This is an automated archive made by the Lemmit Bot.
The original was posted on /r/selfhosted by /u/Jhaspelia on 2025-12-17 20:57:35+00:00.
Edit: messed up the code junction. Will fix it asap
Hey folks
after years of “it works on my LAN” deployments and 3am outages caused by me, I rebuilt my self-hosted setup with one goal:
Make it boring.
Boring = predictable routing, consistent auth, sane backups, and a clean way to add new apps without breaking old ones.
This is what I landed on (single node, but structured so I can grow to 2–3 nodes later).
Goals
One reverse proxy config style for everything
SSO/2FA for anything exposed (even “harmless” dashboards)
Automated brute-force mitigation without me babysitting logs
Backups that don’t rely on “I’ll remember next week”
“Add a new service” should be 5–10 mins max
Stack overview
Docker (compose) for services
Traefik for reverse proxy + automatic TLS
Authelia for SSO + 2FA (forwardAuth)
CrowdSec for bouncer-based protection (Traefik bouncer)
Grafana + Prometheus + Loki for basic observability
Restic for backups (to remote storage)
Watchtower only for patch updates on a shortlist (not everything)
Everything lives in a single repo with:
/core (traefik, authelia, crowdsec, monitoring)
/apps (each app gets its own compose file)
/scripts (backup + restore + bootstrap helpers)
What made the biggest difference
- A “default deny” pattern for exposure
Anything not explicitly labeled for Traefik is not reachable.
No ports: on app containers unless truly required
Internal networks for service-to-service traffic
Only Traefik binds to 80/443
- ForwardAuth everywhere
Even internal-only services get Authelia. It’s less about paranoia and more about consistency. If I later expose something, I’m not retrofitting auth.
- Logs/metrics are just enough
I don’t need enterprise APM at home. But I do need:
“What changed?”
“Why is it slow?”
“What’s consuming disk/ram?”
Core compose (trimmed but functional)
core/traefik/docker-compose.yml
version: "3.9"
networks:
proxy:
external: true
services:
traefik:
image: traefik:v3.1
container_name: traefik
restart: unless-stopped
networks:
- proxy
ports:
- "80:80"
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./traefik.yml:/etc/traefik/traefik.yml:ro
- ./dynamic.yml:/etc/traefik/dynamic.yml:ro
- ./acme:/acme
- ./logs:/logs
environment:
- TZ=Europe/Istanbul
core/traefik/traefik.yml
api:
dashboard: true
entryPoints:
web:
address: ":80"
http:
redirections:
entryPoint:
to: websecure
scheme: https
websecure:
address: ":443"
providers:
docker:
exposedByDefault: false
file:
filename: /etc/traefik/dynamic.yml
certificatesResolvers:
letsencrypt:
acme:
email: you@example.com
storage: /acme/acme.json
httpChallenge:
entryPoint: web
log:
level: INFO
accessLog:
filePath: "/logs/access.log"
core/traefik/dynamic.yml (Authelia forwardAuth middleware)
http:
middlewares:
authelia:
forwardAuth:
address: "http://authelia:9091/api/verify?rdhttps://auth.example.com/"
trustForwardHeader: true
authResponseHeaders:
- Remote-User
- Remote-Groups
- Remote-Name
- Remote-Email
Example app (everything looks the same)
apps/whoami/docker-compose.yml
version: "3.9"
networks:
proxy:
external: true
services:
whoami:
image: traefik/whoami
restart: unless-stopped
networks:
- proxy
labels:
- "traefik.enable=true"
- "traefik.http.routers.whoami.rule=Host(
whoami.example.com)"
- "traefik.http.routers.whoami.entrypoints=websecure"
- "traefik.http.routers.whoami.tls.certresolver=letsencrypt"
- "traefik.http.routers.whoami.middlewares=authelia@file"
That label pattern is now copy/paste for any service:
Router rule
TLS resolver
Authelia middleware
CrowdSec + Traefik bouncer (quick notes)
CrowdSec reads Traefik access logs
Bouncer blocks at the proxy level before the app sees traffic
Biggest win: I stopped writing my own half-baked fail2ban rules for container logs
If you’re doing this, the key is making sure Traefik logs include real client IPs (and you’re not behind some weird double NAT / CDN config without setting forwarded headers correctly).
Backups (Restic)
I back up:
Compose files + secrets (encrypted at rest)
App data volumes (for apps that store state)
Traefik ACME json (because reissuing certs on disaster day is annoying)
Daily automated backups + weekly prune. The most important part: I wrote a restore checklist and tested it once. That alone felt like leveling up.
Lessons learned / gotchas
Don’t auto-update everything.
Watchtower only touches a “safe list” (Prometheus node exporter, some stateless things). Databases and core auth are manual.
Keep auth/SSO separate from apps.
If Authelia is down, I can still SSH and fix things but most apps remain protected by default.
Name your networks intentionally.
“proxy” network is the only place where routing happens.
Stop exposing random ports.
You almost never need -p 3000:3000 if Traefik exists.
Question for the hive mind
If you’ve done a similar “make it boring” rebuild:
What’s your preferred approach for secrets (sops, docker secrets, vault, …) in a homelab?
Any opinionated alternatives to Authelia that you’ve found simpler (or more robust) for a small setup?
