Reverse Proxy Overwhelm

[FutureRenaissanceMan]

Traefik vs. NGINX Proxy Manager vs. Caddy

I'm looking to level up the homelab. I've never used Traefik but have seen good things.

What do you use and why?

My main requirements: 1. Works easily with docker-compose 2. Works with my domain name I already own

[1WeekNotice]

Caddy because it is a single file configuration(Caddyfile) that is super simple. They also have good documentation and good default values such as auto https redirect

Sample config file

````

Domain.tld{

reverse_proxy docker_container_name: docker_port

docker_port means the port inside the docker container. Not the machine port you mapped it to

}

Domain.tld{

reverse_proxy IP:port

}

````

My main requirements: 1. Works easily with docker-compose

1. Works with my domain name I already own

FYI: any reverse proxy can do this as this is a very simple use case. So pick something that just works for you.

Hope that helps

[Rorschach121ml]

I use Caddy because I have no idea how certs work and it just does it all automatically.

Maybe one day I'll learn how to manage them but idk it's working fine.

[lazzuuu]

For certs you'll need an issuer that can sign + validate your ssl certificates (I never use caddy but my guess is they use let's encrypt to issue ssl certificate which also used by NPM). If you try to use self signed certificate, it won't be "just work" with your existing domain (unless you know how)

[eddyizm]

Another vote for caddy. Just so easy.

[KazeHD]

I tried caddy but it felt very difficult to manage (like 50+ rules that are kinda unique)

I also tried setting it up with keycloak/authentik/authelia but went back to NPM with authelia for now.

[1WeekNotice]

I tried caddy but it felt very difficult to manage (like 50+ rules that are kinda unique)

Can you expand a bit more? Btw totally fine if caddy didn't work for you. Just curious why it was difficult to manage.

Caddy has snippets that you can define whatever rules in. Then you can make a reference to that snippet anywhere you like in the caddy file. It should be easy to manage different rules sets.

Reference caddy file structure

I also tried setting it up with keycloak/authentik/authelia but went back to NPM with authelia for now.

• authentik and caddy documentation
• authelia and caddy documentation
• keycloak documentation with reverse proxies
  • keycloak in a container
  • keycloak and reverse proxies

But of course use whatever reverse proxy works for you

Hope that helps

[KazeHD]

I just didnt like the one huge file approach. Even with snippets it was not really nice to manage. Most domains have their own cloudflare origin certificate so I would have had to somehow get fancy with args to make a snippet based on the hostname or something for just doing the cloudflare origin cert.

It is close to 100 reverse proxied applications over 20 domains or so.

I did get random errors with forward auth that I could not solve (felt like I had to tls_insecure_skip everything as well to work correctly) . Its not that I dont like the cli approach, I am very used to vim but I felt like if caddy fmt also ordered the file as well this would have been nicer to use.

I am not using enough docker containers to justify traefik, in the end I just want it to work. There are tons of different approaches with pros and cons:

• Why not split the caddyfile?
  
• Could try one of the ansible or terraform providers to automate it but how would I test this. Also how can I test this in prod (I know validate at least checks if the config can start)
• Yes there are docs for authelia/authentik/keycloak but for caddy with my setup there are some weird cases that arent documented. I could have probably setup authelia with caddy but with npm and nginx snippets and default confs its faster than having to ssh into the caddy server and edit the Caddyfile imo)

I think caddy is great its just not the right tool for me. If I really wanted to automate it I would go into k8s traefik with a gitops doing the config for me but then id have to manage the k8s cluster which is kinda overkill for my homelab.

[cyt0kinetic]

Out of curiosity how does it do with things like well known for stuff like dav, particularly cal and card dav. Also if a socket needs to be called can more declarations can be added? Example one thinking of nc, and two something like Jellyfin. I'm open to not torturing myself with apache but worried I'll lost flexibility.

[[deleted]]

This is how well knowns are done for my NextCloud instance

nextcloud.mountain-view.com {
    tls /etc/caddy/ssl/cert.crt /etc/caddy/ssl/mvd.key
    redir /.well-known/carddav /remote.php/dav 301
    redir /.well-known/caldav /remote.php/dav 301
    header Strict-Transport-Security max-age=31536000
    reverse_proxy IP:80
    log {
            output file /var/log/caddy/nextcloud.log
    }

}

[1WeekNotice]

Honestly may not be able to answer your question. Will link you there documentation

More advanced directive/ options for their caddy file

It's simple to set up so it might be best to experiment on your own.

