Best for Homelab? Traefik vs Nginx Proxy Manager

I've searched a long time for the best reverse proxy for my Home Lab. In this video, I'll explain which one I'm using in my setup, how I'm doing it, and why I'm doing it. We will discuss some details about Traefik and the Nginx Proxy Manager to find the perfect reverse proxy for your Home Server Projects. #Traefik #NginxProxyManager #HomeLab
Traefik on Docker: • Is this the BEST Rever...
Traefik on K8S: • How to use Traefik as ...
GitHub Docu: github.com/christianlempa/boi...
CIVO-*: civo.com/thedigitallife
Follow me:
TWITTER: / christianlempa
INSTAGRAM: / christianlempa
DISCORD: / discord
GITHUB: github.com/christianlempa
PATREON: / christianlempa
MY EQUIPMENT: kit.co/christianlempa
Timestamps:
00:00 - Introduction
01:01 - Why use a Reverse Proxy in Home Lab?
03:15 - Advanced Features of Traefik
05:21 - What I'm running right now
07:28 - Advertisement-*
08:22 - Direct Comparison
11:55 - Conclusion
________________
All links with "*" are affiliate links.

[@FireBean8504]

As a long time Traefik user and the first R-Proxy I ever learned on... NGINX Proxy Manager HANDS DOWN for at home. I have incorporated it at my place of work as well. It's fantastic and when you get support for it, they will help with making sure NPM is doing stuff securely.

[@Dorff_Meister]

I just migrated from doing reverse proxy with HAProxy to using nginx proxy manager (using the provided GUI in my Netgate/pfsense router). I'm doing a lot of docker (with compose) but no Kube (no interest). After watching this, I'm glad I chose NPM vs Traefik - I'm really liking NPM.

[@GadgeteerZA]

Thanks been watching many of your other videos, but now that I started thinking about Traefik or Traefik Hub, I saw this older video. But just wanted to say with NPM what had been helping me was using a wildcard cert, and pointing to container names versus using container IP addresses. The latter allows the external ports to stay closed, and NPM always finds the containers, no matter if their IP addresses change this made my life way easier, and also prevented docker containers punching open the firewall ports automatically when creating new containers.

[@Ripstikerpro]

As an intermediate, I've been looking all around for a good explanation on how to properly use reverse proxies and how to set them up and all that. This video has been great for that!!

[@parispumal4719]

You explain complex topics so well, I'm a beginner and I actually understand concepts so much better from watching your videos. Thank you

[@christianlempa]

Thank you, that makes me so happy it's helping you! :)

[@mikkel3135]

Personally loving Traefik. When you know how it works, it's insanely fast to get a new service up. I already copy from one of my other stacks/docker compose files, so I simply need to change the labels to the new subdomain and I'd basically be good to go.

[@christianlempa]

Fully agree with you!

[@karserasl]

I totally agree. It took me a few days of experimenting, but after setup, its extremely easy to do things. For ex. Its very easy to create chains for different setup, like having one with Authelia and one for Google Oauth and another with no auth. Adding one domain for external and one subdomain for locals with its own cert. Passing headers or bypass auth if for ex, an API header is present etc.

[@CHK]

I also totally agree with you, plus you can store all your configurations in your own repository. It's fantastic!! that means you can make gitops and have a perfect definition of your homelab or production environment and, well, sleep soundly like a baby at night xD

[@adzcraig]

This is a great overview of the products and helped me decide to go with NGINX for now as I want something quick for self hosting set up. I'm planning to dabble with docker and container automation later so will take a look a traefik at that point.

[@christianlempa]

Thank you! ;) Good decision to start with btw

[@majorgear1021]

Agreed. I don’t need orchestration for my home lab. I only have one of each app and once they are deployed, I don’t change them. Once and done!

[@andreacazzaniga8488]

I would suggest beginners to start with nginx and make it work. Then, if the project grows and needs increase, consider switching to traefik

[@christianlempa]

Yep, makes sense to me ;)

[@Glatze603]

Hi Christian, great video and content! Thanks very much! For me / my homelab NPM (with Authelia!) is the simplest and best choice, like you mentioned it :-) I like it when things are simple and functional (like NPM in combination with authelia for additional 2fa), I like it when my homelab-stuff is very secure (dmz-firewall-concept with opnsense and sophos xg) and I like to automate everything (ansible, scripts...) - that's why I have and love my homelab and that's the reason why I change things often :-) I am looking forward to your server-rack videos.

