![\"Request](\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/diagrams\/traefik-docker-home-server-en.png\")
Step-by-Step Implementation Guide<\/h2>\nStep 1: System Preparation and File Hierarchy Architecture<\/h3>\n
To ensure persistent data storage and clean separation of concerns on the Raspberry Pi host, a standardized filesystem directory tree must be established under Critical Security Note:<\/em> The The routing infrastructure is defined within a root Before executing the compose stack, an isolated bridge network must be initialized on the host system to allow Traefik to communicate securely with downstream application containers:<\/p>\n To eliminate manual container update maintenance, Watchtower is added as an autonomous background service. Since the original To attach any self-hosted application to the Traefik edge router without modifying central proxy files, dynamic Traefik routing labels are declared directly within the target service’s compose definition:<\/p>\n After bringing up the services with What is achieved:<\/strong> Replacement of manual reverse proxy routing, fragile SSL script cron jobs, and manual container updates with an autonomous, declarative Docker Compose infrastructure powered by Traefik v3 and Watchtower.<\/p>\n Resulting added value:<\/strong><\/p>\n No. The :ro only prevents the container from modifying the socket file itself. Through the socket, however, Traefik talks to the Docker API, and the API does not distinguish between read and write calls just because the file is mounted read-only. Whoever reaches the socket can start containers through it, including ones with the host’s root directory mounted, and thereby effectively holds root privileges on the Raspberry Pi.<\/p>\n The risk therefore lies in Traefik’s attack surface: it is the only service that accepts connections directly from the internet. A vulnerability in Traefik would not stop at the container. Watchtower needs write access to the socket anyway in order to replace containers, but it accepts no connections from outside.<\/p>\n A socket proxy mitigates this: a small container that holds the socket and forwards only the read-only API endpoints Traefik needs for container discovery. Traefik then receives the network address of this proxy instead of the socket, and the Docker provider can be pointed at it through its endpoint parameter.<\/p>\n Watchtower follows the tag an image is listed with, not a version number. A container on latest therefore also receives the jump to a new major version as soon as one is published under latest, including changed configuration or data formats. There is no way back built in: after cleanup with WATCHTOWER_CLEANUP=true, the old image is not even left on disk.<\/p>\n The setup in the article already shows the countermeasure: Traefik is pinned to traefik:v3.1 and so only receives new images under that tag, meaning fixes within 3.1 but no jump to another version. The same is worthwhile for every service that keeps its own data, such as a database. For the services on latest, whoami and Watchtower itself in the article, the risk is lower because they hold no data.<\/p>\n Yes, limited to the home network: besides TLS, the dashboard router has the dashboard-ip middleware, an IP allow list (ipAllowList) that only lets through addresses from 192.168.0.0\/16 and 10.0.0.0\/8. Without it, anyone who knows the hostname could see every router, service and hostname of the home server. If the dashboard should also be reachable from outside, a basic auth middleware is added.<\/p>\n Only if Let’s Encrypt can reach the Raspberry Pi from the internet on port 80: the hostname has to point publicly to the connection, and the router has to forward port 80 to the Pi. On connections without a public IPv4 address of their own, behind carrier-grade NAT or DS-Lite for example, this fails over IPv4; it then only works if the hostname has an AAAA record and the Pi is reachable over IPv6. The same limitation applies to services meant to be reachable only on the home network.<\/p>\n The DNS-01 challenge mentioned in the article is intended for these cases. It proves control over the domain with a TXT record in DNS, needs no open port and also allows wildcard certificates. In return, Traefik needs credentials for the DNS provider’s API, and those credentials then deserve the same protection as acme.json.<\/p>\n<\/div>\n Technical tutorial on deploying a fully automated, self-hosted Raspberry Pi home laboratory with Traefik v3 reverse proxy, zero-touch SSL, and Watchtower image automation.<\/p>\n","protected":false},"author":1,"featured_media":14079,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[92630],"tags":[91106,91145,91113,91181,91237,91219],"class_list":["post-527","post","type-post","status-publish","format-standard","hentry","category-tutorials-en-raspberry-pi","tag-automation","tag-docker","tag-homelab","tag-raspberry-pi","tag-self-hosting","tag-tutorial"],"yoast_head":"\n\/opt\/containers\/<\/code>:<\/p>\nmkdir -p \/opt\/containers\/traefik\/data\nmkdir -p \/opt\/containers\/watchtower\ntouch \/opt\/containers\/traefik\/data\/acme.json\nchmod 600 \/opt\/containers\/traefik\/data\/acme.json<\/code><\/pre>\nacme.json<\/code> file storing private Let’s Encrypt cryptographic keys must be restricted to file permissions 600<\/code>. Traefik will refuse to start if read\/write permissions are excessively permissive.<\/p>\nStep 2: Designing the Traefik v3 Dynamic Edge Router Stack<\/h3>\n