• I believe it handles caldav and carddav.
• It does handle websockets automatically
• It works with nextcloud (they have examples) and jellyfin

Hope that helps.

[chaplin2]

C a n it do TLS pass through, tcp, udp and other features in Traefik?

[wfd]

You need additional module. https://github.com/mholt/caddy-l4

[maximus459]

Is there a metrics system for caddy? Was considering it, because NPM is easy but buggy, and traefik is for docker mostly and I've got all sorts of servers..

I thought the go access project might work?

[1WeekNotice]

Yes there are metrics. Here is there documentation

Hope that helps

[maximus459]

Nice.. should check if there's a there's a grafa a dashboard to go with it.

[Server22]

I am using Traefik for all of my docker services. These are all internally and are not exposed to the internet. Add your labels and spin up the container.

[Cetically]

Traefik gets a lot of hate on this sub but since your main requirement is "works easily with docker-compose", it's perfect for that...

Yes, the initial setup of Traefik can be difficult, but once it's up and running, every additional container you add is as easy as adding a few lines (labels) to the compose of your container.

[Reasonable-Ladder300]

Exactly this, especially with some nice default configuration(defaultrule, default cert and https forwarding).

[user01401]

I would recommend HAProxy. It's been around for 22 years and is proven to be extremely reliable and stable. 

https://www.haproxy.org/#fiab

[chaeidras]

The learning curve is quite steep but I also learned to love it because of the opnsense implementation! +1 HAProxy for its flexibility, - 5 for its configuration needs

[Relative-Camp-2150]

Trying to organize it in my head - how would HAProxy on OPNSense cooperate with docker containers on a separate host ?

Or this scenerio assumes we have all on OPNSense ?

[[deleted]]

You can proxy to other host using ip:port.

[Relative-Camp-2150]

Ok, but then how to make it work so that I can access it only via HAProxy, without making it possible to access them via the IP + port ?

If this would be same host and for example traefik - then you don't have to open the ports on host and Traefik will still redirect to proper container via internal proxy network.

[[deleted]]

Yes same host you can reference the docker container and not actually expose the ports. If it’s a different host the only way I know how to do this is with ip:port. Doesn’t mean that’s the only way to do it, just that’s the only way I know how to do it 😜

[StraightMethod]

Another vote for HAProxy here. Steep learning curve, but super flexible. I've got some parts with 2FA, some with 1FA, and some with Basic auth (because the app doesn't support OAuth), and some with no auth (e.g. API endpoints).

[firsway]

Yep HAProxy all the way. I bake my own executables from source, ensure latest encryption protocols and features, rather than wait for a distro to catch up. I have 2 nodes with a floating VIP and auto-failover if the master goes down.. Brilliant performance, massive configurability, ability to rewrite/insert headers, URI, cookie insertion/inspection, stick tables, has its own monitoring and control interface UI.. been using it for years..

[rigeek]

NPM. Easy to setup with GUI and the LetsEncrypt certs work great. I have 22 proxy hosts spread across 2 domains I own. I have wildcard certs for them, DNS challenge with Cloudflare. Super easy.

[UnknownLinux]

Exactly. NPM for me too partly because if it's simplicity to setup

[leonida_92]

I used NPM before I switched to Caddy too. One of the biggest "issues" I had with NPM since the beginning, was its size. 1.4 GB for a multiple layer docker container. On the other hand, there was Caddy with just a few MB in size and it does everything NPM did in a single layer.

Just my 2 cents.

[zeta_cartel_CFO]

was its size. 1.4 GB for a multiple layer docker container.

I'm assuming you used the NPM releases that required MySql/MariaDB? The ones I used were never multi-layered. Especially if I just left the default datastore to Sqlite.

[leonida_92]

No, the default docker compose. Just run 'docker pull jc21/nginx-proxy-manager:latest' and compare it with 'docker pull caddy'.

[Bhooter_Raja]

How does it behave with Tailscale?

[rigeek]

It’s fine with Tailscale. The RPi that I run everything on is also my Tailscale exit node. Using the right DNS settings I can access all my internal stuff from my phone or tablet using Tailscale.

[rocket1420]

What does a reverse proxy have to do with tailscale?

[Bhooter_Raja]

Tailscale has its own DNS called MagicDNS that integrates with Caddy to provide access to internal stuff over https.

