pi-hole/docs
1
0
Fork 0
mirror of https://github.com/pi-hole/docs.git synced 2024-12-06 19:27:12 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Create traefik-v2-docker.md

Browse Source 
Current docs for Traefik config seem to be for Traefik v1 so I've provided some for v2.

I also have provided 2 scenarios- a) both Traefik and Pi-hole are containers on same Docker host, and b) Traefik is containerized but Pi-hole is remote.

Signed-off-by: William Trelawny <22324745+willman42@users.noreply.github.com>
This commit is contained in:
William Trelawny
2023-05-05 23:30:54 -04:00
committed by yubiuser
parent dd09f23a0b
commit a8e3104ec7
1 changed files with 65 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/guides/webserver/traefik-v2-docker.md
+65
View File
@@ -0,0 +1,65 @@
### Notes & Warnings
- **This is an unsupported configuration created by the community**
- This describes how to use Traefik v2 in a Docker container (via docker-compose.yml) to serve the Pi-hole web admin interface via https and includes a permenent http -> https redirect.
- This does not describe how to proxy DNS or DHCP requests to Pi-hole, which is not recommended.
- For ACME challenges, the Traefik container may need to be able to resolve the desired Pi-hole hostname without relying on Pi-hole to do so. Provide this via the `extra_hosts` parameter in your Traefik container's config in docker-compose.yml if needed.
- For LetsEncrypt to work Traefik must be reachable on port 80 and 443 from the Internet and have `domain.tld` pointed at its external address.
### Basic requirements
1. Have a Traefik v2 Docker container running where it can access port 80 of the Pi-hole server.
1. The following Traefik static config (passed as `command` arguments to the Traefik container in docker-compose.yml):
```
- "--providers.docker=true"
- "--providers.docker.network=traefik-net" # replace with your configured Docker network name
- "--entrypoints.web.address=:80"
- "--entrypoints.web.http.redirections.entrypoint.to=websecure"
- "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
- "--certificatesresolvers.letsencrypt.acme.email=your-email@example.com"
- "--certificatesresolvers.letsencrypt.acme.storage=acme.json"
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
```
3. The next step has 2 scenarios:
- If Pi-hole is running in a container on the same Docker host as Traefik, put the following `labels` in your Pi-hole container's config in docker-compose.yml:
```
- "traefik.http.routers.pihole.rule=Host(`pihole.domain.tld`)"
- "traefik.http.routers.pihole.entrypoints=websecure"
- "traefik.http.routers.pihole.tls=true"
- "traefik.http.routers.pihole.tls.certresolver=letsencrypt"
- "traefik.http.routers.pihole.tls.domains[0].main=pihole.domain.tld"
- "traefik.http.routers.pihole.tls.domains[0].sans=pihole.domain.tld"
- "traefik.http.services.pihole.loadbalancer.server.port=80"
```
- If Pi-hole is running on a different host, you need to provide the Pi-hole (dynamic) config via a `traefik.yml` file to Traefik. This is best done by bind mounting the local directory containing this file to the `/etc/traefik` directory within the container:
```
# Traefik container config:
volumes:
- './traefik/fileproviders:/etc/traefik'
```
```
# traefik.yml dynamic config for Pi-hole:
http:
routers:
pihole:
rule: Host(`pihole.domain.tld`)
entrypoints: websecure
tls:
certresolver: letsencrypt
domains:
- main: pihole.domain.tld
sans:
- pihole.domain.tld
services:
pihole:
loadbalancer:
servers:
- url: "http://pihole.domain.tld/"
```
4. Restart the Traefik and Pi-hole containers, then you should be able to access your pihole via `https://pihole.domain.tld/`