Comment on Route domain name to Docker containers on Synology NAS?

• Kangie@lemmy.srcfiles.zip ⁨8⁩ ⁨months⁩ ago

  Ideally I don’t want to port forward, so would I need to rely on Traefik to redirect the traffic from port 80 to port 443, and then proxy from port 443 to the required container? How do I therefore stop traffic from hitting the DSM admin on ports 5000/5001 for example?

  That’s not quite how it works - the port forwarding is on your internet gateway to allow traffic on those ports to a specific host internal to your network. That’s your only option if you want these services to be available on the wider web.

  My recommendation around using 80 to redirect to 443 is because in 2023 there’s no reason for that traffic to be unencrypted - just listen on 80 and say "Hey, go to example.com" instead.

  If you don’t care about that you can do internal only DNS + VPN into the network and still get the benefits of free SSL certificates via the LetsEncrypt DNS01 challenge.

  source

  • schmurnan@lemmy.world ⁨8⁩ ⁨months⁩ ago

    Thanks, and yeah sorry, what I meant was to listen on both ports 80 and 443 and have a redirect in Traefik from 80 to 443 - I don’t plan on having anything directly accessible over port 80.

    As per another post, I’ve hit a stumbling block:

    OK so made a start with this. Spun up a Pi-hole container, added mydomain.com as an A record in Local DNS, and created a CNAME for traefik.mydomain.com to point to mydomain.com.

    In Cloudflare, I removed the mydomain.com A record and the www CNAME record.

    Doing an nslookup on mydomain.com I get

    Non-authoritative answer:
    *** Can't find mydomain.com: No answer
    

    Which I guess is to be expected.

    However, when I then navigate to traefik.mydomain.com in my browser, I’m met with a Cloudflare error page: https://imgur.com/XhKOywo.

    Below is the docker-compose of my traefik container:

    traefik:
        container_name: traefik
        image: traefik:latest
        restart: unless-stopped
        networks:
          - medianet
        ports:
          - 80:80
        volumes:
          - /etc/localtime:/etc/localtime:ro
          - /var/run/docker.sock:/var/run/docker.sock:ro
          - /volume1/docker/traefik:/etc/traefik
          - /volume1/docker/traefik/access.log:/logs/access.log
          - /volume1/docker/traefik/traefik.log:/logs/traefik.log
          - /volume1/docker/traefik/acme/acme.json:/acme.json
        environment:
          - TZ=Europe/London
        labels:
          - traefik.enable=true
          - traefik.http.routers.traefik.rule=Host(`$TRAEFIK_DASHBOARD_HOST`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))
          - traefik.http.routers.traefik.service=api@internal
    

    My traefik.yml is also nice and basic at this point:

    global:
      sendAnonymousUsage: false
    
    entryPoints:
      web:
        address: ":80"
    
    api:
      dashboard: true
      insecure: true
    
    providers:
      docker:
        endpoint: "unix:///var/run/docker.sock"
        watch: true
        exposedByDefault: false
    
    log:
      filePath: traefik.log
      level: DEBUG
    
    accessLog:
      filePath: access.log
      bufferingSize: 100
    

    Any ideas what’s going wrong? I’m unclear on why the domain is still routing to Cloudflare.

    source