[@christianlempa]

Thank you so much :) Can you send me a DM how you're doing NPM with Authelia (if you are okay with your stuff ending up in a video)? It's a topic I wanted to look at anyway.

[@Glatze603]

@@christianlempa No problem, but actually I have to use mail. Take a look 🙂

[@afrosheenix]

@@christianlempa did you get this information? I have it done with single and 2fa now, I can explain it now.

[@ThePapanoob]

Hi Christian! I can only recommend the absolute standard cert-manager & nginx-ingress stack (with some ingressdefinitions routing it to the backend services) :D its a bit "harder" to setup however its really damn simple in the sense that you always know why stuff is doing what it does. theres no magic going on in the background

[@Tech-wq2fi]

Do you have any good resources that can accomplish that? Would love to learn more about that, if not could you point me to the right direction where should i be looking?

[@christianlempa]

Oh boy, cert-manager is on my list! That's a great suggestion :) I probably will look at combining it with traefik though.

[@dyegoe]

Hi! Like you, I am not looking to self-host but to learn. With that in mind, I am currently running my Kubernetes with Cilium CNI and using its own Ingress controller. I will be changing it to the API Gateway in the near future. As I read, the new API gateway controller from Kubernetes solves many gaps in the ingress controller

[@alanjrobertson]

Great video. I've only just got into this a few weeks ago and TBH really liking NPM so far so will probably stick with it for now for my simple needs. BTW looks like a really nice bash prompt you've got and looks like you're using Windows Terminal too - would you mind letting me know which font and prompt customisation you're using? I like Caskaydia from Nerd Fonts but finding only some of the icons are showing up with it.

[@stevendonaldson1216]

Great clarifications for the different situations. I thought the extra comments on the differences was helpful. I need to look at nginx for reverse proxy for my home-lab hosted ideas. One more thing to learn

[@christianlempa]

Glad it was helpful!

[@michaelgraff6978]

I use Traefik for my Kubernetes cluster, and nginx for my Docker hosts. Both have a wildcard SSL cert for the part of the namespace they control. I also have my Docker host in a colo, while the Kubernetes is at home, and consists of lower end PCs and Raspberry Pis. It's "interesting" mixing architectures in the same cluster...

[@Movies4118]

I switched from Swag (Formerly known as LE Proxy) to Nginx Proxy Manager. It was a natural progression , since both are built on top of Nginx. I found Traefik to be overly complicated for my self-hosting needs.

[@christianlempa]

Nothing against NPM, it's awesome! :)

[@andreacazzaniga8488]

Same here

[@afrosheenix]

I'm looking at Traefik because NPM seems to be aging, maybe nothing under the hood needs to change and it is finished. However, combined with Authelia, doing 2 factor auth with a single edit to a file, it is like simple magic.

[@RahulKumar-hq6wm]

Thank you bro for making such informative videos 🔥 love you ❤️

[@christianlempa]

Glad you like them!

[@alexanderos8209]

I agree with your conclusion that traefik is a bit more comlicated, less well documented but more powerful. But you forgot one for me crucial point: Traefik configuration files (if yml is used) integrate realy well with ansible. You can generate "static" configuration files with ansible and put it in a folder to be loaded dynamically. It sounds a bit comlicated (and is) but allows to directly expose all services via Trafic and not just docker. For this reason alone I switched to Traefik as my reverse proxy BTW: I am looking forward to seeing your infrastructure.

[@christianlempa]

That's an interesting point I haven't thought about. But I'll look into that, homelab automation is a big topic for me in 2022.

[@s1nghsays]

@christianlempa What is the container management app/dashboard you use, featured at 01:39 ? is it Portainer (with a not default theme) ?

[@jonathanvargas9693]

I prefer traefik but I have had problem on deploying docker containers on elastic beanstalk. Due to AWS healthy check due to logs format so I had been forced to use nginx in that case

[@MrPDC-jr5yl]

Amazing Christian. Can you please create a detailed tutorial for SWAG setup? Docker and multiple websites and services setup with domain and cloudflare. Very confusing documentation :). Thanks

[@nurlanturganaliev3375]

I am happy that watching your new posted tutorial one of the first people (after 1 hour it is posted). Grammatically might be not correct but you should get the point. Sorry for my weak english.

