE_DOMAIN`)\n - traefik.http.routers.traefik.entrypoints=web\n - traefik.http.routers.traefik.service=traefik_service\n - traefik.http.services.traefik_service.loadbalancer.server.port=8080\n \n wordpress:\n ...\n ...\n labels:\n - traefik.enable=true\n - traefik.http.routers.wordpress_router.rule=Host(`$BASE_DOMAIN`)\n - traefik.http.routers.wordpress_router.entrypoints=websecure\n - traefik.http.routers.wordpress_router.service=web\n - traefik.http.routers.wordpress_router.tls.certresolver=myresolver\n - traefik.http.services.web.loadbalancer.server.port=80\n - traefik.tcp.services.web.loadbalancer.proxyprotocol.version=2\n - traefik.http.routers.websocket.rule=Host(`$WEBSOCKET_DOMAIN`)\n - traefik.http.routers.websocket.entrypoints=websecure\n - traefik.http.routers.websocket.service=wss\n - traefik.http.routers.websocket.tls.certresolver=myresolver\n - traefik.http.services.wss.loadbalancer.server.port=${WEBSOCKET_PORT}\n - traefik.tcp.services.wss.loadbalancer.proxyprotocol.version=2\n\nHow do I solve this issue?","selftext_html":"

I have been pulling my hair on this. I have traefik handling SSL for HTTP docker container. But I cannot seem to get the users' real IP both in X-Forwarded-For and Real-IP headers. They all come as the container IP. I have tried enabling proxy protocol both for version 1 and 2 but to no avail.

\n\n

Here is my docker compose

\n\n

services:\n  traefik:\n    image: traefik:v3.2\n    command:\n      - --api.insecure=true #remove in production!\n      - --api.dashboard=true #remove in production!\n      - --providers.docker\n      - --providers.docker.exposedByDefault=false\n      - --log.level=ERROR\n      - --entryPoints.web.address=:80\n      - --entrypoints.websecure.address=:443\n      - --certificatesresolvers.myresolver.acme.tlschallenge=true\n#      - --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory\n      - --certificatesresolvers.myresolver.acme.email=${WEBMASTER_EMAIL}\n      - --certificatesresolvers.myresolver.acme.storage=/ssl/acme.json\n    ports:\n      - "80:80"\n      - "8080:8080"\n      - "443:443"\n    volumes:\n      - /var/run/docker.sock:/var/run/docker.sock:ro\n      - ./ssl:/ssl\n    labels:\n      - traefik.enable=true\n      - traefik.http.routers.traefik.rule=Host(`traefik.$BASE_DOMAIN`)\n      - traefik.http.routers.traefik.entrypoints=web\n      - traefik.http.routers.traefik.service=traefik_service\n      - traefik.http.services.traefik_service.loadbalancer.server.port=8080\n\n  wordpress:\n    ...\n    ...\n    labels:\n      - traefik.enable=true\n      - traefik.http.routers.wordpress_router.rule=Host(`$BASE_DOMAIN`)\n      - traefik.http.routers.wordpress_router.entrypoints=websecure\n      - traefik.http.routers.wordpress_router.service=web\n      - traefik.http.routers.wordpress_router.tls.certresolver=myresolver\n      - traefik.http.services.web.loadbalancer.server.port=80\n      - traefik.tcp.services.web.loadbalancer.proxyprotocol.version=2\n      - traefik.http.routers.websocket.rule=Host(`$WEBSOCKET_DOMAIN`)\n      - traefik.http.routers.websocket.entrypoints=websecure\n      - traefik.http.routers.websocket.service=wss\n      - traefik.http.routers.websocket.tls.certresolver=myresolver\n      - traefik.http.services.wss.loadbalancer.server.port=${WEBSOCKET_PORT}\n      - traefik.tcp.services.wss.loadbalancer.proxyprotocol.version=2\n

\n\n

How do I solve this issue?

I have deployed a SOLR container using docker and traefik. When I tried to access the API in my react app, I am getting CORS error. I have looked up online and tried many solutions but nothing seems to work. This is my docker compose file

\n\n

version: '3.7'\nservices:\n  solr:\n    image: solr:latest\n    container_name: solr\n    restart: unless-stopped\n    networks:\n      - proxy\n    ports:\n      - "8983:8983"\n    volumes:\n      - /data/solr:/var/solr\n    labels:\n      - "traefik.enable=true"\n      - "traefik.http.routers.solr.entrypoints=http"\n      - "traefik.http.routers.solr.rule=Host(`solr.exdomain.com`) || Host(`www.solr.exdomain.com`)"\n      - "traefik.http.middlewares.solr-https-redirect.redirectscheme.scheme=https"\n      - "traefik.http.routers.solr.middlewares=solr-https-redirect,redirect-www-to-non-www@file"\n      - "traefik.http.routers.solr-secure.entrypoints=https"\n      - "traefik.http.routers.solr-secure.rule=Host(`solr.exdomain.com`) || Host(`www.solr.exdomain.com`)"\n      - "traefik.http.routers.solr-secure.tls=true"\n      - "traefik.http.routers.solr-secure.service=solr"\n      - "traefik.http.routers.solr-secure.middlewares=solr-https-redirect,redirect-www-to-non-www@file"\n      - "traefik.http.services.solr.loadbalancer.server.port=8983"\n      - "traefik.docker.network=proxy"\n      - "traefik.http.middlewares.cors.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"\n      - "traefik.http.middlewares.cors.headers.accesscontrolallowheaders=*"\n      - "traefik.http.middlewares.cors.headers.accesscontrolalloworiginlist=*"\n      - "traefik.http.middlewares.cors.headers.addvaryheader=true"\nnetworks:\n  proxy:\n    external: true\n

","ups":1,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1god33s","num_comments":0,"author_fullname":"t2_4w6xys16","url":"https://www.reddit.com/r/Traefik/comments/1god33s/getting_404_error_on_traefik_dashboard/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1731278420,"title":"Getting 404 error on traefik dashboard","selftext":"Hi,\n\nI am setting up a new cluster as my old one broke and I couldn't recover it. I had traefik setup before but now my nodes are on talos linux instead of ubuntu.\n\nI was following this guide by techno tim [https://youtu.be/G4CmbYL9UPg?si=sueaCSz8ldkmNVwy](https://youtu.be/G4CmbYL9UPg?si=sueaCSz8ldkmNVwy) but I can't seem to get it working, I keep getting a 404 page not found which leads me to believe metallb is working but traefik either won't redirect the traffic or traefik can't find the service.\n\nI installed using helm and the values.yaml file down the bottom.\n\nIf anyone can help that would be great\n\ndashboard-ingress.yaml\n\n apiVersion: traefik.containo.us/v1alpha1\n kind: IngressRoute\n metadata:\n name: traefik-dashboard\n namespace: traefik\n annotations: \n kubernetes.io/ingress.class: traefik-external\n spec:\n entryPoints:\n - websecure\n routes:\n - match: Host(`traefik.tinytown.au`)\n kind: Rule\n middlewares:\n - name: traefik-dashboard-basicauth\n namespace: traefik\n services:\n - name: api@internal\n kind: TraefikService\n\ndashboard-middleware.yaml\n\n apiVersion: traefik.containo.us/v1alpha1\n kind: Middleware\n metadata:\n name: traefik-dashboard-basicauth\n namespace: traefik\n spec:\n basicAuth:\n secret: traefik-dashboard-auth\n \n apiVersion: traefik.containo.us/v1alpha1\n kind: Middleware\n metadata:\n name: traefik-dashboard-basicauth\n namespace: traefik\n spec:\n basicAuth:\n secret: traefik-dashboard-auth\n\nvalues.yaml\n\n globalArguments:\n - \"--global.sendanonymoususage=false\"\n - \"--global.checknewversion=false\"\n \n \n additionalArguments:\n - \"--serversTransport.insecureSkipVerify=true\"\n - \"--log.level=DEBUG\"\n \n \n deployment:\n enabled: true\n replicas: 2\n annotations: {}\n podAnnotations: {}\n additionalContainers: []\n initContainers: []\n \n \n ports:\n web:\n redirectTo:\n port: websecure\n priority: 10\n websecure:\n http3:\n enabled: true\n advertisedPort: 4443\n tls:\n enabled: true\n \n ingressRoute:\n dashboard:\n enabled: false\n \n \n providers:\n kubernetesCRD:\n enabled: true\n ingressClass: traefik-external\n allowExternalNameServices: true\n kubernetesIngress:\n enabled: true\n allowExternalNameServices: true\n publishedService:\n enabled: false\n \n \n rbac:\n enabled: true\n \n \n service:\n enabled: true\n type: LoadBalancer\n annotations: {}\n labels: {}\n spec:\n loadBalancerIP: 192.168.10.81 # this should be an IP in the MetalLB range\n loadBalancerSourceRanges: []\n externalIPs: []\n\n","selftext_html":"

Hi,

\n\n

I am setting up a new cluster as my old one broke and I couldn't recover it. I had traefik setup before but now my nodes are on talos linux instead of ubuntu.

\n\n

I was following this guide by techno tim https://youtu.be/G4CmbYL9UPg?si=sueaCSz8ldkmNVwy but I can't seem to get it working, I keep getting a 404 page not found which leads me to believe metallb is working but traefik either won't redirect the traffic or traefik can't find the service.