docker-compose.yml<\/code> file located in \/opt\/containers\/traefik\/<\/code>. This configuration specifies entrypoints for port 80 (HTTP) with mandatory redirects to port 443 (HTTPS), enables automated Let’s Encrypt HTTP-01 challenges, and mounts the Docker Unix socket read-only:<\/p>\nservices:\n traefik:\n image: traefik:v3.1\n container_name: traefik\n restart: unless-stopped\n security_opt:\n - no-new-privileges:true\n networks:\n - proxy\n ports:\n - \"80:80\"\n - \"443:443\"\n command:\n - \"--api.dashboard=true\"\n - \"--providers.docker=true\"\n - \"--providers.docker.exposedbydefault=false\"\n - \"--providers.docker.network=proxy\"\n - \"--entrypoints.web.address=:80\"\n - \"--entrypoints.web.http.redirections.entryPoint.to=websecure\"\n - \"--entrypoints.web.http.redirections.entryPoint.scheme=https\"\n - \"--entrypoints.websecure.address=:443\"\n - \"--certificatesresolvers.myresolver.acme.httpchallenge=true\"\n - \"--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web\"\n - \"--certificatesresolvers.myresolver.acme.email=admin@lukaswojcik.com\"\n - \"--certificatesresolvers.myresolver.acme.storage=\/data\/acme.json\"\n volumes:\n - \"\/var\/run\/docker.sock:\/var\/run\/docker.sock:ro\"\n - \"\/opt\/containers\/traefik\/data:\/data\"\n labels:\n - \"traefik.enable=true\"\n - \"traefik.http.routers.dashboard.rule=Host(`proxy.lukaswojcik.com`)\"\n - \"traefik.http.routers.dashboard.service=api@internal\"\n - \"traefik.http.routers.dashboard.entrypoints=websecure\"\n - \"traefik.http.routers.dashboard.tls.certresolver=myresolver\"\n - \"traefik.http.routers.dashboard.middlewares=dashboard-ip\"\n - \"traefik.http.middlewares.dashboard-ip.ipallowlist.sourcerange=192.168.0.0\/16, 10.0.0.0\/8\"\n\nnetworks:\n proxy:\n external: true<\/code><\/pre>\nStep 3: Creating the External Proxy Docker Network<\/h3>\n
docker network create proxy<\/code><\/pre>\nStep 4: Integrating Watchtower for Automated Lifecycle Management<\/h3>\n
containrrr\/watchtower<\/code> repository was archived on 17 December 2025 and receives no further fixes or security updates, the actively maintained fork nickfedor\/watchtower<\/code> is used here as a drop-in replacement. It checks configured registries every 24 hours (86400 seconds), pulls updated images matching current tags, gracefully terminates old container instances, and removes orphaned images automatically:<\/p>\nservices:\n watchtower:\n image: nickfedor\/watchtower:latest\n container_name: watchtower\n restart: unless-stopped\n volumes:\n - \"\/var\/run\/docker.sock:\/var\/run\/docker.sock\"\n environment:\n - WATCHTOWER_CLEANUP=true\n - WATCHTOWER_POLL_INTERVAL=86400\n - WATCHTOWER_INCLUDE_RESTARTING=true\n - WATCHTOWER_ROLLING_RESTART=true<\/code><\/pre>\nStep 5: Deploying a Secure Downstream Microservice via Labels<\/h3>\n
services:\n whoami:\n image: traefik\/whoami:latest\n container_name: whoami\n restart: unless-stopped\n networks:\n - proxy\n labels:\n - \"traefik.enable=true\"\n - \"traefik.http.routers.whoami.rule=Host(`whoami.lukaswojcik.com`)\"\n - \"traefik.http.routers.whoami.entrypoints=websecure\"\n - \"traefik.http.routers.whoami.tls.certresolver=myresolver\"\n - \"traefik.http.services.whoami.loadbalancer.server.port=80\"\n\nnetworks:\n proxy:\n external: true<\/code><\/pre>\nStep 6: Quality Assurance and System Auditing<\/h3>\n
docker compose up -d<\/code>, the infrastructure must be systematically verified:<\/p>\n\n
docker logs -f traefik<\/code> to confirm successful Let’s Encrypt ACME challenges and verify that acme.json<\/code> is populated with valid RSA\/ECDSA certificates.<\/li>\ncurl -I http:\/\/whoami.lukaswojcik.com<\/code>) to confirm an immediate 308 Permanent Redirect<\/code> or 301 Moved Permanently<\/code> header pointing to HTTPS.<\/li>\ndocker exec -it watchtower \/watchtower --run-once --monitor-only<\/code> to verify that access permissions to the Docker socket are functioning correctly. The flag --no-pull<\/code> is no substitute here: it only suppresses registry pulls, while a newer image already present locally still causes the container to be stopped and recreated.<\/li>\n<\/ol>\nSummary and Measurable Added Value<\/h2>\n
\n
nickfedor\/watchtower<\/code> takes the place of the archived original.<\/li>\n<\/ul>\nQuestions and answers<\/h2>\n
Does the :ro on the Docker socket make Traefik’s access harmless?<\/h3>\n
Which updates does Watchtower install, and how can jumps to a new major version be avoided?<\/h3>\n
Is the Traefik dashboard at proxy.lukaswojcik.com protected?<\/h3>\n
Does the HTTP-01 challenge work on every home internet connection?<\/h3>\n
Sources<\/h2>\n
\n