[@christianlempa]

Hey thank you so much! Greatly appreciated :)

[@scubeedu2]

Hey Christian! Just a quick question about your preferences while securing your homelab. NPM and others like it work really well, and only having to have port 80/443 open is great. Question is, do you use Cloudflare tunnels at all so that you don't have to have any ports open at all? I have NPM running, but when used with CF tunnels, appears unusable and trying to auto-update Letsencrypt certs doesn't work. What do you do or recommend to keep the nasties away?

[@christianlempa]

I would only expose as much as you need in your home network. Maybe adding a firewall at some point might be a good idea. As for my home lab, I don't expose any ports publicly, I use a VPN or teleport to "dial" into my servers from outside.

[@scubeedu2]

@@christianlempa ok thanks for the info. Using tunnels, I felt like I was limiting myself, but protecting my homelab by having all ports closed is the most secure. You make terrific videos Christain - glad to hear that you are taking the proper amount of time for yourself and your famil!!!

[@uuu12343]

Hi Christian! May I ask, how do you decide what motherboard and cpu to get for your servers? And do you have any budget Motherboards to recommend for either beginners or perhaps on the cheaper options?

[@christianlempa]

You can find the hardware I’m using on my kit.co/ChristianLempa page

[@chrisumali9841]

Thanks for the info and demo. I use NPM with Authelia so far so good

[@christianlempa]

Oh that's cool! How are you doing this? Can you send me a DM on discord? ;)

[@Tekgnome.]

I've been running NGINX reverse proxy manager with Fail2Ban with cloudflare and it's been fantastic 😀

[@christianlempa]

Very nice!

[@carl_thunder]

I’m sticking with NPM. I tried running traefik and got it running but couldn’t figure out how to get it to work with multi domains so I went back to NPM and haven’t thought about traefik since.

[@heliwrsfoestuff5913]

have you tried Caddy instead of NPM or Traefik

[@wtfmrkratos]

I use HAProxy, and it's configured with context path routing, but i'm thinkng of trying out traefik with the whole subdomain routing.

[@christianlempa]

Interesting, tell us how that went for you ;)

[@carstenr.1682]

I started with NGINX Proxy Manager, but the annoying part was the change of ACLs, this results in a reconfiguration all linked entries/hosts. I'm now using Traefik for 9 month and I'm really happy with Traefik. Big thanks to Techno Tim for his HowTo. Authelia is also integrated very easily.

[@TabakMan]

Hi, I am using Nginx proxy manager in my home lab and Nginx Ingress Controller in Kubernetes. I have never used Traefik and probably idea for future video - Nginx VS Traefik as Ingress controllers in Kubernetes

[@christianlempa]

Hmmm I'll think about it! Thanks ;)

[@timderks5960]

6:00 You mention uploading the self-signed certs to the trusted CA store of all of your clients. Have you done this manually on each device, or is there an easier way that I'm unaware of?

[@christianlempa]

You can Script it in Windows and Linux, in AD networks you can also do this with GPO, but for mobile devices I haven't found an automated way unfortunately

[@knowledgeispower17]

For most people Nginx is a way to go, easy to setup and mantain. On the other hand most people doesnt even now what is a reverse proxy. :D

[@sidneyking11]

I am having to travel abroad and want to be able to access my jellyfin that in running in docker on a proxmox server. Any suggesting on how access jellyfin remotely and make it secure? I am stuck and really could use some help before I have to travel.

[@dadooron6247]

Ich habe mir auch die Frage gestellt, was ich eigentlich benötige. Nach 5 Jahren mit Traefik bin ich vor 2 Jahren zu NPM gewechselt und habe seitdem mehr Zeit für wichtige Sachen. Das Hinzufügen neuer Hosts ist ein Kinderspiel. Selbst mit eingespielter Traefik-Routine bin ich mit NPM immer schneller fertig. Aber wie Du schon sagst - - Anwendungsabhängig.

[@alejandroburbano6085]

Hello, i followed your tutorial and it was easy to configure my container and port forwarding. But when i tried to install my custom ssl certificate, traefik doesn't recognize it

[@krishnachaitanya4822]

What terminal are you using in your desktop? It looks cool!. If somebody knows an answer to this, please reply.

