this post was submitted on 08 Jul 2024
21 points (95.7% liked)

Selfhosted

40173 readers
1100 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
21
Traefik and external services (lemm.ee)
submitted 4 months ago by [email protected] to c/[email protected]
12 comments fedilink hide all child comments
 

Hello Selfhosted peeps!

So I just got Traefik v3 setup inside my docker environment, and successfully got SSL certs for my services hosted within docker. However, I have an external device hosting PiHole and Wireguard-UI. I am looking to use the docker instance of Traefik v3 to obtain SSL certs for the internal use only for PiHole and Wireguard-UI.

I am still new to Traefik, and have no idea if this is possible, or how I would go about doing this.

Any tips, suggestions, links to documentation; I am all ears.

Video

Notes for above video

These 2 resources I utilized to help further my understanding.

Thank you

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 2 points 4 months ago* (last edited 4 months ago) (1 children)

so in my traefik.yml file I have cloudflare set as my certresolver as follows:

certificatesResolvers:
  cloudflare:
    acme:
      email: [email protected]
      storage: acme.json
      caServer: https://acme-v02.api.letsencrypt.org/directory # prod (default)
      # caServer: https://acme-staging-v02.api.letsencrypt.org/directory # staging
      dnsChallenge:
        provider: cloudflare
        #disablePropagationCheck: true # uncomment this if you have issues pulling certificates through cloudflare, By setting this flag to true disables the need to wait for the propagation of the TXT record to all aut>
        #delayBeforeCheck: 60s # uncomment along with disablePropagationCheck if needed to ensure the TXT record is ready before verification is attempted 
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

And I had to get the secret mounted via the docker-compose file.

So where you have:

tls:

        certResolver: examplecom-dns

Do I have to redefine all of the same information I did in my Traefik yml but in this separate config.yml?

(I did set it up in my traefik.yml and docker-compose.yml to mount and use this config, which I had commented out for later use.

Thank you so much for the help!

Edit:

Essentially I am trying to get my PiHole which is hosted on another pi setup with an SSL cert for local use only:

So in looking at your config I tried using:

http:
  routers:
    pihole-rtr:
      entryPoints:
      - https
      service: pihole-rtr
      rule: "Host(`ph.local.domain.com`)"
      tls:
        certResolver: cloudflare

  services:
    pihole-svc:
      loadBalancer:
        servers:
          - url: "http://<ip>/admin"

However when doing this error logs returned:


2024-07-08T15:04:27-04:00 ERR error="the service \"pihole-rtr@file\" does not exist" entryPointName=https routerName=pihole-rtr@file
2024-07-08T15:04:28-04:00 ERR error="the service \"pihole-rtr@file\" does not exist" entryPointName=https routerName=pihole-rtr@file

I am doing something very wrong... And feel a little lost.

[–] [email protected] 2 points 4 months ago (2 children)

I think you're close.

You need to change service: pihole-rtr to service: pihole-svc.

Do I have to redefine all of the same information I did in my Traefik yml but in this separate config.yml?

No, you just need to reference it like you have. Define once, reference many.

[–] [email protected] 2 points 4 months ago

I will give this a shot! Thank you for the help. I will report back, in hopes that between your knowledge and my fumbles that someone else too can learn from this!

[–] [email protected] 2 points 4 months ago (1 children)

I hate to report back, but something isn't quite working for pihole behind Traefik.

running "docker logs traefik" returns no error, and yet no certificate was presented to my pihole.

Not sure what else I might be missing or that I might have wrong.

[–] [email protected] 2 points 4 months ago (1 children)

Can you see the router and service in the Traefik dashboard and do they show any errors there?

[–] [email protected] 2 points 4 months ago (1 children)

Shows in traefik, no errors there.

[–] [email protected] 2 points 4 months ago (1 children)

If you're sure you've got a DNS entry for the Pihole FQDN pointing at Traefik, open the dev panel in your browser (F12), switch it to the Network tab, and visit the pihole URL.

See if you get anything back and especially take note of the HTTP status codes.

[–] [email protected] 2 points 4 months ago

I will likely have to do some tinkering, and more reading up on this from the documentation I am thinking. I am getting HTTP 200 statuses basically across the board. When going to the FQDN it doesn't redirect to the PiHole admin page like I was expecting. Again, likely some configuration that I have wrong.