---
type: entity
path: Wiki/Reference
tags:
  - traefik
  - docker
  - homelab
created: 2026-05-08
updated: 2026-05-08
---

# Traefik

## What it is

Traefik is the reverse proxy and ingress router for PBS infrastructure. It handles TLS termination, service routing, middleware chains, and integration with Cloudflare for DNS and tunnel-based access. Traefik runs as a Docker container in the PBS Linode stack and is the entry point for all HTTP/HTTPS traffic to PBS services.

## Current state

Active at version 3.6.11 (upgraded March 2026 during the server stability hardening session). Key configurations:
- **TLS** — wildcard certificates via Let's Encrypt + Cloudflare DNS challenge
- **Routing** — all PBS services (WordPress, n8n, pbs-hub, Gitea, MySQL proxy, etc.) routed through Traefik labels
- **Middleware** — `block-wpcron` middleware prevents direct HTTP access to `wp-cron.php` (replaced by Supercronic sidecar)
- **Cloudflare Tunnel** — Traefik sits behind Cloudflare Tunnel for MCP and some homelab services
- **Knot DNS** — primary and secondary DNS integrated with Traefik TLS pipeline

The homelab also runs Traefik (or uses the same pattern) for `.herbylab.dev` services behind Authentik.

## Where it lives

- PBS Linode Docker stack (`traefik` service in Docker Compose)
- Config: labels on Docker Compose services + `traefik.yml` / `dynamic/` config files
- Homelab: separate Traefik instance (or shared) for `.herbylab.dev`

## Related projects

- [[Sources/Homelab/traefik-deployment|traefik-deployment]] — full Traefik deployment plan
- [[Sources/Homelab/server-stability-and-security-hardening|server-stability-and-security-hardening]] — v3.6.11 upgrade
- [[Sources/Homelab/wp-cron-supercronic-deploy|wp-cron-supercronic-deploy]] — block-wpcron middleware
- [[Sources/Homelab/ufw-docker-outage-fix|ufw-docker-outage-fix]] — UFW + Docker/Traefik outbound rules fix
- [[Sources/Homelab/homelab-mcp-server|homelab-mcp-server]] — MCP server behind Traefik
- [[Wiki/Reference/cloudflare|cloudflare]] — tunnel + DNS
- [[Wiki/Reference/authentik|authentik]] — auth layer
- [[Wiki/Homelab/homelab-ingress-stack|homelab-ingress-stack]] — synthesis

## History

- Ongoing — Core PBS ingress layer
- **March 2026** — Upgraded to v3.6.11 during server stability work
- **March 2026** — `block-wpcron` middleware added when Supercronic replaced WP-Cron
- **2026** — UFW `after.rules` fixed to restore Docker/Traefik outbound routing after UFW misconfiguration caused outage
- **2026-05-06** — Traefik used as ingress for MCP server at `mcp.herbylab.dev`