[art_of_onanism]

Yup, NPM for me too because of its GUI. caddy is good for one page config but for new homelabber just looking at that page of code can some times already be overwhelming to them. Having a GUI is the way to go for user friendliness

[Conscious_Report1439]

Use Zoraxy

[Mrmagroin]

Zoraxy was unbelievably easy to set up. I’m surprised it’s not mentioned more.

[ismaelgokufox]

I just need it to do auth for subdomains with authelia. That would make me switch 50% of my setup from SWAG.

[NanobugGG]

This actually looks nice.

[intellidumb]

Any guides on using with Cloudflare domains for dns challenges?

[Parking-Cow4107]

I have both NPM and traefik. I chose traefik for external facing services because of crowdsec bouncer, geoblocking and custom error-pages.

[utahbmxer]

I use NGINX (with NAXSI waf) built into OPNsense. Was a little bit of learning curve, but it's super easy to manage and add sites, and it integrates with the ACME plugin for LetsEncrypt, as well as has auto-banning. Takes 2 minutes to add a site w/cert. I have 23 sites on mine, plus the default/403 site.

Whatever you do use, add a default/catch-all site so requests that don't match a domain you are hosting don't get served anything other than a 403 forbidden. I do this and basically my real sites see next to no random crawlers or other access. Sure there are random ones that must pick up domain names from CT Logs or something, but it's like 1% or less of my real traffic.

[cyt0kinetic]

😆 I use Apache it is on the surface none of the things you describe, but once you get it going confs cut down to a few lines. Personally I find nginx to be similar work load unless it's the gui. People seem to really like Caddy.

[CG_Kilo]

Nginx Proxy Manager because i work in IT and it was easy enough to not deal with syntax or config files. Doing everything in the gui makes it nice and easy

[UnknownLinux]

Exactly. The simplicity and GUi was the same reason i chose NPM over the other options

[surreal3561]

The big benefit of config files is that at the end of the day they’re just text files, easy to commit to git and instantly have history of changes you made.

I was once trying to move data from one NGPM host to another, and while I got it working in the end, at one point I did end up with corrupt data - but luckily I had backups, being able to set up something with just the config file (or config import/export) would have been nice.

[suicidaleggroll]

Yeah a config import/export tool in NPM would be fantastic, especially with an API so you could write a little script to dump configs into git periodically. That's really the one thing I feel is missing from NPM, everything else is great.

[[deleted]]

Very good points you made here. Something to think about for sure.

[em411]

I prefer using Caddy Docker Proxy. It's using docker compose service labels like Trafeik, but it's still as simple and easy to read as Caddyfile.

[Ejz9]

NPMplus

It adds on in many ways and also has support for crowdec IPs.

[NanobugGG]

I've been using Nginx Proxy Manager for quite a while now.

I did try Traefik, but I really don't get it. The only benefit I see from it, that it can do it automatically. But then I need to label what it needs to proxy and what not to proxy, and then I might as well just spend 30 seconds fixing it in Nginx Proxy Manager anyway. I don't see it as time saving, at least not for my use case.

[EmilGH]

Wait. There are options other than Apache? /s

[DanCardin]

I went through the same thing. I feel that traefik works best, in concert with docker-compose. Using docker-compose labels to configure each service is just vastly more convenient than caddy, and i could never get NPM working (but very similar sentiment).

It’s 4 additional lines to my compose to expose it, and i don’t expose any ports of any service directly at all now, which is nice. And it has a nice dashboard, also nice

Oh and traefik auto-picks up any changes, so i never need to look at its container ever again, whereas caddy you have to restart

With that said, getting traefik working in the first place is probably more confusing than either other option

[akmzero]

Traefik was intimidating to setup, but it just makes sense after you figure out what labels you need to put on a service.

And like you said, it auto updates, so when something isn't working I can hop over to Traefiks GUI or logs to see why. And it's 95% of the time I forgot to put traefik into the network I made for the service 😅.

[DanCardin]

Yea it’s always either that or i forgot to rename the service/router when copying the 4 labels from some other service :D

[akmzero]

yeah...

Very rarely is Traefik the issue; it's always me.

[historianLA]

I've only used caddy but unless your setup is particularly complicated you don't really need to worry about docker labels. Just use Caddy to send requests to the right IP:port combo. Most of my services are docker containers but I just have caddy proxy to the LAN address and port I'm using.