[@christianlempa]

Just made a video about it: kzbin.info/www/bejne/d3yVe3hojth-qtE

[@OfficialChiller]

Ich nutz auch ehr Traefik für mein HomeLab, ist auch recht einfach muss man sagen. Wobei ich mich auch nicht scheue andere/neue Sachen anzuschauen. Aber ich hab eine "interessante" Konstellation, neben Proxmox betreibe ich meine eigene OPNsense und gerade für den Bereich "WebServer" musste Traefik zum Einsatz kommen da bei einigen Containern die Zertifikatseinbindung nicht ganz funktionierte also wollte ich, bzw. war ich gezwungen auf ein Reverse-Proxy zurückgreifen.

[@Airbag888]

You should definitely make a / some videos on traefik setup and administration :)

[@christianlempa]

Good idea, I think there will be more traefik stuff in the future ;)

[@yashinshekh802]

you are a geek ... amazing video

[@nalle475]

I used to run HA on pfSense but now i don ‘t hava pfS anymore. Trying Nginx for some time, to much manual stuff. Switch to NPM (found out its actually a modified OpenResty) and added Authelia, fantastic combo. Easy to use still after being away for almost 2 months. Now my homelab has grown and I tinkering with Traefik and HA. Will I switch, yes. Which one, the one I used or the new one? Traefik will give me more of a learning experience, so I think it’s Traefik.

[@christianlempa]

Sounds great! Have you considered using a firewall together with Traefik?

[@nalle475]

@@christianlempa my servers and vm’s have firewalls and fail2ban/CrowdSec. Considering to go with a tunnel from Cloudflare then there is no open ports and no ip shown

[@christianlempa]

Solid setup!

[@cheebadigga4092]

Cloudflare + NPM as Kubernetes deployment. Guess I'm the underdog now! :D

[@christianlempa]

Haha well yeah on Kubernetes probably :D

[@KR1ML0N]

i was really thinking the same thing the other day.

[@christianlempa]

that's funny ;)

[@paneesh]

1:40 what is the web interface/admin panel used here?

[@afnannr1249]

Hey, i want to config HA of NPM(1 master NPM and 1 backup NPM) , is that possible? and how?

[@giovannipetroselli6103]

Hi Cristian, it is possible to implement SSO with Authelia and ngnix or Traefik? I've configured Authelia to land in another site with login page. How can pass one time credential to enter directly to site without relogin? Thanks

[@Glatze603]

That's not what you implement with authelia. Authelia only offers additional authentification-options. The benefit of authelia is, that the first authentification (username/password) is only necessary once, if you want to access multiple apps behind authelia/npm.

[@giovannipetroselli6103]

@@Glatze603 Ok Markus Thanks. Is there some apps that permits this? Thanks!!

[@Glatze603]

@@giovannipetroselli6103 Hi, I don't think so because if your app needs authentication, authelia does not know it. If your app has no authentication, you only need to authenticate in authelia (1 or 2 factor). You see with authelia you can activate 2fa for apps, that has no authentication by default. If you use bitwarden (or vaultwarden) you have minimal work to use complex usernames and passwords, so SSO is not really necessary.

[@bthegawd8113]

Ngnix proxy manager is what I use in my homelab.

[@christianlempa]

That's greate man :)

[@joanandestin4201]

Hi I have not been able to get traefik to work. I keep getting this error "level=error msg="Unable to obtain ACME certificate for domains" I am not sure if it is because I am using nginx proxy manager and with the same domain and wildcard. I am not sure what I am doing wrong. Can you assist?

[@christianlempa]

Check out our Discord for help, maybe we'll able to help you

[@camaycama7479]

HA proxy is pretty good also, good load balancer too

[@christianlempa]

I'll take a look 😀 thanks

[@LucianoEvaristoGuerche]

Do you have any video showing how to configure TCP and UDP routing (Minecraft and Minecraft Bedrock)?

[@christianlempa]

No sorry

[@MetalisForever666]

My Nginx Proxy Manager doesn't refresh the Let's Encrypt certificates. I had to do it manually.

