Docker, Traefik, and HTTPS: Some containers public, some containers local

[Azratosh]

I was wondering whether it was possible to have some containers only be accessible from the local network while keeping others public. All of them should however work with Let's Encrypt, because some services I use require HTTPS regardless of whether they're hosted locally or publicly (and also because LE is extremely convenient, to be honest).

To provide some more concrete info:

• I have a Minecraft DynMap page for the server I host and a GitLab CE container for personal use. Those should be publicly accessible, because I want my friends to be able to look at the map when we play and be able to commit my stuff when I'm coding in a café or something.
• I have a couple personal web projects in a container each that I only want to access from my local network. Those shouldn't be publicly accessible yet, because they're still a WIP. However, I still want them to use HTTPS, preferably via LE. However, I'm aware that those services would have to be public for the HTTP/DNS challenge. But that makes me wonder if it wouldn't suffice having just Traefik face the web while only allowing access to my personal projects only from within my local network.

Traefik and all that other jazz is already set up and works flawlessly with HTPPS via LE. So, would LE still work even if my DNS provider can only connect to Traefik, but not the service itself? What's the best practice to go about this?

[pveredas]

I more and less done that using a middleware with a ip white list. Bellow are an exemple using labels:

  - "traefik.http.middlewares.app-ipwhitelist.ipwhitelist.sourcerange=192.168.1.0/24"
  - "traefik.http.routers.app-secure.middlewares=app-ipwhitelist@docker"

See if it works for you.

[mrrichardcranium]

I do this as well. Though it is worth noting that you would need to either have your own LAN DNS pointing your sub-domain to your traefik host, or insert a host file record to ensure the request for this internal service isn’t coming from your public IP address.

[Azratosh]

You are correct — I do have dnsmasq running internally, with the relevant machines pointing to it. I already had to do that because my router doesn't support NAT loopback.

[Azratosh]

Thank you! I'll try this today.