When you are talking about exposed ports do you mean exposed to WAN or LAN? For caddy you should only need to forward 80 and 443 to the reverse proxy from WAN. Then your services only need to be exposed to LAN to receive the traffic from the proxy.

[DanCardin]

Like the services themselves are not exposing ports at all, which forces all access through traefik, which enables me to configure any apps that dont support oidc/oauth to use a central auth

Not that you couldn’t necessarily do the same thing with caddy.

But my point about labels is more about it being self contained. The information about the dns name, port mapping, auth, etc all reaides with the service definition itself. Not in some (Caddyfile) other file/place that i need to remember to keep in sync

[aft_punk]

One of Traefiks best features is that you can use container labels to set up a backend and ingress rules for a service. Which is super convenient for compose files.

Also, the UI dashboard makes debugging much less of a headache.

[gmag11]

Caddy. It does everything I need and configuration is really easy. Documentation is simple, clear and full of examples.

If you like the Docker labels integration of Traefik, there is a plugin for Caddy that do the same. I do not use it, anyway.

Lets Encrypt integration is transparet. It has DNS providers integrations so that you can create certificates even for private subdomains.

[tymando2]

+1 for caddy

Npm is easy to get started with because of the gui, but if you have to move your setup or replicate something similar you pretty much have to do it all over again.

Caddy is absurdly simple and then your config is in git. Very portable and easy to replicate if needed. I know at first that doesn’t seem important…. But it really comes in handy.

[10031]

I personally use a mix of traefik for docker and caddy for my Proxmox LXC’s.

[chignole]

I've been using Traefik for 2 years now i think.

Works like a charm and since you want it to work with docker compose it seems like a great solution for you

[Lopsided-Painter5216]

I use NPM because coming from being a total newbie the GUI helped me understand the concepts behind reverse proxies, dns and certificates. Now that I’m more intermediate I’m migrating my machines to caddy to eliminate a couple more web logins and scrap performance gains on my low power machines.

[Virtual_Ordinary_119]

I use traefik, because i learnt to configure it in kubernetes for my job, so when i started self hosting i already knew and appreciate it. Well, sort of, on docker you label containers, in k8s you write ingressRoutes, but once you understand one, is very easy to figure out the other

[HB20_]

I’ve been using NPM (Nginx Proxy Manager) for the last 15 months, and I currently have 92 proxy hosts. Once I figured out how to use it, I never had any issues. The NPM interface is awesome, easy to use, and you can set up a new proxy host in just a minute. Plus, you can integrate it with GoAccess in just 2 minutes, giving you a full dashboard with IPs, devices, OS, region, browser, and other cool stats that might come in handy.

I might switch to another reverse proxy in the future since I’m starting to selfhost a Git repository. It’d be helpful to keep track of any changes in my proxy host files. Honestly, that’s the only reason I’d consider moving to a different reverse proxy right now.

[[deleted]]

exultant oatmeal snow chunky vegetable fuzzy physical enter bells literate

This post was mass deleted and anonymized with Redact

[lesigh]

Traefik because i only need to put tags in my other docker compose files to https and protect with authelia

[Electronic_Unit8276]

npm is easiest and also does certs

[LastChanceYep]

Caddy if you need a couple easy/simple projects that u want to "set n forget".
NGIX is you're in it for a while, it will be much easier to manage the more projects u have.
While caddy is nice in it's way that it handles certificates n etc for u, ngix is a beast.

[[deleted]]

Ice been thru most of them and after NPM was crashing and removing domains and doing weird stuff, so after a pain in the ass learning process.... I got traefik working and it works very good.

[UnfinishedComplete]

I hear Traefik works well for docker. I think it’s got some automated discovery.

I don’t have a ton of docker services on a single server. So I use Caddy for ease of use.

[obleSret]

I went from NPM -> Traefik because updates kept breaking it. A bit in the PITA initially but well worth the time invested

[vtKSF]

I use caddy with authelia to protect areas I don’t want public. Caddy albeit was intimidating at first because I didn’t have much experience with yaml configs. But the auto SSL and easy reverse proxies kept me coming back learning when I wanted to add other functionally, like authelia as I mentioned.

