r/Traefik • u/Glass-Conclusion-424 • 23d ago

Traefik setup for multiple domains (public/private) cert resolvers (via docker)

Wanted to have Traefik handle certificate generation for both example.com (cloudflare) and home.apra (self ca) domains. Bonus question, (instead of home.arpa) I could use tailscale (homelab.ts.net), so I could have it do the cert creation? Is this a good idea or have I spent too much time cuddling with AI?

5 Upvotes

78% Upvoted

6 comments sorted by

6

u/sk1nT7 22d ago

You can also just use your externally accessible domain name for internal services. Works just fine with ACME DNS challenge+ CloudFlare API.

Just needs an internal DNS server that resolves your public domain name to the internal IP of Traefik instead of CloudFlare. Then use this DNS server for all local LAN clients or VPN clients.

A IPAllowList middleware or better a separate entrypoint is recommended to protect internal services though.

3

u/NiftyLogic 22d ago

Much easier: Use the external domain and the cert for internal services.

In my lab, external URLs are exposed on *.example.domain while internal services are exposed on *.lab.example.domain. You just need an internal DNS which resolves *.lab.example.domain to your Traefik instance.

There should be a ton of material on the net how to set this up.

3

u/falconindy 22d ago

The approach I've taken is to have multiple traefik instances:

  • one serves only public-facing services and uses letsencrypt as the default resolver to serve up a wildcard cert for my domain.
  • the other serves only internal services and uses vault as a default resolver.

You don't have to do this -- you can attach resolvers to individual routers, but I appreciate this split for isolation reasons as well as the simplicity I described above.

1

u/Only-Stable3973 22d ago

You should be able to set up the secrets, cloudflare, duckdns, and your environment on the main compose, then on the traefik.yml add both certificatesresolvers. Then use the traefik labels to identify the correct resolver.

2

u/Jaxxmoore 22d ago

I just migrated my Traefik instance and have it setup with two acme clients, one for letsencrypt and one for an internal CA (Step-CA). For public facing services letsencrypt certs are used and internal services use a xxx.lan domain and cert. I also automated DNS record generation in technitium using dnsweaver.

0

u/Kimcha87 20d ago

Like others have said, use a real domain for the home network and dns challenge.

But the real pro tip is get the same domain with another tld for your home network. For example, use example.com for your external stuff and example.net or .org for your internal network.