Skip to main content

Traefik (Maresa)

This is the standalone Traefik that runs on the Maresa Synology host — not the cluster Gateway-API stack (see Platform → Envoy Gateway for that). Its only job is to terminate TLS for the handful of admin UIs that live on the Synology and route them by hostname on the internal *.maresa.int.kueber.eu zone.

Why a separate proxy on Maresa​

The Synology hosts a few admin surfaces — AdGuard Home, Syncthing, and Traefik's own dashboard — that should:

  • Speak HTTPS, with a real cert, even though they're internal-only (so browsers don't nag and modern features like the cookie Secure flag work).
  • Be discoverable by name (syncthing.maresa.int.kueber.eu, etc.) rather than 192.168.0.5:8384.
  • Stay reachable even when the cluster is down, since AdGuard's whole point is to survive cluster outages.

Sending all of that through the cluster's ingress would couple "can I reach my DNS resolver" to "is Kubernetes up." Running Traefik locally on the Synology keeps the dependency in the right direction.

Why Traefik and not Caddy / nginx​

  • Docker labels are the config. Each Compose service declares its own routing via labels: — no separate Traefik config file to keep in sync.
  • Native Let's Encrypt DNS-01 with the All-Inkl provider. The homelab's domain is hosted at All-Inkl; Traefik talks to their DNS API directly, no shell-script hooks.
  • Built-in dashboard for "what's currently routed?", protected behind the same TLS as everything else.

Caddy would be equally fine; Traefik won on label-driven config matching the rest of the maresa stack.

Operational notes​

  • The All-Inkl credentials are injected via ALL_INKL_LOGIN / ALL_INKL_PASSWORD env vars from the host environment — never committed.
  • ACME state (account key, issued certs) is persisted on /volume1/docker/traefik-data/. Wiping that file re-issues every cert at the next request.
  • Public port 447 is bound on the host so this Traefik doesn't conflict with the Synology's own DSM web UI on 443. Internal clients hit https://<host>.maresa.int.kueber.eu (which resolves to Maresa's LAN IP) and the LAN-side rule maps to 447.
  • Insecure-skip-verify is on for upstream connections — backends are local-loopback only, so the missing verification doesn't cross any trust boundary.
  • The dashboard is at traefik.maresa.int.kueber.eu; reachable from the home LAN and over the NetBird mesh via the Maresa agent.

Cluster Deployment​

Traefik — Maresa Docker host

Cluster-specific notes only. General product info and rationale live in docusaurus/docs/apps/traefik.mdx.

Layout​

  • Image digest-pinned (traefik:v3.7.0).
  • HTTPS listener (websecure) on container port 443, published on the host as 447 to avoid conflict with the Synology DSM UI on :443.
  • TLS via Let's Encrypt DNS-01 through the all-inkl provider; ACME state on /volume1/docker/traefik-data/acme-dns.json.
  • Wildcard cert for *.maresa.int.kueber.eu so per-service hosts don't each require their own issuance.
  • Docker provider with exposedbydefault=false — every service opts in via labels.
  • Prometheus metrics endpoint enabled.

Deviations from defaults​

  • Host port 447 instead of 443 — Synology DSM owns 443 for its own management UI.
  • serversTransport.insecureSkipVerify=true — backends are local Docker services with self-signed or no certs; safe because the traffic never leaves the loopback bridge.
  • api.insecure=true + label-routed dashboard — the dashboard isn't on a public port, only via the matching Traefik router, which terminates TLS itself.

Credentials (ALL_INKL_LOGIN, ALL_INKL_PASSWORD) are sourced from the host environment, not committed.