7eb8d756d1
Read all 62 source files (Dev: 37, Homelab: 22, Venture: 3, Reference: 0). Entity pages created (17): - Wiki/Reference: lovebug, jenny, sunnie, n8n, ob1, tailscale, authentik, traefik, cloudflare, obsidian, gitea, plant-based-southerner, claude-code, dispatch, docker - Wiki/Homelab: proxmox - Wiki/Dev: pbs-hub, herbydev Synthesis pages created (2): - Wiki/Homelab/homelab-ingress-stack — four-layer ingress model (Cloudflare + Traefik + Authentik + Tailscale); operational lessons from 10+ source files - Wiki/Dev/ai-memory-architecture — three memory layers (wiki + OB1 + Dispatch context); ingest paths; harness-vs-model design decision All 11 index pages rebuilt (Sources/Dev, Venture, Homelab, Reference, Sources root; Wiki/Dev, Venture, Homelab, Reference, Wiki root; vault root index.md). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
53 lines
2.5 KiB
Markdown
53 lines
2.5 KiB
Markdown
---
|
|
type: entity
|
|
path: Wiki/Reference
|
|
tags:
|
|
- traefik
|
|
- docker
|
|
- homelab
|
|
created: 2026-05-08
|
|
updated: 2026-05-08
|
|
---
|
|
|
|
# Traefik
|
|
|
|
## What it is
|
|
|
|
Traefik is the reverse proxy and ingress router for PBS infrastructure. It handles TLS termination, service routing, middleware chains, and integration with Cloudflare for DNS and tunnel-based access. Traefik runs as a Docker container in the PBS Linode stack and is the entry point for all HTTP/HTTPS traffic to PBS services.
|
|
|
|
## Current state
|
|
|
|
Active at version 3.6.11 (upgraded March 2026 during the server stability hardening session). Key configurations:
|
|
- **TLS** — wildcard certificates via Let's Encrypt + Cloudflare DNS challenge
|
|
- **Routing** — all PBS services (WordPress, n8n, pbs-hub, Gitea, MySQL proxy, etc.) routed through Traefik labels
|
|
- **Middleware** — `block-wpcron` middleware prevents direct HTTP access to `wp-cron.php` (replaced by Supercronic sidecar)
|
|
- **Cloudflare Tunnel** — Traefik sits behind Cloudflare Tunnel for MCP and some homelab services
|
|
- **Knot DNS** — primary and secondary DNS integrated with Traefik TLS pipeline
|
|
|
|
The homelab also runs Traefik (or uses the same pattern) for `.herbylab.dev` services behind Authentik.
|
|
|
|
## Where it lives
|
|
|
|
- PBS Linode Docker stack (`traefik` service in Docker Compose)
|
|
- Config: labels on Docker Compose services + `traefik.yml` / `dynamic/` config files
|
|
- Homelab: separate Traefik instance (or shared) for `.herbylab.dev`
|
|
|
|
## Related projects
|
|
|
|
- [[Sources/Homelab/traefik-deployment|traefik-deployment]] — full Traefik deployment plan
|
|
- [[Sources/Homelab/server-stability-and-security-hardening|server-stability-and-security-hardening]] — v3.6.11 upgrade
|
|
- [[Sources/Homelab/wp-cron-supercronic-deploy|wp-cron-supercronic-deploy]] — block-wpcron middleware
|
|
- [[Sources/Homelab/ufw-docker-outage-fix|ufw-docker-outage-fix]] — UFW + Docker/Traefik outbound rules fix
|
|
- [[Sources/Homelab/homelab-mcp-server|homelab-mcp-server]] — MCP server behind Traefik
|
|
- [[Wiki/Reference/cloudflare|cloudflare]] — tunnel + DNS
|
|
- [[Wiki/Reference/authentik|authentik]] — auth layer
|
|
- [[Wiki/Homelab/homelab-ingress-stack|homelab-ingress-stack]] — synthesis
|
|
|
|
## History
|
|
|
|
- Ongoing — Core PBS ingress layer
|
|
- **March 2026** — Upgraded to v3.6.11 during server stability work
|
|
- **March 2026** — `block-wpcron` middleware added when Supercronic replaced WP-Cron
|
|
- **2026** — UFW `after.rules` fixed to restore Docker/Traefik outbound routing after UFW misconfiguration caused outage
|
|
- **2026-05-06** — Traefik used as ingress for MCP server at `mcp.herbylab.dev`
|