\n\n

I installed using helm and the values.yaml file down the bottom.

\n\n

If anyone can help that would be great

\n\n

dashboard-ingress.yaml

\n\n

apiVersion: traefik.containo.us/v1alpha1\nkind: IngressRoute\nmetadata:\n  name: traefik-dashboard\n  namespace: traefik\n  annotations: \n    kubernetes.io/ingress.class: traefik-external\nspec:\n  entryPoints:\n    - websecure\n  routes:\n    - match: Host(`traefik.tinytown.au`)\n      kind: Rule\n      middlewares:\n        - name: traefik-dashboard-basicauth\n          namespace: traefik\n      services:\n        - name: api@internal\n          kind: TraefikService\n

\n\n

dashboard-middleware.yaml

\n\n

apiVersion: traefik.containo.us/v1alpha1\nkind: Middleware\nmetadata:\n  name: traefik-dashboard-basicauth\n  namespace: traefik\nspec:\n  basicAuth:\n    secret: traefik-dashboard-auth\n\napiVersion: traefik.containo.us/v1alpha1\nkind: Middleware\nmetadata:\n  name: traefik-dashboard-basicauth\n  namespace: traefik\nspec:\n  basicAuth:\n    secret: traefik-dashboard-auth\n

\n\n

values.yaml

\n\n

globalArguments:\n  - "--global.sendanonymoususage=false"\n  - "--global.checknewversion=false"\n\n\nadditionalArguments:\n  - "--serversTransport.insecureSkipVerify=true"\n  - "--log.level=DEBUG"\n\n\ndeployment:\n  enabled: true\n  replicas: 2\n  annotations: {}\n  podAnnotations: {}\n  additionalContainers: []\n  initContainers: []\n\n\nports:\n  web:\n    redirectTo:\n      port: websecure\n      priority: 10\n  websecure:\n    http3:\n      enabled: true\n    advertisedPort: 4443\n    tls:\n      enabled: true\n\ningressRoute:\n  dashboard:\n    enabled: false\n\n\nproviders:\n  kubernetesCRD:\n    enabled: true\n    ingressClass: traefik-external\n    allowExternalNameServices: true\n  kubernetesIngress:\n    enabled: true\n    allowExternalNameServices: true\n    publishedService:\n      enabled: false\n\n\nrbac:\n  enabled: true\n\n\nservice:\n  enabled: true\n  type: LoadBalancer\n  annotations: {}\n  labels: {}\n  spec:\n    loadBalancerIP: 192.168.10.81 # this should be an IP in the MetalLB range\n  loadBalancerSourceRanges: []\n  externalIPs: []\n

","post_hint":"self","ups":2,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1gkg4x2","num_comments":17,"author_fullname":"t2_8ar8x8d9","url":"https://www.reddit.com/r/Traefik/comments/1gkg4x2/traefik_help_needed_404_error_for_local_ip/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1730837699,"title":"Traefik Help Needed - 404 Error for Local IP Service - Prefix remote access","selftext":"Hi all,\n\nI’m setting up Traefik as a reverse proxy and followed [this video](https://www.youtube.com/watch?v=n1vOfdz5Nm8&list=TLPQMDMxMTIwMjSYLgW6_UuOfg&index=5) to get started. So far, Traefik works great for Docker services on the same machine, but I’m running into a problem with a service on another device on my LAN.\n\nHere’s the situation:\n\n• The service is hosted on a local IP and I’m using Pi-hole for resolving A and CNAME records.\n\n• The URL is secured with an SSL certificate, but when I access it, I get a “404 Not Found” error.\n\n• My goal is to eventually use subdomain prefixes for services like Jellyfin and Home Assistant, but first I need to figure out why Traefik can’t resolve the local IP.\n\nI’ve shared my config.yml [here](https://pastebin.com/qa4KtYE6).\n\nAny advice on troubleshooting this issue or pointers on the configuration would be highly appreciated! Thanks in advance!","selftext_html":"

Hi all,

\n\n

I’m setting up Traefik as a reverse proxy and followed this video to get started. So far, Traefik works great for Docker services on the same machine, but I’m running into a problem with a service on another device on my LAN.

\n\n

Here’s the situation:

\n\n

• The service is hosted on a local IP and I’m using Pi-hole for resolving A and CNAME records.

\n\n

• The URL is secured with an SSL certificate, but when I access it, I get a “404 Not Found” error.

\n\n

• My goal is to eventually use subdomain prefixes for services like Jellyfin and Home Assistant, but first I need to figure out why Traefik can’t resolve the local IP.

\n\n

I’ve shared my config.yml here.

\n\n

Any advice on troubleshooting this issue or pointers on the configuration would be highly appreciated! Thanks in advance!

","post_hint":"self","ups":1,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1gk9kuh","num_comments":33,"author_fullname":"t2_1iogkmcc","url":"https://www.reddit.com/r/Traefik/comments/1gk9kuh/finally_after_hours_of_fing_around/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1730821270,"title":"Finally, after hours of f-ing around..! 🙌","selftext":"A combination of too much late night f\\*ckery, confusion, not RTFM and general lack of knowledge meant I almost gave up on this... but I sat myself down, had a word with myself, binged all the YouTube videos from Jim's Garage, Techno Tim and Christian Lempa and actually read the documentation and finally... success..!\n\nI guess it was fun after all and incredibly satisfying to see this 😍:\n\nhttps://imgur.com/a/XKDlION","selftext_html":"

A combination of too much late night f*ckery, confusion, not RTFM and general lack of knowledge meant I almost gave up on this... but I sat myself down, had a word with myself, binged all the YouTube videos from Jim's Garage, Techno Tim and Christian Lempa and actually read the documentation and finally... success..!

\n\n

I guess it was fun after all and incredibly satisfying to see this 😍:

\n\n

https://imgur.com/a/XKDlION

","post_hint":"self","ups":31,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1gk9im6","num_comments":9,"author_fullname":"t2_umjos7i","url":"https://www.reddit.com/r/Traefik/comments/1gk9im6/bare_metal_or_docker_different_portainerserver_to/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1730821106,"title":"bare metal or docker? Different Portainer-\"Server\" to one Container?","selftext":"Hello everyone. I finally managed to install Traefik. First, I installed a container via helper scripts on my Proxmox. There, I initially used Traefik as a reverse proxy. However, the possibilities are obviously limited on bare metal. I have several Portainer instances running on different servers and would like to configure everything to route through this single container. Therefore, I set up another Docker instance and got Traefik running via Docker there. Currently, BasicAuth and geoblocking are enabled.\n\n\n\nDid I even need the Docker instance? Couldn't it all have worked on bare metal as well? How can I get the traffic to run through the single Docker container? Do I even need to?\n\n\n\nI had ChatGPT translate the text for me. Feel free to reply in German or on Discord. Thanks\n\n\n\nHallo zusammen. Ich habe es endlich geschafft traefik zu installieren. Zuerst habe ich einen Container über helper-scripts auf meinem Proxmox installiert. Dort habe ich traefik erstmal als Reverse Proxy genutzt. Offensichtlich sind aber die Möglichkeiten bei bare metal begrenzt. Ich habe mehrere Portainer-Instanzen auf verschiedenen Servern laufen und würde alles so anpassen, damit das alles über diesen einen Container läuft. Deshalb habe ich noch ein weitere docker-Instanz aufgesetzt und dort dann traefik über docker zum laufen gebracht. Zur Zeit läuft eine BasicAuth und geoblocking.\n\nHätte ich überhaupt die docker-Instanz benötigt? Hätte das nicht alles bare metal auch geklappt? Wie bekomme ich den Verkehr über den einen docker-Container zum laufen? Muss ich das überhaupt?\n\nHab mir den Text von ChatGPT übersetzen lassen. Gerne auch Antworten auf deutsch oder per discord. Danke\n\n \nGruß\n\nDan","selftext_html":"

Hello everyone. I finally managed to install Traefik. First, I installed a container via helper scripts on my Proxmox. There, I initially used Traefik as a reverse proxy. However, the possibilities are obviously limited on bare metal. I have several Portainer instances running on different servers and would like to configure everything to route through this single container. Therefore, I set up another Docker instance and got Traefik running via Docker there. Currently, BasicAuth and geoblocking are enabled.

\n\n

Did I even need the Docker instance? Couldn't it all have worked on bare metal as well? How can I get the traffic to run through the single Docker container? Do I even need to?

\n\n

I had ChatGPT translate the text for me. Feel free to reply in German or on Discord. Thanks

\n\n

Hallo zusammen. Ich habe es endlich geschafft traefik zu installieren. Zuerst habe ich einen Container über helper-scripts auf meinem Proxmox installiert. Dort habe ich traefik erstmal als Reverse Proxy genutzt. Offensichtlich sind aber die Möglichkeiten bei bare metal begrenzt. Ich habe mehrere Portainer-Instanzen auf verschiedenen Servern laufen und würde alles so anpassen, damit das alles über diesen einen Container läuft. Deshalb habe ich noch ein weitere docker-Instanz aufgesetzt und dort dann traefik über docker zum laufen gebracht. Zur Zeit läuft eine BasicAuth und geoblocking.