[@tesses50]

for me I prefer vanila nginx (don't know how to have static pages with nginx proxy manager) (I do proxy services too but I like regular nginx better)

[@heinzbroehl4598]

Why not try Caddy 2. Very easy to use and to setup

[@christianlempa]

Hm no idea, maybe I need to try it 😉

[@testes2390]

I just installed Caddy 2, I read on their forum that instructions for setting up DNS challenge changed, so I am looking to NPM and Traefik now, maybe Caddy 2 needs more maturity?

[@valizeth4073]

Given how much troubles I've had with nginx and proxy manager I'm probably gonna switch. One power outage and nginx just refused to work again

[@elalemanpaisa]

Interesting, I use nginx (not nginx proxy manager) to also serve static files .. config for reverse proxy is dead simple .. like 2 lines in the config file .. sure in k8s you might want something automated yet I was working with dns entries so far.

[@TheNERDad]

Hallo! Fail2Ban und Nginx Proxy Manager schon mal zusammen vernetzt?

[@gdevelek]

Great overview video, yet the music is too loud and distracting.

[@christianlempa]

Thanks :) Sorry for the music :P

[@sirjenkins7442]

I have some basic knowledge of IT and dabble in homeserver for a few services so NPM is more than enough for me.

[@marchagen3893]

Treafik in a cluster is a bitch, but once figured out how to takle that issue it works great.! I've a 3 Node Swarm cluster with 3 traefik instances that self load balance :D Do i need it ? No. But it was a great experience to learn how to do it. Small edit: No no etcd or sync stuff just proxy the docker-socket over all nodes with a docker network and attach it to traefik

[@christianlempa]

Fully agree with you! Cool setup btw :D

[@maxleon1721]

What about Caddy?

[@mayurchavhan8590]

I'm fan of automation and everything needs to be IaaC for me, Traefik is way to go. If NPM comes with CLI or YAML configuration for more flexibility, i would definitely use it !!

[@christianlempa]

Absolutely!

[@kaspersergej]

What makes in your opinion nginx less "professional" than traefik? Traefik and nginx are in two different product categories with overlapping functionality.

[@christianlempa]

You clearly misunderstood something in the video, I didn't say that.

[@kaspersergej]

@@christianlempa I’m referring to 8:25

[@testes2390]

I was trying to test Traefik, but when I tried to run it as a system service(to not use docker) and trying to set up DNS challenge, I could not find any documentation related. So after some hours I gave up, then I tried Caddy 2, and wow, like in 5 minutes, I had everything smoothly running

[@christianlempa]

Caddy seems nice

[@Atchalong]

Caddy is awesome! I've used it for a few years and it makes the entire reverse proxy process stupid easy.

[@yashpokharel9628]

Please create a video for Self Signed SSL, Also, with teleport 8, I m unable to add node servers because of this.

[@christianlempa]

Already planned ;)

[@qfrimaa]

honey digital life video just dropped

[@christianlempa]

:D

[@podroznik2214]

Can you use nginx with web app on another host?

[@christianlempa]

Yes

[@neuro5261]

Am curious about a comparison betwen Traefik Community Edition and NGINX, and between Traefik Enterprise Edition and NGINX. I wonder if Traefik Community Edition has all of the features that NGINX has and more pretty much.

[@mafricimangmailaccount6611]

Can someone please help me understand whether I should be using reverse proxy or VPN for remote access? Both seem to be secure however VPN will encrypt me traffic also. I don't understand VPN well enough to know how it works when accessing different services within the same network similar to how reverse proxy works. Likewise, I don't know enough about reverse proxies to know how secure it is compared to VPN. TIA!

[@christianlempa]

Use a Reverse Proxy when you want to make web applications accessible, use a VPN if you want to secure the access to your internal/remote networks.

[@mafricimangmailaccount6611]

@@christianlempa can you use both to have secure remote access to the services?

[@_TbT_]

@@mafricimangmailaccount6611 With SSL (one of the functions of the reverse proxy) you secure the transport of data, with VPN the access to resources.

[@mafricimangmailaccount6611]

@@_TbT_ Aha! Thank you 😁

[@danielstellmon5330]

A self hosted VPN is for securely connecting to your home network from out side said network. Reverse proxy is for when you have multiple services on the same box and don't want to memorize port numbers for each service. There is a lot more to it, but that is a simple place to start.

[@RK-ly5qj]

For me NPM was better to implement, it has a gui. So i made less mistakes instead of struggling with CLI.

