I recently posted most of my traefik configs, you can use it as a base to learn how traefik works:
https://lemmy.ca/comment/17702205
Note that I might not be much help with troubleshooting, as this took me a lot of trial and error and googling to make work.
I am definitely not the best at networking, but can’t you do that through your current dhcp client?
The server has been reverse engineered for literal decades at this point.
I can share my traefik setup - note I am doing this on my phone at work, so I might miss something
compose.yaml
labels:
- "traefik.enable=true"
- "traefik.http.routers.traefik.middlewares=authwares@file"
GNU nano 7.2 /config/traefik/dynamic/middlewares.yaml
http:
middlewares:
limit:
buffering:
memRequestBodyBytes: 5000000000
memResponseBodyBytes: 5000000000
maxRequestBodyBytes: 5000000000
maxResponseBodyBytes: 5000000000
authwares:
chain:
middlewares:
- default-headers
- authelia
- limit
default-headers:
headers:
accessControlAllowHeaders: "content-type,authorization"
accessControlAllowMethods:
- GET
- OPTIONS
- PUT
- POST
- DELETE
frameDeny: true
accessControlAllowOriginList: "*"
accessControlMaxAge: 100
addVaryHeader: true
browserXssFilter: true
contentTypeNosniff: true
forceSTSHeader: true
stsIncludeSubdomains: true
stsPreload: true
stsSeconds: 15552000
customFrameOptionsValue: SAMEORIGIN
referrerPolicy: "strict-origin-when-cross-origin"
customRequestHeaders:
X-Forwarded-Proto: https
customResponseHeaders:
X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex"
server: ""
X-Forwarded-Proto: "https,wss"
hostsProxyHeaders:
- "X-Forwarded-Host"
authelia:
forwardAuth:
address: http://auth/api/verify?rd=https%3A%2F%2Fauth.example.com%2F
trustForwardHeader: true
authResponseHeaders:
- "Remote-User"
- "Remote-Groups"
- "Remote-Email"
- "Remote-Name"
GNU nano 7.2 /config/traefik/traefik.yaml
global:
checkNewVersion: false
sendAnonymousUsage: false
entryPoints:
web:
address: :80
proxyProtocol:
insecure: false
trustedIPs:
- 172.32.0.0/16
- 192.168.1.0/24
forwardedHeaders:
insecure: false
trustedIPs:
- 172.32.0.0/16
- 192.168.1.0/24
http:
redirections:
entryPoint:
to: websecure
scheme: https
permanent: true
websecure:
address: :443
proxyProtocol:
insecure: false
trustedIPs:
- 172.32.0.0/16
- 192.168.1.0/24
forwardedHeaders:
insecure: false
trustedIPs:
- 172.32.0.0/16
- 192.168.1.0/24
http:
tls:
options: modern@file
certResolver: letsencrypt
domains:
- main: "example.com"
sans:
- "*.example.com"
providers:
docker:
exposedByDefault: false
network: compose_proxied
allowEmptyServices: true
endpoint: "http://socket:2375/"
defaultRule: "Host(`{{ index .Labels \"com.docker.compose.service\"}}.example.com`)"
file:
directory: /config/dynamic
watch: true
api:
insecure: false
dashboard: true
certificatesResolvers:
letsencrypt:
acme:
email: [email protected]
storage: /certificates/acme.json
dnsChallenge:
provider: cloudflare
resolvers:
- "1.1.1.1:53"
- "1.0.0.1:53"
log:
level: DEBUG
filePath: /config/logs/traefik.log
format: json
accesslog:
filepath: /config/logs/access.log
bufferingSize: 100
format: json
Guess I am making this in excel now.
Note that its also possible to set up service auto discovery with traefik, the only traefik related config I do on new containers is
Traefik.enabled=true
I gave up on automating it, I download with slskd, and run musicbrainz Picard (import slskd download folder, and set it to always save to the jellyfin music folder/rename with my preferred sorting method). This has the bonus of downloading the cover art, and rarely has issues.
My bank forces a 6 digit PIN as a password.
Their 2fa is also email or text only.
At least we can set a unique username?
Slskd is nice
Especially with the VPN icon on there.
Tailscale to pihole ftw though!
For bad ragons in specific? Yes. Last I checked there was a subreddit and a section in heir official forums to do so, and I am sure there were more spaces I didn’t know about (because I never cared to try looking).
There are literally trusted middlemen for ensuring you don’t get scammed.
Pihole at home with a personal VPN (wireguard, tailscale, head scale, etc) that routes all your phone traffic through it.
Works pretty good, and you can always add additional blacklists if something still gets through.
As a west coast Canadian, I have literally never heard them called a loonie store.
Its very fun getting a turtle notification too.
So life loses vibrancy, but my retinas stay in slightly better shape when I’m 80? Sounds like future me problem then, definitely have no interest in trying again with a different pair after my next eye exam.
Unfortunately every eye doctor in this province (or at least not a 13 hour drive away) is associated with a chain, with I think a single exception that is referral only. So the best I can do is get an eye exam, demand my detailed results, and do my best to order glasses that fit comfortably.
Man, I wish this was always true.
Here in BC/Canada, our healthcare doesn’t cover glasses, and our 3rd party providers only cover $2-300 every 2 years for glasses.
My last job had a $500 yearly flex-spend coverage, which I used to buy $600 glasses (mainly lenses cost-wise) with all the options/coatings/transitions/blue light filter/etc from the local eye clinic, and honestly the lenses are not great, and after less than 3 years the coating is bubbling in horizontal lines across the entire lens.
Honestly though, been regretting getting glasses with the blue light filter for the past 2 years anyways, nothing feels vibrant anymore and i swear it has been negatively affecting my mood, and i have noticed zero difference in eye strain levels.
Authelia has a page on cloudflare, does this help at all? Note that I use traefik as my reverse proxy and am not using any of cloudflares advanced features.
https://www.authelia.com/integration/proxies/forwarded-headers/#cloudflare
WordPress could probably do it, you don’t have to give it public access.
You can try setting up a VPN, eg headscale/tailscale with your home server being an exit node, and then just set up your questionable services on a domain that only resolves locally - and then you don’t need to use authentik for authorisation to those services.
This is what I have been trying recently, and seems to work well.
I mean, I make fun of my home server all the time - its 2 old computers screwed to a wall.