Autonomous Docker-Compose Home Server with Traefik, SSL, and Watchtower

Architectural Overview: Autonomous Home Server Design on Raspberry Pi

Deploying a self-hosted home laboratory on a Raspberry Pi requires a resilient, low-maintenance orchestration architecture. Exposing internal Docker containers to local or public networks without centralized SSL/TLS termination introduces administrative complexity and severe security vulnerabilities. Manual certificate renewals, static reverse proxy configurations, and manual container updates inevitably lead to downtime and expired cryptographic certificates.

An autonomous home server architecture combines three core technologies within a single declarative Docker Compose stack: Traefik v3 acts as a dynamic edge router that monitors the Docker socket and routes incoming HTTP/HTTPS requests based on container labels. Let’s Encrypt ACME integration automates SSL certificate generation and renewal via HTTP-01 or DNS-01 challenges; and Watchtower provides automated lifecycle management by periodically checking container registries and gracefully rolling over outdated container images without manual intervention.

Step-by-Step Implementation Guide

Step 1: System Preparation and File Hierarchy Architecture

To ensure persistent data storage and clean separation of concerns on the Raspberry Pi host, a standardized filesystem directory tree must be established under /opt/containers/:

mkdir -p /opt/containers/traefik/data
mkdir -p /opt/containers/watchtower
touch /opt/containers/traefik/data/acme.json
chmod 600 /opt/containers/traefik/data/acme.json

Critical Security Note: The acme.json file storing private Let’s Encrypt cryptographic keys must be restricted to file permissions 600. Traefik will refuse to start if read/write permissions are excessively permissive.

Step 2: Designing the Traefik v3 Dynamic Edge Router Stack

The routing infrastructure is defined within a root docker-compose.yml file located in /opt/containers/traefik/. This configuration specifies entrypoints for port 80 (HTTP) with mandatory redirects to port 443 (HTTPS), enables automated Let’s Encrypt HTTP-01 challenges, and mounts the Docker Unix socket read-only:

services:
  traefik:
    image: traefik:v3.1
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    ports:
      - "80:80"
      - "443:443"
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=proxy"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.myresolver.acme.email=admin@lukaswojcik.com"
      - "--certificatesresolvers.myresolver.acme.storage=/data/acme.json"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/opt/containers/traefik/data:/data"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`proxy.lukaswojcik.com`)"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls.certresolver=myresolver"
      - "traefik.http.routers.dashboard.middlewares=dashboard-ip"
      - "traefik.http.middlewares.dashboard-ip.ipallowlist.sourcerange=192.168.0.0/16, 10.0.0.0/8"

networks:
  proxy:
    external: true

Step 3: Creating the External Proxy Docker Network

Before executing the compose stack, an isolated bridge network must be initialized on the host system to allow Traefik to communicate securely with downstream application containers:

docker network create proxy

Step 4: Integrating Watchtower for Automated Lifecycle Management

To eliminate manual container update maintenance, Watchtower is added as an autonomous background service. Since the original containrrr/watchtower repository was archived on 17 December 2025 and receives no further fixes or security updates, the actively maintained fork nickfedor/watchtower is used here as a drop-in replacement. It checks configured registries every 24 hours (86400 seconds), pulls updated images matching current tags, gracefully terminates old container instances, and removes orphaned images automatically:

services:
  watchtower:
    image: nickfedor/watchtower:latest
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_POLL_INTERVAL=86400
      - WATCHTOWER_INCLUDE_RESTARTING=true
      - WATCHTOWER_ROLLING_RESTART=true

Step 5: Deploying a Secure Downstream Microservice via Labels

To attach any self-hosted application to the Traefik edge router without modifying central proxy files, dynamic Traefik routing labels are declared directly within the target service’s compose definition:

services:
  whoami:
    image: traefik/whoami:latest
    container_name: whoami
    restart: unless-stopped
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.lukaswojcik.com`)"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls.certresolver=myresolver"
      - "traefik.http.services.whoami.loadbalancer.server.port=80"

networks:
  proxy:
    external: true

Step 6: Quality Assurance and System Auditing

After bringing up the services with docker compose up -d, the infrastructure must be systematically verified:

1. Certificate Issuance Verification: Inspect container log output via docker logs -f traefik to confirm successful Let’s Encrypt ACME challenges and verify that acme.json is populated with valid RSA/ECDSA certificates.
2. Automated Redirection Audit: Execute a plain HTTP cURL query against the domain (curl -I http://whoami.lukaswojcik.com) to confirm an immediate 308 Permanent Redirect or 301 Moved Permanently header pointing to HTTPS.
3. Update Trigger Simulation: Execute a single non-invasive Watchtower check via docker exec -it watchtower /watchtower --run-once --monitor-only to verify that access permissions to the Docker socket are functioning correctly. The flag --no-pull is no substitute here: it only suppresses registry pulls, while a newer image already present locally still causes the container to be stopped and recreated.

Summary and Measurable Added Value

What is achieved: Replacement of manual reverse proxy routing, fragile SSL script cron jobs, and manual container updates with an autonomous, declarative Docker Compose infrastructure powered by Traefik v3 and Watchtower.

Resulting added value:

• Zero-Touch SSL/TLS Maintenance: Cryptographic certificates are requested, provisioned, and renewed automatically by Let’s Encrypt, preventing browser certificate warnings and service outages.
• Dynamic Service Discovery: New home server applications are routed and encrypted instantly by appending Docker labels, eliminating manual Nginx/Apache configuration file edits and server reloads.
• Continuous Automated Patching: Security patches and application updates are automatically applied within 24 hours of upstream registry releases, hardening the Raspberry Pi against known vulnerabilities. This guarantee only holds as long as the update tool itself is maintained, which is why the actively developed fork nickfedor/watchtower takes the place of the archived original.