[@famshahgeldyan4990]

Why no caddy? I dont get it.

[@christianlempa]

Haven't used it ;)

[@famshahgeldyan4990]

@@christianlempa oh but then you definitely should try it out 😁, I mean, after having used apache/nginx/traefik/netscalers/etc... I just fell in love with caddy webserver. Secure by design, auto letsencrypt, clustered shared ssl certs, load balancing of anything downstream and much more. With 1 line in the config you have a ssl terminator with letsencrypt and load balanced backend reverse proxy.

[@damienbutt6320]

HAProxy is far superior in my opinion. I don’t understand why it doesn’t get more love.

[@christianlempa]

I will take a look at it at some point ;)

[@damienbutt6320]

@@christianlempa it doesn’t have a fancy front end like the others. Everything is done through a config file but it’s quite simple. Lightweight but really powerful.

[@PanduPoluan]

Hear, hear! HAProxy is a venerable reverse proxy, tested for decades. It's really my go-to for reverse proxy.

[@ddh756]

seems like neither support ocsp stapling

[@squirrel_ca9745]

I’m running unRAID with nginx and swag

[@vino9587]

hello sir, I have one question, can NPM run container that have multiple port ?, For example : container A: and container B: Thanks.

[@christianlempa]

Yes, because you don't need to expose the container's port publicly.

[@kurt_hansen]

@@christianlempa But what is, if i need the port, e.g. for influxdb i need the port in my application from where i connect to influx. So, i want to use my ssl domain name in addition with a port, is that possible with npm?

[@DeceLatina]

I use apache for proxying

[@christianlempa]

Also nice!

[@altra8911]

Traefik has cute platypus

[@MrSnyaify]

Traefik

[@christianlempa]

Thank you mate! :)

[@shetuamin]

I use Apache. But now i am looking traefik container.

[@christianlempa]

Nice

[@zyntax81]

swag :)

[@christianlempa]

Oh that's also great :)

[@marcello4258]

Poorly documented.. thanks that is all I need to hear. To me, if the software is doing something what I cannot find in the docs (or vice versa) it is a bug nothing else.

[@christianlempa]

Well it's not that you can't find it. It's just confusing where to find it 🤣

[@marcello4258]

@@christianlempa it should come with the software or at least should point where to find the documentation

[@evertythingtechrelated9715]

I think Traefik needs a GUI editor.

[@christianlempa]

Nah, it's fine without, that would make things even more complicated :D

[@elalemanpaisa]

You often talk about gaining more knowledge.. wondering why I have never seen any freebsd or openbsd server which def have a place

[@MarkConstable]

FWIW please don't use background music during the main part of your video tutorial (intro, outro is fine). It makes it unreasonable to speed up the video. Even x1.25 is unacceptable.

[@christianlempa]

Ah, I still like it ;)

[@MarkConstable]

@@christianlempa Well, I can't stand it, so I have no choice except to unsubscribe.

[@UzairAli001]

Even though Traefik has more control over reverse proxy, for most of the users NPM is more than enough

[@christianlempa]

It's not always about "what is enough", but also what you're interested in learning

[@famousartguymeme]

my nginx breaks after every reboot

[@tcasex]

sounds about right

[@nezu_cc]

I don't agree with you saying that treafik is poorly documented. In my opinion, the docs have everything you need and the search function works well enough. It might not be "idiot proof" but I consider that to be a good thing. No extra garbage, just values and descriptions of what they do. Everyone's setup is different so trying to make a universal how2 guide is pointless bloat IMO. I personally really like the "here are all the available options, now go build something with it" approach.

[@christianlempa]

Good documentation for me is that it's idiot proof. When I read docs and often don't understand where to look for and find things, that's not a good sign.

[@testes2390]

@@christianlempa Like DigitalOcean tutorials, they are simply amazing! thanks man for your great tutorials BTW

[@NoobSaibot0xFF]

your background music makes me agressive

[@318rbs]

F5 and cloudflare 😅

[@damienbenz]

Well, i'm glad someone agrees that Traefik's documentation is s***. I spent countless hours just testing various approaches and guessing values and structure because there is simply NO documentation. And i tried to find how much does Traefik support actually cost. Not gonna say how much, i just say that 90% of small - mid businesses will not afford that. So i pour another coffee and back to testing various approaches again.

