docker-compose-collection/traefik/README.md

Traefik Setup with Cloudflare DNS and Basic Auth

This guide provides an example of configuring Traefik with Cloudflare DNS API for automatic TLS certificate issuance and Basic Authentication to secure the Traefik dashboard.

Prerequisites

Before setting up, make sure you have the following:

1. Docker and Docker Compose installed on your machine.
2. A Cloudflare account with an active domain.
3. Cloudflare API Token for DNS-01 challenge validation.
4. Apache2-utils installed on your machine to generate Basic Authentication credentials. You can install it via the following command:
   • For Debian/Ubuntu: sudo apt install apache2-utils

Configuration Overview

Docker Compose Setup

The docker-compose.yml file sets up the following services:

• Traefik: The reverse proxy, which manages routing and SSL certificates.
• Cloudflare DNS: Automatically requests SSL certificates via the Cloudflare DNS provider.

Basic Authentication

The dashboard is secured using basic authentication. You'll need to generate a user and password for this.

Setup Instructions

Step 1: Clone or Download the Files

Clone this repository or download the docker-compose.yml and .env-example files to your project directory.

Step 2: Rename and Customize the .env File

Rename the .env-example file to .env and update the file with your specific values. This file contains environment variables used by the Traefik service.

mv .env-example .env

Modify the .env file

Step 3: Generate Basic Authentication Password

To generate the Basic Authentication password hash, you will need the apache2-utils package. If you haven't installed it yet, run:

sudo apt install apache2-utils

Then, use the following command to generate the password hash:

echo $(htpasswd -nB yourusername) | sed -e s/\\$/\\$\\$/g

Replace yourusername with your desired username. The generated value should be placed in the TRAEFIK_BASICAUTH_PASSWORD field in the .env file.

Step 4: Configure the traefik.yml File

Change the traefik.yml under data/traefik/traefik.yml

Add the following configuration and replace "yourmail@example.com" with your email address:

certificatesResolvers:
  cloudflare:
    acme:
      email: "yourmail@example.com"
      storage: acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

Step 5: Create the Traefik Network

Before running the docker-compose.yml, you need to create a Docker network that Traefik can use. Run the following command:

docker network create traefik

This will create a network named traefik that can be referenced in your docker-compose.yml file. Ensure that your services are connected to this network for Traefik to manage them correctly.

Once you've created the network, you can proceed with the rest of the setup as described in the guide. The services will be able to communicate with Traefik, and your SSL certificates will be automatically handled through Cloudflare.

Step 6: Start the Services

Run the following command to start Traefik and any associated services using Docker Compose:

docker-compose up -d

This will start Traefik with the specified configuration.

Step 7: Access the Traefik Dashboard

Open your browser and navigate to the Traefik dashboard at http://<your-traefik-domain>.
If you’ve set up Basic Authentication, you’ll be prompted to enter the username and password you configured in the .env file.

Step 8: Cloudflare DNS-01 Challenge

Traefik will automatically use the Cloudflare DNS API to request a wildcard TLS certificate for your domain using the DNS-01 challenge. Ensure your Cloudflare account has the necessary permissions and API token configured in the .env file. Step 7: Customizing Your Traefik Configuration

You can modify the docker-compose.yml file to add more routers, services, and middlewares as per your needs. This setup only includes the Traefik reverse proxy and basic configurations for TLS via Cloudflare and Basic Authentication for the dashboard.