\n\n

Hätte ich überhaupt die docker-Instanz benötigt? Hätte das nicht alles bare metal auch geklappt? Wie bekomme ich den Verkehr über den einen docker-Container zum laufen? Muss ich das überhaupt?

\n\n

Hab mir den Text von ChatGPT übersetzen lassen. Gerne auch Antworten auf deutsch oder per discord. Danke

\n\n

Gruß

\n\n

Dan

Hi,

\n\n

I have traefik running on a linux host in docker. I added a dynamic rule to setup a route to a Synology NAS. However, a near-identical rule to setup a route to Home Assistant running on a raspberrypi doesn't work. I only see a 400: Bad Request message in the browser and nothing in traefik debug logs. The only difference between routing to NAS and HA is that the NAS serves https using a self signed certificate, where as HA is http only.

\n\n

Here is the dynamic rule I've setup for HA in rules/homeassistant.yml :

\n\n

http:\n  routers:\n    hass-route:\n      entryPoints:\n        - websecure\n      rule: "Host(`iot.example.com`)"\n      service: hass-service\n  services:\n    hass-service:\n      loadBalancer:\n        serversTransport: hass-transport\n        servers:\n          - url: "http://192.168.1.19:8123"\n  serversTransports:\n    hass-transport:\n      insecureSkipVerify: true\n

\n\n

I've setup dynamic rules in static traefik config as follows:

\n\n

providers:\n  file:\n    watch: true\n    directory: "/rules/"\n

\n\n

Please help me figure out why this HA over http rule fails, where as a near-identical rule works for NAS over https.

","ups":1,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1gi2d5l","num_comments":3,"author_fullname":"t2_6hrh1jpn","url":"https://www.reddit.com/r/Traefik/comments/1gi2d5l/forward_auth_with_authentik_how_to_strip_path_and/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1730570511,"title":"Forward Auth (with authentik): How to strip path and arguments from url when redirecting?","selftext":"I run traefik with an forward auth for an external application (technitium) on a single subdomain and do authentification with authentik. I have set up a remote technitium-dns as a first example.\n\nThe flow executes as expected when i call the subdomain, but when authentification is successfull, i am redirected not just to the url stored in the config ([https://192.168.100.108:53443](https://192.168.100.108:53443/outpost.goauthentik.io/callback?X-authentik-auth-callback=true&code=0d1142efac11410ab526ca12566c0748&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L2Z2eDIxR2h6R2tWQURMNzdNUkhaNFpnSE9sQ28wYWJRTXNsdkg1NHIiLCJzaWQiOiJaSUFMVEI1WUZNSktTS1pRS01BNUNKVzNYWklMRFNNUUFDQUxWREpJTVNWUFdOTDZQWlVBIiwic3RhdGUiOiJuX0lsWUtRNndqUUhHNzRQb0ljbkg0MTh1Z09RVUt2cTl5TXQyWEFoU09FIiwicmVkaXJlY3QiOiJodHRwczovL3RlY2huaXRpdW0uemVlYjI0LmRlLyJ9.idHimAoeKOqbTvy5S-WskUXzeV5CbA2UKu4QDZvjzEc)), but to:\n\n[https://192.168.100.108:53443/outpost.goauthentik.io/callback?X-authentik-auth-callback=true&code=0d1142efac11410ab526ca12566c0748&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L2Z2eDIxR2h6R2tWQURMNzdNUkhaNFpnSE9sQ28wYWJRTXNsdkg1NHIiLCJzaWQiOiJaSUFMVEI1WUZNSktTS1pRS01BNUNKVzNYWklMRFNNUUFDQUxWREpJTVNWUFdOTDZQWlVBIiwic3RhdGUiOiJuX0lsWUtRNndqUUhHNzRQb0ljbkg0MTh1Z09RVUt2cTl5TXQyWEFoU09FIiwicmVkaXJlY3QiOiJodHRwczovL3RlY2huaXRpdW0uemVlYjI0LmRlLyJ9.idHimAoeKOqbTvy5S-WskUXzeV5CbA2UKu4QDZvjzEc](https://192.168.100.108:53443/outpost.goauthentik.io/callback?X-authentik-auth-callback=true&code=0d1142efac11410ab526ca12566c0748&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L2Z2eDIxR2h6R2tWQURMNzdNUkhaNFpnSE9sQ28wYWJRTXNsdkg1NHIiLCJzaWQiOiJaSUFMVEI1WUZNSktTS1pRS01BNUNKVzNYWklMRFNNUUFDQUxWREpJTVNWUFdOTDZQWlVBIiwic3RhdGUiOiJuX0lsWUtRNndqUUhHNzRQb0ljbkg0MTh1Z09RVUt2cTl5TXQyWEFoU09FIiwicmVkaXJlY3QiOiJodHRwczovL3RlY2huaXRpdW0uemVlYjI0LmRlLyJ9.idHimAoeKOqbTvy5S-WskUXzeV5CbA2UKu4QDZvjzEc)\n\nThe relevant path is just [https://192.168.100.108:53443](https://192.168.100.108:53443) and should be called as simple as that as the server cant handle the path I get an error 500.\n\nI tried to use a [ReplacePathRegex](https://doc.traefik.io/traefik/middlewares/http/replacepathregex/) middleware in the router (no effect) and a the preservePath: true key in the service (broken, 404), but to no avail.\n\nI am a noob and trying to figure out the ruleset and options, but I have no idea how to fix this?\n\nsee my second post for the relevant config (cause if included here, its rendered without identation, even if marked as code?) ","selftext_html":"

I run traefik with an forward auth for an external application (technitium) on a single subdomain and do authentification with authentik. I have set up a remote technitium-dns as a first example.

\n\n

The flow executes as expected when i call the subdomain, but when authentification is successfull, i am redirected not just to the url stored in the config (https://192.168.100.108:53443), but to:

\n\n

https://192.168.100.108:53443/outpost.goauthentik.io/callback?X-authentik-auth-callback=true&code=0d1142efac11410ab526ca12566c0748&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L2Z2eDIxR2h6R2tWQURMNzdNUkhaNFpnSE9sQ28wYWJRTXNsdkg1NHIiLCJzaWQiOiJaSUFMVEI1WUZNSktTS1pRS01BNUNKVzNYWklMRFNNUUFDQUxWREpJTVNWUFdOTDZQWlVBIiwic3RhdGUiOiJuX0lsWUtRNndqUUhHNzRQb0ljbkg0MTh1Z09RVUt2cTl5TXQyWEFoU09FIiwicmVkaXJlY3QiOiJodHRwczovL3RlY2huaXRpdW0uemVlYjI0LmRlLyJ9.idHimAoeKOqbTvy5S-WskUXzeV5CbA2UKu4QDZvjzEc

\n\n

The relevant path is just https://192.168.100.108:53443 and should be called as simple as that as the server cant handle the path I get an error 500.

\n\n

I tried to use a ReplacePathRegex middleware in the router (no effect) and a the preservePath: true key in the service (broken, 404), but to no avail.

\n\n

I am a noob and trying to figure out the ruleset and options, but I have no idea how to fix this?

\n\n

see my second post for the relevant config (cause if included here, its rendered without identation, even if marked as code?)

I followed smarthomebeginner tutorial for the second time, starting from scratch after replacing storage device.

\n\n

Now after starting traefik3 and socket-proxy containers, I'm following this issue on traefik logs.\ntls-opts.yml is created successfully with chmod 600 and chown root:root.

\n\n

I'm stuck on this and have no idea.\nAny help appreciated.

I currently am using Caddy to do my reverse proxy from my vps to my homelab. Right now it goes from url to vps to service, but when I try this with traefki it doesn't seem to like going outside the net it is on. I was told to use traefik kop for that but is that the only solution?

Hi everyone, i've read this post and i'm still having issues into using other services with traefik and tailscale. Both tailscale and traefik documentations on the matter have room for improvment other that sligltly incoherence between each other.

\n\n

Keeping in mind that tailscale is my only option for my ISP provider, due to CGNAT, i'm strougling in the rounting part, since i get only 404s.

\n\n

The certificates are passed correctly between the dockers but the issue appears to be on traefik side, where is not able to route the request to a local service, but it gives back a blank address.

\n\n

Here there is traefik static config for the tailsclale intetgration:

\n\n

certificatesResolvers:\n  myresolver:\n    tailscale: {}\n

\n\n

Here is my dynamic config:

\n\n

http:\n#  middlewares:\n  routers:\n    plexrouter:\n      entryPoints:\n      - websecure\n      service: plex\n      rule: Host(`xxxyyyzzz.ts.net`) && Path(`/plex`)\n      tls: \n        certresolver: myresolver\n\n  services:\n    plex:\n      loadBalancer:\n        servers:\n        - url: http://local address:plexport\n        passHostHeader: true\n

\n\n

And it appears to be correct from the webui.

\n\n

https://preview.redd.it/zr6brh2u0cxd1.png?width=1278&format=png&auto=webp&s=69108fcb097d7873f3014ae17f84594009163735

\n\n

And the log when i connect to my funnel address

\n\n

172.18.0.3 - - [27/Oct/2024:17:04:03 +0000] "GET /plex HTTP/1.1" 404 19 "-" "-" 1 "-" "-" 0ms

\n\n

Has anyone manage to make tailscale and traefik work well toghether? or it's a unicorn?

