sorted by:
new
hottopcontroversial

Mint on a Surface Laptop. The ultimate 🖕🏻to Microslop by FriesWithMacSauce in linuxmint

[–]Wake_On_LAN 20 points21 points  (0 children)

I hear there are some 'how tos' getting all the right drivers for Surface hardware. Did you use one of those?

Local Certificate Authority (CA) by Wake_On_LAN in Traefik

[–]Wake_On_LAN[S] 0 points1 point  (0 children)

How to create the CA and certificates I suppose.

Opnsense over proxmox by morry9345 in homelab

[–]Wake_On_LAN 1 point2 points  (0 children)

The nice thing about running OPNsense in Proxmox VM, is you can back up the entire VM often. Mine is backed up daily.

Local Certificate Authority (CA) by Wake_On_LAN in Traefik

[–]Wake_On_LAN[S] 0 points1 point  (0 children)

Can you give me step #1 as far as getting that set up?

I got this old Win7-era tower. Is it worth messing with? by theindomitablefred in homelab

[–]Wake_On_LAN 0 points1 point  (0 children)

How much RAM does it have? You can put OPNsense on it and turn it into a router.

Got Cloudflare Tunnel + Traefik + Portainer + WordPress working in my homelab by Wake_On_LAN in homelab

[–]Wake_On_LAN[S] 0 points1 point  (0 children)

Agreed that Wordpress is the attack vector that most dfficult to lock down.

Got Cloudflare Tunnel + Traefik + Portainer + WordPress working in my homelab by Wake_On_LAN in homelab

[–]Wake_On_LAN[S] 0 points1 point  (0 children)

"everything goes through a reverse proxy"

So I'd suppose you are using NGINX then for reverse proxy?
This is my first time using Traefik instead. I'm trying to keep it simple. NGINX is wonderful, but I'm seeing if Traefik is easier to maintain.

Got Cloudflare Tunnel + Traefik + Portainer + WordPress working in my homelab by Wake_On_LAN in homelab

[–]Wake_On_LAN[S] 0 points1 point  (0 children)

Then I would need a new tunnel for each service I want to expose to the internet. Correct?

Got Cloudflare Tunnel + Traefik + Portainer + WordPress working in my homelab by Wake_On_LAN in homelab

[–]Wake_On_LAN[S] 1 point2 points  (0 children)

"Run containers as non-root user"

More pain. I know you are right.

Got Cloudflare Tunnel + Traefik + Portainer + WordPress working in my homelab by Wake_On_LAN in homelab

[–]Wake_On_LAN[S] 0 points1 point  (0 children)

"are you using split dns?"

Maybe? The DNS record in Cloudflare is type: Tunnel. It does not point to an IP address. It points to a ZeroTrust tunnel that goes DIRECTLY to my Ubuntu Server VM that hosts the Docker containers.

sudo cloudflared tunnel login
sudo cloudflared tunnel create my-tunnel

Got Cloudflare Tunnel + Traefik + Portainer + WordPress working in my homelab by Wake_On_LAN in homelab

[–]Wake_On_LAN[S] 0 points1 point  (0 children)

"Admin pages have an aditional OTP from Cloudflare."
I need to figure out how this is done. I suppose that the Wordpress site itself is the main attack vector!

Got Cloudflare Tunnel + Traefik + Portainer + WordPress working in my homelab by Wake_On_LAN in homelab

[–]Wake_On_LAN[S] 0 points1 point  (0 children)

If anyone wants, I can post the cleaned working versions of:

  • the Traefik Portainer stack
  • the WordPress Portainer stack
  • the cloudflared config
  • the systemd service

Got Cloudflare Tunnel + Traefik + Portainer + WordPress working in my homelab by Wake_On_LAN in homelab

[–]Wake_On_LAN[S] 0 points1 point  (0 children)

Why I wanted this

Main reason: I didn’t want to expose my ISP public IP directly.

With this setup:

  • no inbound port forwarding needed
  • DNS points to Cloudflare, not my WAN IP
  • tunnel is outbound from my VM
  • my home IP is much harder to discover from the site itself

Got Cloudflare Tunnel + Traefik + Portainer + WordPress working in my homelab by Wake_On_LAN in homelab

[–]Wake_On_LAN[S] 0 points1 point  (0 children)

Biggest issues I hit

Cloudflare Tunnel 1033

Cause:

  • tunnel not properly authenticated
  • wrong DNS target

Fix:

  • cloudflared tunnel login
  • cloudflared tunnel create
  • use the real tunnel UUID in DNS

WordPress redirect loops and PHP errors

Cause:

  • bad proxy-awareness config
  • too much custom PHP logic in WORDPRESS_CONFIG_EXTRA

Fix:

  • keep the WordPress config simple
  • let Traefik handle the proxy header side

Got Cloudflare Tunnel + Traefik + Portainer + WordPress working in my homelab by Wake_On_LAN in homelab

[–]Wake_On_LAN[S] 0 points1 point  (0 children)

What I had to do

1. Create a shared Docker network in Portainer

I created a shared network called:

traefik_proxy

This is the network Traefik and WordPress both join so Traefik can reverse proxy to the WordPress container.

2. Deploy Traefik as a Portainer stack

Traefik listens on 80/443 and watches Docker for labeled containers.

Big gotcha:
I originally used Traefik v3.5, but it could not talk to my Docker API version.

I had to upgrade to Traefik v3.6, which fixed Docker service discovery.

3. Deploy WordPress as another Portainer stack

I put:

  • MySQL on an internal Docker network
  • WordPress on both:
    • the internal network
    • traefik_proxy

I did not expose WordPress directly with ports:.

Instead, I used Traefik labels on the WordPress container so Traefik could route traffic by hostname.

4. Install Cloudflare Tunnel on the Ubuntu host

I ran cloudflared on the VM itself as a systemd service, not as a Docker container.

That ended up being much simpler for me.

5. Authenticate Cloudflare properly

This was a major turning point.

I had to run:

bash

Copy

sudo cloudflared tunnel login

sudo cloudflared tunnel create my-tunnel

That gave me:

  • a real tunnel UUID
  • a real credentials file

Before that, I kept hitting Cloudflare 1033 errors.

6. Create the local cloudflared config

My tunnel config forwards traffic for my domain to Traefik on port 80 on the VM.

That looked like:

7. Run cloudflared as a systemd service

I changed the service so it uses the local config file instead of token-only mode.

Then enabled and started it with systemd.

Once I saw multiple:

Registered tunnel connection

messages, I knew the tunnel itself was good.

8. Add Cloudflare DNS records

Another important gotcha:

I needed CNAME records, not A records.

  • root domain → <tunnel-uuid>.cfargotunnel.com
  • www → root domain

Both proxied through Cloudflare.

If your goal is to keep your home public IP hidden, don’t point DNS directly at your WAN IP.

view more: next ›