# Traefik Setup with Cloudflare DNS and Basic Auth

This guide provides an example of configuring **Traefik** with **Cloudflare DNS API** for automatic TLS certificate issuance and **Basic Authentication** to secure the Traefik dashboard.

## Prerequisites

Before setting up, make sure you have the following:

1. **Docker and Docker Compose** installed on your machine.
2. A **Cloudflare account** with an active domain.
3. **Cloudflare API Token** for DNS-01 challenge validation.
4. **Apache2-utils** installed on your machine to generate Basic Authentication credentials. You can install it via the following command:
   - For Debian/Ubuntu: `sudo apt install apache2-utils`

## Configuration Overview

### Docker Compose Setup

The `docker-compose.yml` file sets up the following services:

- **Traefik**: The reverse proxy, which manages routing and SSL certificates.
- **Cloudflare DNS**: Automatically requests SSL certificates via the Cloudflare DNS provider.

### Basic Authentication

The dashboard is secured using basic authentication. You'll need to generate a user and password for this.

## Setup Instructions

### Step 1: Clone or Download the Files

Clone this repository or download the `docker-compose.yml` and `.env-example` files to your project directory.

### Step 2: Rename and Customize the `.env` File

Rename the `.env-example` file to `.env` and update the file with your specific values. This file contains environment variables used by the Traefik service.

```bash
mv .env-example .env
```
Modify the .env file

### Step 3: Generate Basic Authentication Password

To generate the Basic Authentication password hash, you will need the apache2-utils package. If you haven't installed it yet, run:

```bash
sudo apt install apache2-utils
```

Then, use the following command to generate the password hash:

```bash
echo $(htpasswd -nB yourusername) | sed -e s/\\$/\\$\\$/g
```

Replace yourusername with your desired username. The generated value should be placed in the TRAEFIK_BASICAUTH_PASSWORD field in the .env file.

### Step 4: Configure the traefik.yml File

Change the traefik.yml under data/traefik/traefik.yml

Add the following configuration and replace "yourmail@example.com" with your email address:

```yaml
certificatesResolvers:
  cloudflare:
    acme:
      email: "yourmail@example.com"
      storage: acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"
```


### Step 5: Create the Traefik Network

Before running the docker-compose.yml, you need to create a Docker network that Traefik can use. Run the following command:

```bash
docker network create traefik
```

This will create a network named traefik that can be referenced in your docker-compose.yml file. Ensure that your services are connected to this network for Traefik to manage them correctly.

Once you've created the network, you can proceed with the rest of the setup as described in the guide. The services will be able to communicate with Traefik, and your SSL certificates will be automatically handled through Cloudflare.

### Step 6: Start the Services

Run the following command to start Traefik and any associated services using Docker Compose:

```bash
docker-compose up -d
```

This will start Traefik with the specified configuration.

### Step 7: Access the Traefik Dashboard

    Open your browser and navigate to the Traefik dashboard at http://<your-traefik-domain>.
    If you’ve set up Basic Authentication, you’ll be prompted to enter the username and password you configured in the .env file.

### Step 8: Cloudflare DNS-01 Challenge

Traefik will automatically use the Cloudflare DNS API to request a wildcard TLS certificate for your domain using the DNS-01 challenge. Ensure your Cloudflare account has the necessary permissions and API token configured in the .env file.
Step 7: Customizing Your Traefik Configuration

You can modify the docker-compose.yml file to add more routers, services, and middlewares as per your needs. This setup only includes the Traefik reverse proxy and basic configurations for TLS via Cloudflare and Basic Authentication for the dashboard.