Walking through my service release cycle in my Trafeik proxied auto certed wonderland and noted somewhere in the process how nice it would be if Traefik could update my release rules at the point in time that the service became available... like it does for certs and name based resolution and I am sure a bunch of other stuff I do not yet use.

\n\n

Is this a thing? Is there a cookie cutter guide for the ignorant of most of this thing? Initial google foo did not say yes and GPT and I are not talking to one another currently.

\n\n

Thanks for allowing me to dream and any feedback that can bring me closer to a reality.

I’ve come across a project which create cloudflare dns records based on the docker container label for traefik I would like to do this but for bind9 is there anything similar around which achieves this?

\n\n

https://github.com/tiredofit/docker-traefik-cloudflare-companion

","post_hint":"self","ups":4,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1gbok6d","num_comments":0,"author_fullname":"t2_fztkm","url":"https://www.reddit.com/r/Traefik/comments/1gbok6d/help_with_authbypass_via_headers/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1729840706,"title":"help with auth-bypass via headers","selftext":"I get this error:\n\n ERR Error occurred during watcher callback error=\"/etc/traefik/dynamicConfig/router-auth-bypass.yml: template: :4: unexpected \\\"\\\\\\\\\\\" in operand\" providerName=file\n\nthis is router-auth-bypass.yml in my dynamic config:\n\n http:\n routers:\n bypass-auth-rtr:\n rule: \"HostRegexp(`{{ index .Labels \\\"com.docker.compose.service\\\"}}.{{env \"WEBSITE\"}}`) && Header(`{{env \"TRAEFIK_AUTH_BYPASS_KEY_HEADER\"}}`, `{{env \"TRAEFIK_AUTH_BYPASS_KEY\"}}`)\"\n middlewares:\n - chain-no-auth@file\n service: {{ index .Labels \\\"com.docker.compose.service\\\"}}","selftext_html":"

I get this error:

\n\n

ERR Error occurred during watcher callback error="/etc/traefik/dynamicConfig/router-auth-bypass.yml: template: :4: unexpected \\"\\\\\\\\\\" in operand" providerName=file\n

\n\n

this is router-auth-bypass.yml in my dynamic config:

\n\n

http:\n  routers:\n    bypass-auth-rtr:\n      rule: "HostRegexp(`{{ index .Labels \\"com.docker.compose.service\\"}}.{{env "WEBSITE"}}`) && Header(`{{env "TRAEFIK_AUTH_BYPASS_KEY_HEADER"}}`, `{{env "TRAEFIK_AUTH_BYPASS_KEY"}}`)"\n      middlewares:\n        - chain-no-auth@file\n      service: {{ index .Labels \\"com.docker.compose.service\\"}}\n

I have attempted to migrate from v1 to v2 several times now but just give up after not getting all the way. I seem to be stuck on migrating my docker compose file over to the new routers/resolvers/entrypoints.

\n\n

Can anyone help me migrate this over properly? Maybe some of these settings I don't need? I created this all based on some guides YEARS ago and have no idea why some of these settings are there.

\n\n

This is my traefik container's labels

\n\n

      - "traefik.enable=true"\n      - "traefik.backend=traefik"\n      - "traefik.frontend.rule=Host:traefik.${DOMAINNAME}"  \n      - "traefik.frontend.auth.forward.address=http://organizr/api/v2/auth?group=1"\n      - "traefik.port=8080"\n      - "traefik.docker.network=traefik_proxy"\n      - "traefik.frontend.headers.SSLRedirect=true"\n      - "traefik.frontend.headers.STSSeconds=315360000"\n      - "traefik.frontend.headers.browserXSSFilter=true"\n      - "traefik.frontend.headers.contentTypeNosniff=true"\n      - "traefik.frontend.headers.forceSTSHeader=true"\n      - "traefik.frontend.headers.SSLHost=example.com"\n      - "traefik.frontend.headers.STSIncludeSubdomains=true"\n      - "traefik.frontend.headers.STSPreload=true"\n      - "traefik.frontend.headers.frameDeny=false"\n      - "traefik.frontend.auth.basic.users=${HTTP_USERNAME}:${HTTP_PASSWORD}"\n

\n\n

This is one of my containers labels

\n\n

      - "traefik.enable=true"\n      - "traefik.backend=random"\n      - "traefik.frontend.rule=Host:random.test.com"\n      - "traefik.frontend.auth.forward.address=http://organizr/api/v2/auth?group=1"\n      - "traefik.port=8990"\n      - "traefik.docker.network=traefik_proxy"\n      - "traefik.frontend.headers.SSLRedirect=true"\n      - "traefik.frontend.headers.STSSeconds=315360000"\n      - "traefik.frontend.headers.browserXSSFilter=true"\n      - "traefik.frontend.headers.contentTypeNosniff=true"\n      - "traefik.frontend.headers.forceSTSHeader=true"\n      - "traefik.frontend.headers.SSLHost=example.com"\n      - "traefik.frontend.headers.STSIncludeSubdomains=true"\n      - "traefik.frontend.headers.STSPreload=true"\n      - "traefik.frontend.headers.frameDeny=false"\n

\n\n

Essentially I use organizr to expose all of my internal websites to the web with it being the authentication method in front of all of them. The listed hostnames are just examples, not my actual hostnames. Please help! Thank you

","ups":3,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1gaxjpb","num_comments":4,"author_fullname":"t2_anse3","url":"https://www.reddit.com/r/Traefik/comments/1gaxjpb/help_on_second_domain_with_traefik/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1729757505,"title":"Help on second domain with Traefik","selftext":"Hey!\n\n \nI have 2 domains (say [domain1.com](http://domain1.com) and domain2.com) both setup in cloudflare to point to the same ip. For domain1.com i have a lot of subdomains, which all work flawlesly using traefik, but I am not able to rout to a container from domain2.com. I am using Traefik in a container setup and have most my containers setup using labels in the docker-compose file. I am able to view the 404 page from Traefik, suggesting that my DNS in cloudflare is setup correctly, but traefik won't match anything from docker that has the label Host(\\`domain2.com\\`). I see the rule appear in the traefik and it looks alright. I tried to check the DEBUG, level logs, but no avail. I also checked the 'access logs' and found that it tried to apparently enter from 'web' and cannot resolve (perhaps because the container labels are set to 'websecure'?). I'm not sure what my next step is. Did anyone else have issues with this? Also, my cloudflare token has permission to 'Zone.DNS' on All zones.\n\nThanks in advance!","selftext_html":"

Hey!

\n\n

I have 2 domains (say domain1.com and domain2.com) both setup in cloudflare to point to the same ip. For domain1.com i have a lot of subdomains, which all work flawlesly using traefik, but I am not able to rout to a container from domain2.com. I am using Traefik in a container setup and have most my containers setup using labels in the docker-compose file. I am able to view the 404 page from Traefik, suggesting that my DNS in cloudflare is setup correctly, but traefik won't match anything from docker that has the label Host(`domain2.com`). I see the rule appear in the traefik and it looks alright. I tried to check the DEBUG, level logs, but no avail. I also checked the 'access logs' and found that it tried to apparently enter from 'web' and cannot resolve (perhaps because the container labels are set to 'websecure'?). I'm not sure what my next step is. Did anyone else have issues with this? Also, my cloudflare token has permission to 'Zone.DNS' on All zones.

\n\n

Thanks in advance!

","ups":4,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1gavqga","num_comments":2,"author_fullname":"t2_om8jv","url":"https://www.reddit.com/r/Traefik/comments/1gavqga/redirect_subdomain_to_server_on_lan/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1729749270,"title":"Redirect subdomain to server on LAN?","selftext":"I have a setup where I services running on a second docker host and I need to reach them using [app1.domain.net](http://app1.domain.net) and [app2.domain.net](http://app2.domain.net) and so forth. I have those sub-domains setup at Cloudflare\n\nSo far I have managed to configure one, but I don't know how to add antoher... \n[https://codeshare.io/pArDD0](https://codeshare.io/pArDD0)","selftext_html":"

I have a setup where I services running on a second docker host and I need to reach them using app1.domain.net and app2.domain.net and so forth. I have those sub-domains setup at Cloudflare

\n\n

So far I have managed to configure one, but I don't know how to add antoher...
\nhttps://codeshare.io/pArDD0

Like the title states. I've spent more time than I'd like to admit spinning up an Outline instance and using Authentik for SSO. I kept getting stuck at the OIDC redirect and eventually it would display a Bad Gateway message.

\n\n

I have Authentik behind traefik using labels to expose the service and the same can be said for Outline.

\n\n

Long story short, I ended up utilizing a different instance of Authentik from a separate host (same traefik and docker config) and it worked flawlessly.

\n\n

Does anyone have experience with this and know the resolution so I can host these services on the same host machine? I imagine it has something to do with the docker networking and traefik. All three services are on the same docker network and I can post the configs etc if needed tomorrow.

I have other dockers running just fine on my domain using reverse proxy. I duplicated the setup for calibre-web and seeing the below...

