--- type: synthesis path: Wiki/Homelab tags: - traefik - cloudflare - authentik - homelab - networking sources: - "[[Sources/Homelab/traefik-deployment]]" - "[[Sources/Homelab/homelab-mcp-server]]" - "[[Sources/Homelab/2026-05-06-homelab-mcp-server-stand-up]]" - "[[Sources/Dev/cloudflare-cache-strategy]]" - "[[Sources/Dev/cloudflare-cache-rules]]" - "[[Sources/Homelab/dns-knot-pihole-end-to-end]]" - "[[Sources/Homelab/homelab-dns-decision]]" - "[[Sources/Homelab/server-stability-and-security-hardening]]" - "[[Sources/Homelab/wp-cron-supercronic-deploy]]" - "[[Sources/Homelab/ufw-docker-outage-fix]]" - "[[Sources/Homelab/pbs-security-hardening]]" - "[[Sources/Homelab/ssh-ca-with-step-ca-authentik]]" created: 2026-05-08 updated: 2026-05-08 --- # Homelab Ingress Stack ## Synthesis The ingress architecture across both PBS and homelab converges on a layered pattern: Cloudflare at the edge, Traefik as the origin ingress, Authentik as the identity gate, and Tailscale as the private mesh. These four components appear together across 10+ project plans and session notes and form a coherent security + routing philosophy. ### The Four-Layer Model ``` Internet └── Cloudflare (DNS + CDN + DDoS + Tunnel) └── Traefik (TLS termination + routing + middleware) └── Authentik (SSO/OAuth2/OIDC gate) └── Service (WordPress, n8n, MCP server, etc.) Private (Tailscale) └── Direct service access (OB1, herbydev VNC, inter-service) ``` **Layer 1: Cloudflare** handles all public-facing concerns — authoritative DNS for both `plantbasedsoutherner.com` and `herbylab.dev`, CDN caching, DDoS/Bot Fight Mode, and zero-trust tunnel exposure (`cloudflared`). The cache rules use last-match-wins ordering with cookie-based bypass for authenticated members. The Cloudflare Tunnel pattern means origin servers never open inbound ports for public traffic — the tunnel initiates outbound, and Cloudflare routes to it. **Layer 2: Traefik** is the Swiss Army knife — TLS termination (Let's Encrypt + Cloudflare DNS challenge for wildcards), Docker service discovery via labels, custom middleware (e.g., `block-wpcron`). It runs in both PBS and homelab contexts. After the March 2026 v3.6.11 upgrade, Traefik is stable; the UFW outage (missing DOCKER-USER rules) revealed that Docker + UFW interaction requires explicit outbound allow rules in `after.rules`. **Layer 3: Authentik** gates sensitive services behind SSO. The MCP server was the first homelab service deployed behind Authentik OAuth2 (May 2026). The SSH CA project (step-ca + Authentik OIDC) extends this pattern to SSH key lifecycle — short-lived certificates replacing long-lived keys. The PBS security hardening plan adds Authentik/Authelia + Crowdsec as a second layer in front of WordPress admin. **Layer 4: Tailscale** provides the private path — for services that should never be public (OB1, inter-VM communication) and for admin access (herbydev VNC). Tailscale and Cloudflare Tunnel serve complementary roles: Tunnel for public-facing services, Tailscale for private mesh. ### PBS vs. Homelab Divergence PBS infrastructure is primarily Cloudflare + Traefik (no Authentik currently — WordPress handles its own auth). Homelab is where Authentik lives. The convergence point is the MCP server, which uses all four layers: Cloudflare Tunnel for external access, Traefik for routing, Authentik for OAuth2, and Tailscale as an alternative access path. ### Operational Lessons - **UFW + Docker**: Docker rewrites iptables in a way that bypasses UFW INPUT rules. The fix is explicit DOCKER-USER chain rules in `/etc/ufw/after.rules`. Missing these caused a production outage. - **WP-Cron via Traefik**: WordPress's built-in cron fires on HTTP requests, which Traefik handles normally. The Supercronic sidecar + `block-wpcron` middleware pattern removes this unpredictability. - **Cloudflare cache + cookies**: The last-match-wins rule ordering means the cookie-bypass rule must come after the broad cache rule. Getting this wrong served cached logged-in pages to guests. - **DNS rebind protection**: The Knot + Pi-hole chain requires Pi-hole rebind protection disabled for `.herbylab.dev` split-horizon entries — EDE 15 errors were the symptom. ### Planned Additions - **Crowdsec + Authelia** — additional security layer for PBS WordPress admin - **step-ca** — short-lived SSH certificates issued via Authentik OIDC - **PBSII (pbs-infrastructure-intelligence)** — Go collector + log parser + n8n monitor feeding Claude API healer for automated incident response ## Sources **traefik-deployment** provides the canonical Traefik setup: Knot DNS primary/secondary integration, wildcard TLS via Cloudflare DNS challenge, Cloudflare Tunnel wiring, and Tailscale placement in the topology. This is the reference document for the ingress architecture. **homelab-mcp-server** and **2026-05-06-homelab-mcp-server-stand-up** document the first service deployed using the full four-layer pattern: Cloudflare Tunnel + Traefik + Authentik OAuth2 for `mcp.herbylab.dev`. The stand-up session notes capture the FastMCP Streamable HTTP setup. **cloudflare-cache-strategy** and **cloudflare-cache-rules** capture the PBS CDN layer: last-match-wins rule design, cookie-bypass implementation, and n8n auto-purge integration. The session notes document the debugging process that revealed the rule ordering issue. **dns-knot-pihole-end-to-end** and **homelab-dns-decision** capture the DNS architecture decision: Knot DNS as primary with secondary replica, Pi-hole as resolver, split-horizon for `.herbylab.dev`. The session notes document the rebind protection + EDE 15 debugging. **server-stability-and-security-hardening** covers the March 2026 hardening sprint: Traefik v3.6.11 upgrade, Bot Fight Mode, MySQL OOM fix (768MB cap), WordPress memory cap. **ufw-docker-outage-fix** documents the UFW + Docker interaction that caused a production outage, and the fix via explicit DOCKER-USER chain rules. **wp-cron-supercronic-deploy** documents replacing WP-Cron with a Supercronic sidecar + `block-wpcron` middleware. **pbs-security-hardening** and **ssh-ca-with-step-ca-authentik** cover the planned security expansions: Crowdsec + Authelia for PBS, step-ca + OIDC for SSH. ## Open questions - Will the homelab run a second Traefik instance or share the PBS Traefik? The traefik-deployment plan implies a homelab-specific instance but this isn't fully resolved. - The PBSII intelligence layer (Go collector + Claude API healer) would sit at the meta layer above all of this — when does that project move from plan to active? - Crowdsec integration: does it sit in front of Traefik (as middleware) or beside it? The pbs-security-hardening plan doesn't fully specify placement. - As OB1 goes live, does it get a Cloudflare Tunnel path for external access, or remain Tailscale-only permanently?