Traefik Reverse Proxy & Secure Infrastructure

This project provides a hardened Traefik-based reverse proxy infrastructure, designed for secure local or remote routing with automated SSL certificates via Cloudflare DNS-01.

Core Features

• Traefik v2.11: Modern reverse proxy with automated TLS.
• Cloudflare DNS-01: Secure ACME challenge for automated SSL certificates (Let's Encrypt), even for local domains.
• Docker Socket Proxy: Security hardening that restricts Traefik's access to the Docker API (read-only, limited scope).
• Secure Dashboard: Traefik dashboard protected by BasicAuth and HTTPS.
• Lefthook Integration: Pre-commit hooks with Gitleaks, Yamllint, and Checkov to ensure security and code quality.

Getting Started

1. Setup: Initialize the directory structure.

   make setup

2. Environment: Configure your credentials in the .env file.

   cp .env.example .env
   # Edit .env with your Cloudflare token and domain

3. Run: Start the infrastructure.

   make up

4. Dashboard: Access your secure dashboard at: https://traefik.your-domain.com/dashboard/ (Trailing slash is mandatory).

Management Commands

• make up: Start the infrastructure in detached mode.
• make status: Check container status.
• make logs: View live logs.
• make lint: Run security and style checks (Lefthook).
• make down: Stop services.
• make clean: Full cleanup (containers and volumes).

Documentation

See the docs/ folder for detailed guides:

• Getting Started
• Command Cheatsheet
• Traefik Configuration Notes
• Troubleshooting