\n\n

    forwarded = self.environ.get('HTTP_X_FORWARDED_FOR', None)\nAttributeError: 'NoneType' object has no attribute 'get'\n2024-10-20T23:44:01Z <Greenlet at 0x1487a9953420: _handle_and_close_when_done(<bound method WSGIServer.handle of <WSGIServer at , <bound method StreamServer.do_close of <WSGIServer, (<gevent._socket3.socket [closed] at 0x1487a9284ee)> failed with AttributeError\n

\n\n

Is there a way around this?

I don't want to provide an excessive wall of text but don't really know where the problem is. I'm trying to get this set up using docker compose and traefik as a reverse proxy. I found this technoTim guide and I thought I was following it right, maybe they have something different in their traefik set up that I'm not seeing. Here's a pterodactyl pastebin of my compose files.
\n When I go to pterodactyl.domainName.com, I first create a new location. I have been using world for the latest attempts. I then go to nodes, and maybe this is where I go wrong. Daemon port has been set on independent attempts to 443 and the wings docker exterior port 7823. FQDN, here I'm putting the wings rule I created, wings.someDomain.com . I've tried other things but they don't make sense to explain b/c I think they were wrong. Then I click the save button and get to an allocation page. I'm not super sure about IP address. I've been entering the host's local ip and game's port, 10578 for skyrim. I don't think this is wrong since I was able to open skyrim and connect to the game, I just experience webpage errors, server error 500. The panel indicates the server isn't running. I go to server and create server, click create server after inputting settings. Server error 500.

\n\n

EDIT: I’ve got it working, think it could be worth a write up but I don’t really know if others were having the same problem as me.

For reasons, I got a VPS with a wireguard Tunnel to my Homeserver. On the VPS I have some local containers, stuff that needs bandwidth. I want the VPS Traefik to go through its routers and route matching SNI's locally to the respective containers, doing SSL offloading for those. All the rest (in HA Proxy terms "default backend") should be passed untouched to another server. How can I do that?

\n\n

Edit: is it as easy as giving all local vps rules priority 20 and the catchall route to my homeserver priority 10?

","ups":7,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1g8l23o","num_comments":1,"author_fullname":"t2_5kbn992y","url":"https://www.reddit.com/r/Traefik/comments/1g8l23o/request_being_routed_to_wrong_container_ignoring/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1729500507,"title":"request being routed to wrong container ignoring PathPrefix(`/api/v1`)\"","selftext":"All requests to the [portal.domain.com/api/v1](http://portal.domain.com/api/v1) keep getting redirected despite setting PathPrefix(\\`/api/v1\\`) on the backend route rule. and the request endup being handled by the frontend container running nginx. help\n\n`backend:`\n\n`build:`\n\n`context: ./context`\n\n`dockerfile: Dockerfile`\n\n`networks:`\n\n`- srv_traefik-network # Use the same shared network`\n\n`- backend-network`\n\n`depends_on:`\n\n`- database`\n\n`labels:`\n\n`- \"traefik.enable=true\" # Enable Traefik for this service`\n\n`- \"traefik.http.routers.backend.rule=Host(\\`www.portal.domain.com\\`) && PathPrefix(\\`/api/v1\\`)\" # Route for main domain and path`\n\n`- \"traefik.http.routers.backend.priority=1\" # Higher priority`\n\n`- \"traefik.http.routers.backend.entrypoints=websecure\" # Use HTTPS entry point`\n\n`- \"traefik.http.routers.backend.tls.certresolver=myresolver\" # Use Let's Encrypt for HTTPS`\n\n`- \"traefik.http.services.backend.loadbalancer.server.port=4000\" # The internal port to route traffic to`\n\n`frontend:`\n\n`build:`\n\n`context: ./context`\n\n`dockerfile: Dockerfile`\n\n`networks:`\n\n`- srv_traefik-network # Use the same shared network`\n\n`depends_on:`\n\n`- backend`\n\n`labels:`\n\n`- \"traefik.enable=true\" # Enable Traefik for this service`\n\n`- \"traefik.http.routers.frontend.rule=Host(\\`www.portal.domain.com\\`)\"# Route for main domain and path`\n\n`- \"traefik.http.routers.frontend.entrypoints=websecure\" # Use HTTPS entry point`\n\n`- \"traefik.http.routers.frontend.tls.certresolver=myresolver\" # Use Let's Encrypt for HTTPS`\n\n`- \"traefik.http.services.frontend.loadbalancer.server.port=80\" # The internal port to route traffic to`\n\n","selftext_html":"

All requests to the portal.domain.com/api/v1 keep getting redirected despite setting PathPrefix(`/api/v1`) on the backend route rule. and the request endup being handled by the frontend container running nginx. help

\n\n

backend:

\n\n

build:

\n\n

context: ./context

\n\n

dockerfile: Dockerfile

\n\n

networks:

\n\n

- srv_traefik-network # Use the same shared network

\n\n

- backend-network

\n\n

depends_on:

\n\n

- database

\n\n

labels:

\n\n

- "traefik.enable=true" # Enable Traefik for this service

\n\n

- "traefik.http.routers.backend.rule=Host(\\www.portal.domain.com\\`) && PathPrefix(`/api/v1`)" # Route for main domain and path`

\n\n

- "traefik.http.routers.backend.priority=1" # Higher priority

\n\n

- "traefik.http.routers.backend.entrypoints=websecure" # Use HTTPS entry point

\n\n

- "traefik.http.routers.backend.tls.certresolver=myresolver" # Use Let's Encrypt for HTTPS

\n\n

- "traefik.http.services.backend.loadbalancer.server.port=4000" # The internal port to route traffic to

\n\n

frontend:

\n\n

build:

\n\n

context: ./context

\n\n

dockerfile: Dockerfile

\n\n

networks:

\n\n

- srv_traefik-network # Use the same shared network

\n\n

depends_on:

\n\n

- backend

\n\n

labels:

\n\n

- "traefik.enable=true" # Enable Traefik for this service

\n\n

- "traefik.http.routers.frontend.rule=Host(\\www.portal.domain.com\\`)"# Route for main domain and path`

\n\n

- "traefik.http.routers.frontend.entrypoints=websecure" # Use HTTPS entry point

\n\n

- "traefik.http.routers.frontend.tls.certresolver=myresolver" # Use Let's Encrypt for HTTPS

\n\n

- "traefik.http.services.frontend.loadbalancer.server.port=80" # The internal port to route traffic to

Pretty much the title. This is for my org that needs some sane defaults to start with, but would want to overwrite with custom rules on certain customer machines. I'd like to be able to do something like this all in one directory:

\n\n

traefik.yml\n00-env_defaults.yml\n00-http_defaults.yml\n...\n90-custom.yml\n

\n\n

I can't find anywhere in the v3 docs that mentions any sort or loading rules by filename. I could and will just live test it to see if what I expect to work works, but it'd be better if I knew there was something concrete out there.

