Reverse Proxy and Automatic TLS for Homelabs

What a reverse proxy actually solves

One place to terminate TLS, map hostnames to containers, set headers/rate limits, and avoid publishing every app port to the WAN. Exposing each container with its own cert multiplies failure modes.

HTTP → HTTPS and domain routing

Clients hit `https://app.example.com`; the proxy forwards to an internal upstream. Use real DNS names. Separate admin hostnames from public ones when you can.

Backend pattern: publish app ports on `127.0.0.1` or an internal Docker network only — let the proxy be the only WAN listener on 80/443.

TLS / ACME in practice

An ACME client proves hostname control, stores certs, and renews before expiry. Prefer proxy-built-in ACME (Caddy/Traefik/NPM) over a forgotten Certbot cron.

**HTTP-01** needs public 80/443 on the hostname. **DNS-01** uses TXT records — required for wildcards, useful when port 80 is blocked or names are split-horizon.

Use Let's Encrypt staging while debugging. Production rate limits punish wrong A records.

Caddy

File-first automatic HTTPS with a short Caddyfile. Strong default for a handful of services and operators who want few moving parts.

vault.example.com {
	reverse_proxy vaultwarden:80
}

Traefik

Label-driven routing for Docker-heavy labs. Powerful and easy to make opaque — budget time for middlewares, dashboard auth, and bad-label outages.

Nginx (and Nginx Proxy Manager)

Explicit configs and transferable knowledge. NPM adds a UI (another app to back up). Raw Nginx is verbose but precise for headers.

When to use each

Pick one and freeze for months. Remixing proxies costs more reliability than any feature checklist saves.

Certificate renewal

Issuance is easy; silent expiry is the classic outage. Alert on TLS end-date (external HTTPS check). Calendar reminders are not automation.

# weekly end-date check — adjust hostnames
for h in vault.example.com photos.example.com; do
  echo | openssl s_client -connect "$h:443" -servername "$h" 2>/dev/null \
    | openssl x509 -noout -enddate
done

Failure modes

• Wrong A/AAAA or CGNAT blocking HTTP-01
• Another process stealing :80/:443
• DNS API token too broad or expired (DNS-01)
• ACME storage volume not backed up after rebuild
• App bound to `0.0.0.0` bypassing the proxy
• HSTS enabled before all hostnames work on HTTPS

Docker integration

Put apps on an internal network; only the proxy joins the edge network. Pin proxy image tags. Backup proxy config + ACME storage + DNS credentials (in the vault).

[Add real environment data here]
Proxy (Caddy/Traefik/Nginx/NPM) + version:
ACME mode (HTTP-01 / DNS-01):
DNS provider (if DNS-01):
Hosts terminated here:
Last renewal success (date):

Security considerations

Keep proxy/NPM/Traefik dashboards off the public internet. Certificate automation does not replace app auth. Prefer modern TLS defaults from a maintained proxy.

Troubleshooting checklist

1) `dig`/`nslookup` hostname → expected IP. 2) From outside: `curl -I https://hostname`. 3) Proxy logs for ACME errors. 4) Confirm nothing else binds 80/443. 5) Staging cert success before production retry.

Related reading

See Docker Compose hardening, Lightweight monitoring, Secure remote access, DNS and split horizon, and What is self-hosting.