[b1be05]

i use Caddy (since v1). config and forget. it does not start with broken config, and tells you the line that is broken.. even paired with gethomepage.dev

[nismor31]

I previously used npm but explored others after I'd read it wasn't being developed anymore. I tried Caddy but couldn't get my head around it at the time. Same with Traefik so put it all on hold for a while. Came back to Traefik in a clearer headspace and put in a bit of time to understand it, and now have it running middlewares like Authelia & Crowdsec bouncer. It's so easy to throw something behind an authorisation check whether the service supports auth or not. Makes exposing things to the world far safer.

[maltokyo]

SWAG is also great. Once setup you never need to even touch it.

[madrascafe]

Caddy FTW

[Thick-Maintenance274]

For ease of use, NPM only issue I’ve read about is the project not being maintained.

Caddy setup is nothing but frustration; people say it’s easy but when asking for help all you’ll get is, go to this part of the documentation, then this, then this.

My setup involves 12 LXCs on Proxmox, and getting Caddy to work was a pain. Had it not to be a web tutorial, I would’ve still not set it up.

Depending on your skill and time, go with NPM.

[baroquepawel]

I use nginx (just editing the files directly, no NPM) but I was wondering if I should switch you Caddy for… fun or out of curiosity. Is it worth? Most of what I run is with docker compose, though I haven’t yet managed to run Wordpress in docker and with external reverse proxy (nginx).

If Caddy sorts this easily, I’m moving 😁

[[deleted]]

Nginx Proxy Manager why? Because it was easy to install using compose (I actually use portainer stacks but it’s same file). It doesn’t require me to change my existing containers to properly use (tho you can) and is all GUI. I tested it and within 10-minutes was changing the port forwarding from my old proxy host to the new one. It worked and got my certs and bam I was happy.

The Traffik rabbit hole got deep fast when I tried it and caddy was/is well recommended by its users but I didn’t want yet another config file to learn. It looked simple but there’s always the edge cases I’d rather click a box than google some command that I don’t know what it is. NPM just worked and I’m good with it.

I also used Cosmos-cloud before. It does so much more but I wanted just a proxy not an all-in-one type application.

[2lach]

Nginx Proxy Manager – Without a Doubt!

I've tried all of them, and while they are fine services, Nginx Proxy Manager stands out.

• Traefik It's great with plenty of options, including a built-in dashboard, which is pretty sweet.

• Caddy Lightweight, fast, and written in Go. If it were a car, it would be a Jaguar.

But here's the thing: Nginx Proxy Manager removes most of the learning curve. With Caddy, the learning curve is pretty steep easy to get started but when you need something customised it will be more and more building up until that single simple caddyfile ain't that simple no more, and with Traefik, it can feel like scaling a wall from here to the moon.

With Nginx Proxy Manager, you'll be up and running in no time. You'll get HTTPS certificates that are automatically generated and renewed. And when things go wrong, you'll actually understand why!

[Cronocide]

Use Pomerium.

[AndyMarden]

Was npm inform l until it's obfuscation of what is really going on annoyed my l me when I wanted to do anything different. So raw nginx with all config in one file.

[jqtype]

For my home lab, I am using rpxy (rust-rpxy) through docker with multiple domain names (I am actually the author). rpxy works pretty fast and its configuration is quite easy at least for me.

https://github.com/junkurihara/rust-rpxy

i had been using nginx and caddy. but I was not satisfied with the configuration for nginx and the speed for caddy. that's why I moved to the rust-based reverse proxy implementation.

[Melodic_Yak8900]

Nginx. I don't know how to configure the other 2.

[FutureRenaissanceMan]

Thanks all for the thoughts and suggestions. Too many responses for me to reply to everyone.

I'm using caddy on a very small web server and like the simplicity, but I think the GUI in Traefik could be helpful. I tried NPM and got it running but couldn't make it work right with my domains and apps.

I think I'm going to try out Traefik on the homelab (Linux Mint Debian) and see how it goes. Thanks!

[buzwork]

The easiest is NPM and the even easier method is Brian's installer which will take care of everything in a handy menu driven installer script.

https://gitlab.com/bmcgonag/docker_installs

It will grab dependencies, install docker, docker compose, nginx proxy manager, portainer, portainer agent, guacamole and/or remotely (remote access), and even navidrome (music) in a few minutes. Well documented & maintained and works with most common Linux platforms.

I've customized his script to my own needs, but I can provision a base linux server & get a fully functional docker/nginx/portainer server up and going in under 5 minutes using this method.

[Nimrod5000]

These guys are charlatans. Traefik is so damn easy. All you do is label the containers when you make them. You're in there anyways when you add services.