","ups":2,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1g4ezqi","num_comments":4,"author_fullname":"t2_8y693gj0","url":"https://www.reddit.com/r/Traefik/comments/1g4ezqi/working_internally_but_not_working_externally/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1729017631,"title":"Working internally but not working externally ","selftext":"Hi, \n\nI changed my traefik from just one entrypoint to a internal and external entry point. I was using vaultwarden to test both the internal and external entry points the internal works fine and I am able to access my vault but when change the traefik to labels to point to the external entrypoints on the Vualtwarden compose file I am not able to reach my vault. I have opened the ports 82 (external) to point 81 (internal) and I also opened ports 444 (external) and pointed to 443 (internal) these are pointing to my server. I am using openwrt but I am wondering if I need to possibly create a NAT rule pointing to my server or maybe some kind traffic rule? I am using a pihole for my local DNS as well if that could cause problems and I am using cloudflare as my DNS provider. When I was just using one entrypoint I was able to access vaultwarden externally no problem. I didnt like the idea of everything being exposed so I changed the config any help would be appreciated. Below are the traefik docker compose, traefik.yml and vaultwarden docker compose tha I am using. \n\n version: '3.5'\n \n services:\n traefik:\n image: traefik:latest\n container_name: traefik\n restart: unless-stopped\n security_opt:\n - no-new-privileges:true\n networks:\n proxy:\n ports:\n - 81:80\n - 82:82 #external\n - 443:443\n - 444:444 #external\n environment:\n CF_DNS_API_TOKEN_FILE: /run/secrets/cf_api_token # note using _FILE for docker secrets\n # CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN} # if using .env\n #TRAEFIK_DASHBOARD_CREDENTIALS: ${TRAEFIK_DASHBOARD_CREDENTIALS}\n secrets:\n - cf_api_token\n env_file: .env # use .env\n volumes:\n - /etc/localtime:/etc/localtime:ro\n - /var/run/docker.sock:/var/run/docker.sock:ro\n - /home/cbrinkley/docker/traefik/data/traefik.yml:/traefik.yml:ro\n - /home/cbrinkley/docker/traefik/data/acme.json:/acme.json\n - /home/cbrinkley/docker/traefik/data/config.yml:/config.yml:ro\n - /home/cbrinkley/docker/traefik/logs:/var/log/traefik\n labels:\n - \"traefik.enable=true\"\n - \"traefik.http.routers.traefik.entrypoints=http\"\n - \"traefik.http.routers.traefik.rule=Host(`traefik-dashboard.chukkle.net`)\" # if you want a internal domain, get the wildcard cert for it and then choos traefik-dashboard.home.yourdomain.co.uk or what you want\n - \"traefik.http.middlewares.traefik-auth.basicauth.users=\"\n - \"traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https\"\n - \"traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https\"\n #- \"traefik.http.routers.dashboard.entrypoints=traefik\"\n - \"traefik.http.routers.traefik.middlewares=traefik-https-redirect\"\n - \"traefik.http.routers.traefik-secure.entrypoints=https\"\n - \"traefik.http.routers.traefik-secure.rule=Host(`traefik-dashboard.chukkle.net`)\" # if you want a internal domain, get the wildcard cert for it and then choos traefik-dashboard.home.yourdomain.co.uk or what you want\n - \"traefik.http.routers.traefik-secure.middlewares=traefik-auth\"\n - \"traefik.http.routers.traefik-secure.tls=true\"\n - \"traefik.http.routers.traefik-secure.tls.certresolver=cloudflare\"\n #- \"traefik.http.routers.traefik-secure.tls.domains[0].main=home.yourdomain.co.uk\" # If you want *.home.yourdomain.co.uk subdomain or something else, you have to get the certifcates at first.\n #- \"traefik.http.routers.traefik-secure.tls.domains[0].sans=*.home.yourdomain.co.uk\" # get a wildcard certificat for your .home.yourdomain.co.uk\n - \"traefik.http.routers.traefik-secure.tls.domains[0].main=chukkle.net\" #if you use the .home.yourdomain.co.uk entry you have to change the [0] into [1]\n - \"traefik.http.routers.traefik-secure.tls.domains[0].sans=*.chukkle.net\" # same here, change 0 to 1\n - \"traefik.http.routers.traefik-secure.service=api@internal\"\n \n secrets:\n cf_api_token:\n file: ./cf_api_token.txt\n \n\n api:\n dashboard: true\n debug: true\n entryPoints:\n http:\n address: \":81\"\n http:\n middlewares:\n - crowdsec-bouncer@file\n redirections:\n entrypoint:\n to: https\n scheme: https\n https:\n address: \":443\"\n http:\n middlewares:\n - crowdsec-bouncer@file\n http-external:\n address: \":82\"\n http:\n middlewares:\n - crowdsec-bouncer@file\n redirections:\n entrypoint:\n to: https-external\n scheme: https\n https-external:\n address: \":444\"\n http:\n middlewares:\n - crowdsec-bouncer@file\n \n serversTransport:\n insecureSkipVerify: true\n providers:\n docker:\n endpoint: \"unix:///var/run/docker.sock\"\n exposedByDefault: false\n file:\n filename: /config.yml\n certificatesResolvers:\n cloudflare:\n acme:\n email: neo198431@gmail.com\n storage: acme.json\n dnsChallenge:\n provider: cloudflare\n #disablePropagationCheck: true # uncomment this if you have issues pulling certificates through cloudflare, By setting this flag to true disables the need to wait for the propagation of the TXT record to all authoritative name servers.\n resolvers:\n - \"1.1.1.1:53\"\n - \"1.0.0.1:53\"\n \n log:\n level: \"INFO\"\n filePath: \"/var/log/traefik/traefik.log\"\n accessLog:\n filePath: \"/var/log/traefik/access.log\"\n \n\n version: \"3\"\n services:\n vaultwarden:\n container_name: vaultwarden\n image: vaultwarden/server:latest\n volumes:\n - '/home/cbrinkley/docker/bitwarden/:/data/'\n restart: unless-stopped\n networks:\n proxy:\n labels:\n - \"traefik.enable=true\"\n - \"traefik.http.routers.vaultwarden.entrypoints=http-external\"\n - \"traefik.http.routers.vaultwarden.rule=Host(`bw1.chukkle.net`)\"\n - \"traefik.http.middlewares.vaultwarden-https-redirect.redirectscheme.scheme=https\"\n - \"traefik.http.routers.vaultwarden.middlewares=vaultwarden-https-redirect\"\n - \"traefik.http.routers.vaultwarden-secure.entrypoints=https-external\"\n - \"traefik.http.routers.vaultwarden-secure.rule=Host(`bw1.chukkle.net`)\"\n - \"traefik.http.routers.vaultwarden-secure.tls=true\"\n - \"traefik.http.routers.vaultwarden-secure.service=vaultwarden\"\n - \"traefik.http.services.vaultwarden.loadbalancer.server.port=80\"\n - \"traefik.docker.network=proxy\"\n security_opt:\n - no-new-privileges:true\n \n networks:\n proxy:\n external: true\n ","selftext_html":"

Hi,

\n\n

I changed my traefik from just one entrypoint to a internal and external entry point. I was using vaultwarden to test both the internal and external entry points the internal works fine and I am able to access my vault but when change the traefik to labels to point to the external entrypoints on the Vualtwarden compose file I am not able to reach my vault. I have opened the ports 82 (external) to point 81 (internal) and I also opened ports 444 (external) and pointed to 443 (internal) these are pointing to my server. I am using openwrt but I am wondering if I need to possibly create a NAT rule pointing to my server or maybe some kind traffic rule? I am using a pihole for my local DNS as well if that could cause problems and I am using cloudflare as my DNS provider. When I was just using one entrypoint I was able to access vaultwarden externally no problem. I didnt like the idea of everything being exposed so I changed the config any help would be appreciated. Below are the traefik docker compose, traefik.yml and vaultwarden docker compose tha I am using.

\n\n

version: '3.5'\n\nservices:\n  traefik:\n    image: traefik:latest\n    container_name: traefik\n    restart: unless-stopped\n    security_opt:\n      - no-new-privileges:true\n    networks:\n       proxy:\n    ports:\n      - 81:80\n      - 82:82 #external\n      - 443:443\n      - 444:444 #external\n    environment:\n      CF_DNS_API_TOKEN_FILE: /run/secrets/cf_api_token # note using _FILE for docker secrets\n      # CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN} # if using .env\n      #TRAEFIK_DASHBOARD_CREDENTIALS: ${TRAEFIK_DASHBOARD_CREDENTIALS}\n    secrets:\n      - cf_api_token\n    env_file: .env # use .env\n    volumes:\n      - /etc/localtime:/etc/localtime:ro\n      - /var/run/docker.sock:/var/run/docker.sock:ro\n      - /home/cbrinkley/docker/traefik/data/traefik.yml:/traefik.yml:ro\n      - /home/cbrinkley/docker/traefik/data/acme.json:/acme.json\n      - /home/cbrinkley/docker/traefik/data/config.yml:/config.yml:ro\n      - /home/cbrinkley/docker/traefik/logs:/var/log/traefik\n    labels:\n      - "traefik.enable=true"\n      - "traefik.http.routers.traefik.entrypoints=http"\n      - "traefik.http.routers.traefik.rule=Host(`traefik-dashboard.chukkle.net`)" # if you want a internal domain, get the wildcard cert for it and then choos traefik-dashboard.home.yourdomain.co.uk or what you want\n      - "traefik.http.middlewares.traefik-auth.basicauth.users="\n      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"\n      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"\n      #- "traefik.http.routers.dashboard.entrypoints=traefik"\n      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"\n      - "traefik.http.routers.traefik-secure.entrypoints=https"\n      - "traefik.http.routers.traefik-secure.rule=Host(`traefik-dashboard.chukkle.net`)" # if you want a internal domain, get the wildcard cert for it and then choos traefik-dashboard.home.yourdomain.co.uk or what you want\n      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"\n      - "traefik.http.routers.traefik-secure.tls=true"\n      - "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare"\n      #- "traefik.http.routers.traefik-secure.tls.domains[0].main=home.yourdomain.co.uk" # If you want *.home.yourdomain.co.uk subdomain or something else, you have to get the certifcates at first.\n      #- "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.home.yourdomain.co.uk" # get a wildcard certificat for your .home.yourdomain.co.uk\n      - "traefik.http.routers.traefik-secure.tls.domains[0].main=chukkle.net" #if you use the .home.yourdomain.co.uk entry you have to change the [0] into [1]\n      - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.chukkle.net" # same here, change 0 to 1\n      - "traefik.http.routers.traefik-secure.service=api@internal"\n\nsecrets:\n  cf_api_token:\n    file: ./cf_api_token.txt\n\n\napi:\n  dashboard: true\n  debug: true\nentryPoints:\n  http:\n    address: ":81"\n    http:\n      middlewares:\n        - crowdsec-bouncer@file\n      redirections:\n        entrypoint:\n          to: https\n          scheme: https\n  https:\n    address: ":443"\n    http:\n      middlewares:\n        - crowdsec-bouncer@file\n  http-external:\n    address: ":82"\n    http:\n      middlewares:\n        - crowdsec-bouncer@file\n      redirections:\n        entrypoint:\n          to: https-external\n          scheme: https\n  https-external:\n    address: ":444"\n    http:\n      middlewares:\n        - crowdsec-bouncer@file\n\nserversTransport:\n  insecureSkipVerify: true\nproviders:\n  docker:\n    endpoint: "unix:///var/run/docker.sock"\n    exposedByDefault: false\n  file:\n    filename: /config.yml\ncertificatesResolvers:\n  cloudflare:\n    acme:\n      email: neo198431@gmail.com\n      storage: acme.json\n      dnsChallenge:\n        provider: cloudflare\n        #disablePropagationCheck: true # uncomment this if you have issues pulling certificates through cloudflare, By setting this flag to true disables the need to wait for the propagation of the TXT record to all authoritative name servers.\n        resolvers:\n          - "1.1.1.1:53"\n          - "1.0.0.1:53"\n\nlog:\n  level: "INFO"\n  filePath: "/var/log/traefik/traefik.log"\naccessLog:\n  filePath: "/var/log/traefik/access.log"\n\n\nversion: "3"\nservices:\n  vaultwarden:\n    container_name: vaultwarden\n    image: vaultwarden/server:latest\n    volumes:\n      - '/home/cbrinkley/docker/bitwarden/:/data/'\n    restart: unless-stopped\n    networks:\n      proxy:\n    labels:\n      - "traefik.enable=true"\n      - "traefik.http.routers.vaultwarden.entrypoints=http-external"\n      - "traefik.http.routers.vaultwarden.rule=Host(`bw1.chukkle.net`)"\n      - "traefik.http.middlewares.vaultwarden-https-redirect.redirectscheme.scheme=https"\n      - "traefik.http.routers.vaultwarden.middlewares=vaultwarden-https-redirect"\n      - "traefik.http.routers.vaultwarden-secure.entrypoints=https-external"\n      - "traefik.http.routers.vaultwarden-secure.rule=Host(`bw1.chukkle.net`)"\n      - "traefik.http.routers.vaultwarden-secure.tls=true"\n      - "traefik.http.routers.vaultwarden-secure.service=vaultwarden"\n      - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"\n      - "traefik.docker.network=proxy"\n    security_opt:\n      - no-new-privileges:true\n\nnetworks:\n  proxy:\n    external: true\n

