Hacker News Reader

Comment by Jnr | Hacker News Reader

I run some (20+) services using docker compose on my home server, and Traefik is great.

Cloudflare manages my domain and it allows Traefik to get letsencrypt certificates even for internal services not exposed to the outside world.

I also have multiple Traefik entrypoints for internal and external services. And cloudflared tunnel container set up to manage access to the public resources.

Then on the home router level I set/override DNS entries for internal services so they would connect directly to Traefik, instead of going through Cloudflare.

Incredibly these Cloudflare services cost exactly 0$ for now.

But I do not use compose overrides, don't really see the benefits.

View on HN

I recently realized the value of Traefik, been avoiding learning about it for years because I'm a skeptic about new stuff.

But the first thing that struck me was "ok, cool auto-discovery", and then "wait, it needs access to all my containers?".

Maybe I'm from the old school but we used to separate services into their own service users so that if one service falls it can't take others with it as easy.

Now we just accept that all services are under the same user because we use containerization. Well I'm still separating them so I really can't take advantage of the amazing auto-discovery.

Seems like Docker doesn't support fine grained permissions out of the box, but it should be possible to write a proxy for docker unix socket so it would limit what information gets shared and what commands are available.

This way it would allow the use of Traefik and similar services which depend on reading/writing labels while severely minimizing attack surface.

EDIT: Found this on Github https://github.com/Tecnativa/docker-socket-proxy

I thought that the Cloudflare tunnel was the very expensive pay-per-gb "argo route". Really nice to know that they offer a simple and free reverse proxy, thanks!

They made it free a couple years ago and rebranded as Cloudflare Tunnel. Currently an excellent free option though technically you're not supposed to use it for anything other than basic HTML sites.

I recently set it up with a variety of apps (frontend/backend) behind it. Where did you see it should only be a basic html app? Don't recall reading that in their documentation.

I just did a bit of research. They updated[0] their ToS a while back. At the time I asked[1] if people thought this change would apply to tunnels. Based on the answer to that I would say it's no longer prohibited, which is great.

See also this interaction I had with Cloudlfare's CEO a couple years ago on this topic: https://news.ycombinator.com/item?id=30285554

[0]: https://blog.cloudflare.com/updated-tos/

[1]: https://news.ycombinator.com/item?id=35963143

Just looked up and the Argo thing still exists and the pricing looks the same, couldn't find anything related to basic HTML sites on tunnel, though.

"it allows Traefik to get letsencrypt certificates even for internal services not exposed to the outside world"

But something has to be exposed to get these certs to the internal services?

You don't have to expose any ports. It uses ACME DNS challenge, which is supported by Cloudflare and other large nameserver providers. https://doc.traefik.io/traefik/https/acme/#dnschallenge

you can also use your home router to do this if you run something like OPNSense (there is also pfsense but that uses a much older freebsd kernel that does not support newer NICs)

As per the article I guess the benefit is specifically for managing compose files across teams through git.

Reply on news.ycombinator.com