[@christianlempa]

Haha yeah I can totally relate to that ;)

[@DDlol01]

So I want to rant about traefik: I hate it. I use files over labels, because labels take about 20 to 30 seconds to spin up, while the file is done before labels even are done parsing. The commandline options are just ... useless and way worse documented or have (undocumented) side-effects (have fun reading code if you want to figure this stuff out!). Labels and files are somewhat equivalent: labels get turned into "files" (streams). I prefer yaml over toml, but anybody thinking anyone is better over the other doesn't know its just aesthetics (someone begged me to send him toml instead of yaml, i just used an online converter lel). Debug info in traefik is pretty much non existent. `debug: true` yeah... nah, does not do anything except slowing down your traffic and sometimes even bugging it lel. You will not get useful information: - Why it is ignoring your certificates - Why it will just not connect to the service associated by `HostSNI` (with ssl passthrough, cuz the server has certificate level authentication) - why does it connect to a completely different service, just because they are on the same ip (as seen form the outside world) but wildly different HostNames - Why does it pretend dynamic.yaml does not exist EXCEPT FOR A SINGLE RULE It will not even tell you that a connection was closed, simply because the service killed the upstream right before it was assigned and before it was acknowledged as dead (nginx handles this?) I like the web ui of traefik, it is very informative, but i will invest my time and source code to nginx-proxy-manager. I guess it could replace traefik with a few tweaks. ssl_preread is required for my application... not yet supported (properly) by either. P.S.: Why is the logging and verbosity of traefik _so_ _frickin_ *bad* ?

[@JediaelOliveira]

HA Proxy with pfSense CE!!!!!

[@christianlempa]

Hmm need to try that 😉

[@Darkhan9]

Nothing beats nginx (not nginx proxy manager but the oldschool nginx proxy).

[@anantmishra6783]

the bg music is too much bro .. dial it down ffs!!

[@christianlempa]

!!

[@IdAefixBE]

"Nginx is a small open source project that only runs in Docker while Traefik is a cloud native application proxy". Do your research before you say such non-sense. I was using (natively installed) nginx years before docker was even a thing, it never was nor will be a "docker only" thing.

[@christianlempa]

It’s not about nginx, but nginx proxy manager

[@fretbuzzly]

It'd be much easier to hear and understand you without the annoying background music. It's like trying to have a conversation with someone while turning on the radio. Ridiculous.

[@munroegarrett]

I am wrestling with this right now! Please address keepalived with these solutions.

[@christianlempa]

Hmm I hope it helped you though I didn't covered keepalived, yet :P

[@munroegarrett]

@@christianlempa It confirmed that I made the correct decision. My concern is SPOF. keepalived can help with that but the idea of having one instance on standby seems wasteful to me. I also want to load balance between two data centres so an AWS outage doesn't take down my system.

[@munroegarrett]

@@christianlempa It would also be nice if you covered Ansible and Terraform.

[@mikkel3135]

@@munroegarrett If you are concerned about SPOF you can't help but be a bit wasteful. But it would be quite easy for you to put keepalived in front of something like Nginx Proxy Manager or Traefik, since that's the main point of using keepalived. I think the hardest thing is the initial traffic coming in, since you either need an actual load balancer from your cloud provider instead, or have a "dumb" box that gets the WAN traffic and just sends it off (basically acting as the load balancer anyway). Otherwise you'd need a way to quickly switch the WAN as well (floating IP maybe ;) ).

[@SpookyLurker]

What about Caddy?

[@christianlempa]

Haven't used it, yet

[@helloworld8136]

I’m using caddy 2, it’s so easy to configure I don’t know why it’s not used more often. Makes me wonder if there’s something wrong with caddy that I’m not aware of.

[@KR1ML0N]

Should create a video on caddy

[@morganpittkin6867]

Yeah for realzies. Nginx for high performance at the expense of usability (although NPM helps), Traefik for that tasty integration with K8s/Docker, and Caddy seems perfect for home-labbers who like to tinker. It’s flexible and easy to configure, you can compile your own into a single binary with whatever plugins you want (which I hear tell are easy to write if you’re into that s$&t), plenty performant for home lab purposes, and being written in Go you get a code base that any old schmuck can understand and audit, as well as the safety/security features of the language and runtime. It’s right in the sweet spot!

[@majorgear1021]

Nah.