Hi guys,

\n\n

I recently had the need of generating a wildcard certificate, and wanted it to be as automatic as my other Traefik certificates.

\n\n

I have one certresolver (http, let's encrypt) and read the documentation, creating another certresolver using DNS Challenge and Let's Encrypt.

\n\n

DNS Challenge can be used with some providers, but I wanted to keep it all self hosted. If I can't get it working though I will get back to use CloudFlare, OVH or other external provider included.

\n\n

But I wanted to do it that way, so I used the first entry of Traefik documentation : (joohoi) dns-acme

\n\n

Did any of you made it work this way ?

\n\n

I think I am not understanding a part of the process, so I created a github issue on acme-dns github repository.

\n\n

https://github.com/joohoi/acme-dns/issues/366

\n\n

But it could also be that my problem resides on using that with Traefik, even if I doubt it and I think my problem is straight using dns-acme.

\n\n

If any of you have any experience with this, I would be very very grateful.

\n\n

Anways thanks to have read me.

\n\n

Have a great week !

","post_hint":"self","ups":5,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1g2ctsb","num_comments":14,"author_fullname":"t2_6lugse76","url":"https://www.reddit.com/r/Traefik/comments/1g2ctsb/traefik_through_cloudflare_tunnel_help/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1728776222,"title":"Traefik through cloudflare tunnel help","selftext":"I followed the smarthomebeginner guide on setting up traefik3. Everything works fine within my home network. however, externally, I can not reach anything. I just see \"Misdirected Request\" in the browser and the logs say: \n\n TLS options difference: SNI:default, Header:tls-opts@file host=sub.domain.ca req.Host=sub.domain.ca req.TLS.ServerName=domain.ca\n\nI have not been able to figure out how to get this resolved. Any suggestions?\n\n \n","selftext_html":"

I followed the smarthomebeginner guide on setting up traefik3. Everything works fine within my home network. however, externally, I can not reach anything. I just see "Misdirected Request" in the browser and the logs say:

\n\n

TLS options difference: SNI:default, Header:tls-opts@file host=sub.domain.ca req.Host=sub.domain.ca req.TLS.ServerName=domain.ca\n

\n\n

I have not been able to figure out how to get this resolved. Any suggestions?

","ups":5,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1g1qp1e","num_comments":8,"author_fullname":"t2_ujlto","url":"https://www.reddit.com/r/Traefik/comments/1g1qp1e/cloudflared_authentik_and_traefik/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1728701146,"title":"Cloudflared, Authentik and Traefik","selftext":"Hi, so I'm trying to move from NPM to Traefik, however, I'm stuck trying to get my Authentik to work correctly. In NPM it just works, but I'm getting an error on my services that use OIDC ``` unexpected issuer URI `http://authentik.domain/application/o/komodo/` (expected `https://authentik.domain/application/o/komodo/`)```\nI notice that it isn't proxing it as https, but that wasn't an issue before. When I try to do anything in Authentik, I get ```\nCSRF Failed: Origin checking failed - https://authentik.domain does not match any trusted origins.``` although I am able to at least navigate the website. Am I missing something?\n\nCurrently the setup is Cloudflare tunnels (with Wildcard) -> Traefik (as Reverse Proxy)\n\nTraefik Compose\n```\nversion: \"3\"\nservices:\n reverse-proxy:\n # The official v2 Traefik docker image\n image: traefik:v2.11\n # Enables the web UI and tells Traefik to listen to docker\n command: --api.insecure=true --providers.docker\n --providers.file.directory=/rules --providers.file.watch=true --log=true\n --log.filePath=/logs/traefik.log --accessLog=true\n --accessLog.filePath=/logs/access.log --accessLog.bufferingSize=100\n --accessLog.filters.statusCodes=204-299,400-499,500-599\n privileged: true\n ports:\n # The HTTP port\n - 7180:80\n - 8080:8080\n volumes:\n # So that Traefik can listen to the Docker events\n - /var/run/docker.sock:/var/run/docker.sock:z\n - /media/DockerStorage/traefik/config:/rules\n - /media/DockerStorage/traefik/logs:/logs\n networks:\n - reverse_proxy\n restart: unless-stopped\nnetworks:\n reverse_proxy:\n external: true\n```\n\nAuthentik Compose (Useful Parts)\n```\nauthentik-server:\n image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.6.3}\n restart: unless-stopped\n command: server\n environment:\n - AUTHENTIK_REDIS__HOST=redis\n - AUTHENTIK_POSTGRESQL__HOST=postgresql\n - AUTHENTIK_POSTGRESQL__USER=${PG_USER:-authentik}\n - AUTHENTIK_POSTGRESQL__NAME=${PG_DB:-authentik}\n - AUTHENTIK_POSTGRESQL__PASSWORD=${PG_PASS}\n volumes:\n - /media/DockerStorage/authentik/app/media:/media\n - /media/DockerStorage/authentik/app/custom-templates:/templates\n env_file:\n - .env\n ports:\n - 9000:9000\n depends_on:\n - postgresql\n - redis\n networks:\n - authentik\n - reverse_proxy\n labels:\n - traefik.enable=true\n - traefik.http.routers.authentik.rule=Host(`authentik.domain`)\n #- traefik.http.middlewares.https-redirect.headers.customrequestheaders.X-Forwarded-Proto=https\n #- traefik.http.routers.authentik.middlewares=https-redirect\n #- traefik.http.middlewares.https-redirect.redirectscheme.scheme=https\n #- traefik.http.middlewares.https-redirect.redirectscheme.permanent=true\n - traefik.docker.network=reverse_proxy\n #- traefik.http.routers.authentik-output-rtr.rule=HostRegexp(`{subdomain:[a-z0-9-]+}.domain`)&& PathPrefix(`/outpost.goauthentik.io/`)\n #- traefik.http.services.authentik.loadbalancer.server.scheme=https\n```\nWith the commented out labels, I basically tried a few things, but they would all result in me not being able to connect to the page anymore\n\nEdit: So I noticed that it actually uses 9443 on NPM to connect to the authentik-server container. However, Doing that gives me a 404 and I cannot figure out why for the life of me","selftext_html":"

Hi, so I'm trying to move from NPM to Traefik, however, I'm stuck trying to get my Authentik to work correctly. In NPM it just works, but I'm getting an error on my services that use OIDC unexpected issuer URI `http://authentik.domain/application/o/komodo/` (expected `https://authentik.domain/application/o/komodo/`)\nI notice that it isn't proxing it as https, but that wasn't an issue before. When I try to do anything in Authentik, I get \nCSRF Failed: Origin checking failed - https://authentik.domain does not match any trusted origins. although I am able to at least navigate the website. Am I missing something?

\n\n

Currently the setup is Cloudflare tunnels (with Wildcard) -> Traefik (as Reverse Proxy)

\n\n

Traefik Compose\n\nversion: "3"\nservices:\n reverse-proxy:\n # The official v2 Traefik docker image\n image: traefik:v2.11\n # Enables the web UI and tells Traefik to listen to docker\n command: --api.insecure=true --providers.docker\n --providers.file.directory=/rules --providers.file.watch=true --log=true\n --log.filePath=/logs/traefik.log --accessLog=true\n --accessLog.filePath=/logs/access.log --accessLog.bufferingSize=100\n --accessLog.filters.statusCodes=204-299,400-499,500-599\n privileged: true\n ports:\n # The HTTP port\n - 7180:80\n - 8080:8080\n volumes:\n # So that Traefik can listen to the Docker events\n - /var/run/docker.sock:/var/run/docker.sock:z\n - /media/DockerStorage/traefik/config:/rules\n - /media/DockerStorage/traefik/logs:/logs\n networks:\n - reverse_proxy\n restart: unless-stopped\nnetworks:\n reverse_proxy:\n external: true\n

\n\n

Authentik Compose (Useful Parts)\n\nauthentik-server:\n image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.6.3}\n restart: unless-stopped\n command: server\n environment:\n - AUTHENTIK_REDIS__HOST=redis\n - AUTHENTIK_POSTGRESQL__HOST=postgresql\n - AUTHENTIK_POSTGRESQL__USER=${PG_USER:-authentik}\n - AUTHENTIK_POSTGRESQL__NAME=${PG_DB:-authentik}\n - AUTHENTIK_POSTGRESQL__PASSWORD=${PG_PASS}\n volumes:\n - /media/DockerStorage/authentik/app/media:/media\n - /media/DockerStorage/authentik/app/custom-templates:/templates\n env_file:\n - .env\n ports:\n - 9000:9000\n depends_on:\n - postgresql\n - redis\n networks:\n - authentik\n - reverse_proxy\n labels:\n - traefik.enable=true\n - traefik.http.routers.authentik.rule=Host(`authentik.domain`)\n #- traefik.http.middlewares.https-redirect.headers.customrequestheaders.X-Forwarded-Proto=https\n #- traefik.http.routers.authentik.middlewares=https-redirect\n #- traefik.http.middlewares.https-redirect.redirectscheme.scheme=https\n #- traefik.http.middlewares.https-redirect.redirectscheme.permanent=true\n - traefik.docker.network=reverse_proxy\n #- traefik.http.routers.authentik-output-rtr.rule=HostRegexp(`{subdomain:[a-z0-9-]+}.domain`)&& PathPrefix(`/outpost.goauthentik.io/`)\n #- traefik.http.services.authentik.loadbalancer.server.scheme=https\n\nWith the commented out labels, I basically tried a few things, but they would all result in me not being able to connect to the page anymore

\n\n

Edit: So I noticed that it actually uses 9443 on NPM to connect to the authentik-server container. However, Doing that gives me a 404 and I cannot figure out why for the life of me

","ups":3,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1fu9cle","num_comments":4,"author_fullname":"t2_ehz9mae5c","url":"https://www.reddit.com/r/Traefik/comments/1fu9cle/adding_a_writetimeout_to_my_immich_config_and_im/","media":null,"thumbnail_height":null,"thumbnail_width":null,"thumbnail":"self","created":1727848709,"title":"Adding a writeTimeout to my immich config, and I'm lost.","selftext":"I'm trying to add a timeout of 0s to my config, but I can't figure out what I'm doing wrong.\n\nFrom the docs, it looks like entryPoints is a toplevel yaml heading, and then it needs to referenced by my dynamic router? This is my current config before making the change, and I just can't figure out where to define the entrypoint attributed properly.\n\n http:\n routers:\n immich:\n entryPoints:\n - \"https\"\n rule: \"Host(`photos.example.com`)\"\n middlewares:\n - default-headers\n - https-redirectscheme\n tls: {}\n service: immich\n \n services:\n immich:\n loadBalancer:\n servers:\n - url: \"http://immich-app:3001\"\n passHostHeader: true\n \n middlewares:\n https-redirectscheme:\n redirectScheme:\n scheme: https\n permanent: true\n \n default-headers:\n headers:\n frameDeny: true\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n stsIncludeSubdomains: true\n stsPreload: true\n stsSeconds: 15552000\n customFrameOptionsValue: SAMEORIGIN\n customResponseHeaders:\n X-Proxy-By: {{env \"WAN_HOSTNAME\"}}\n customRequestHeaders:\n X-Forwarded-Proto: https\n\nThis is the fix I'm trying to implement, does anyone have any insight? \n[https://github.com/immich-app/immich/discussions/8872](https://github.com/immich-app/immich/discussions/8872)","selftext_html":"

I'm trying to add a timeout of 0s to my config, but I can't figure out what I'm doing wrong.

\n\n

From the docs, it looks like entryPoints is a toplevel yaml heading, and then it needs to referenced by my dynamic router? This is my current config before making the change, and I just can't figure out where to define the entrypoint attributed properly.

\n\n

http:\n  routers:\n    immich:\n      entryPoints:\n        - "https"\n      rule: "Host(`photos.example.com`)"\n      middlewares:\n        - default-headers\n        - https-redirectscheme\n      tls: {}\n      service: immich\n\n  services:\n    immich:\n      loadBalancer:\n        servers:\n          - url: "http://immich-app:3001"\n        passHostHeader: true\n\n  middlewares:\n    https-redirectscheme:\n      redirectScheme:\n        scheme: https\n        permanent: true\n\n    default-headers:\n      headers:\n        frameDeny: true\n        browserXssFilter: true\n        contentTypeNosniff: true\n        forceSTSHeader: true\n        stsIncludeSubdomains: true\n        stsPreload: true\n        stsSeconds: 15552000\n        customFrameOptionsValue: SAMEORIGIN\n        customResponseHeaders:\n          X-Proxy-By: {{env "WAN_HOSTNAME"}}\n        customRequestHeaders:\n          X-Forwarded-Proto: https\n

\n\n

This is the fix I'm trying to implement, does anyone have any insight?
\nhttps://github.com/immich-app/immich/discussions/8872

","post_hint":"self","ups":2,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"},{"media_embed":{},"secureMediaEmbedUrl":{},"id":"1ftxoa6","num_comments":5,"author_fullname":"t2_7okm6dlb","url":"https://www.reddit.com/r/Traefik/comments/1ftxoa6/help_want_to_send_custom_error_page_when_service/","media":null,"thumbnail_height":45,"thumbnail_width":140,"thumbnail":"https://b.thumbs.redditmedia.com/NirgPOn6yVGNpdH-9q1hpWdmeYZ_oXI8H0ZorxJgtlQ.jpg","created":1727813163,"title":"Help: Want to send custom error page when service is offline in traefik instead of Cloudflare error.","selftext":"I have a traefik server, I configure everything in traefik.yaml and config.yml (not using labels). I setup an error middleware so that when a backend service is not available instead of getting the cloudflare bad gateway error 502 I would want traefik to send a custom error. I made it work, it sends the error page but it only works locally in my house (with my custom dns server). After about 5 seconds I get the error middleware page and it sends error 502 to the browser.\n\n \nWhen cloudflare receives error 502 I believe it doesn't even try to display my error, it simply shows the cloudflare error page 502 bad gateway. How can I make it so MY error page sent from traefik is displayed ? \n\nThanks a lot in advance!\n\n \nHere is a portion of my traefik config:\n\n routers:\n test-error:\n entryPoints:\n - \"https-internal\"\n rule: \"Host(`error.local.example.org`)\"\n middlewares:\n - default-headers\n - exceptions\n tls: {}\n service: prog-vscode22\n\n \n services:\n error-service:\n loadBalancer:\n servers:\n - url: \"http://192.168.30.235\"\n passHostHeader: false\n\n middlewares:\n exceptions:\n errors:\n status:\n - \"500-599\"\n service: error-service\n # query: \"/errors/{status}.html\"\n query: \"/errors/unknown-error.html\"\n \n \n\n It does work internally: \n\nhttps://preview.redd.it/5crgqtalb7sd1.png?width=3166&format=png&auto=webp&s=eb1b15c55113c997d2066d2487eb5f68df18b821\n\n \n","selftext_html":"

I have a traefik server, I configure everything in traefik.yaml and config.yml (not using labels). I setup an error middleware so that when a backend service is not available instead of getting the cloudflare bad gateway error 502 I would want traefik to send a custom error. I made it work, it sends the error page but it only works locally in my house (with my custom dns server). After about 5 seconds I get the error middleware page and it sends error 502 to the browser.

\n\n

When cloudflare receives error 502 I believe it doesn't even try to display my error, it simply shows the cloudflare error page 502 bad gateway. How can I make it so MY error page sent from traefik is displayed ?

\n\n

Thanks a lot in advance!

\n\n

Here is a portion of my traefik config:

\n\n

routers:\n  test-error:\n      entryPoints:\n        - "https-internal"\n      rule: "Host(`error.local.example.org`)"\n      middlewares:\n        - default-headers\n        - exceptions\n      tls: {}\n      service: prog-vscode22\n\n\nservices:\n  error-service:\n      loadBalancer:\n        servers:\n          - url: "http://192.168.30.235"\n        passHostHeader: false\n\nmiddlewares:\n    exceptions:\n      errors:\n        status:\n          - "500-599"\n        service: error-service\n        # query: "/errors/{status}.html"\n        query: "/errors/unknown-error.html"\n\n\n\nIt does work internally: \n

\n\n

https://preview.redd.it/5crgqtalb7sd1.png?width=3166&format=png&auto=webp&s=eb1b15c55113c997d2066d2487eb5f68df18b821

","ups":2,"downs":0,"is_reddit_media_domain":false,"is_video":false,"is_self":true,"stickied":false,"subreddit_subscribers":11229,"subreddit_name_prefixed":"r/Traefik"}]