Lesson 4.1: Why Reverse Proxies Matter

Why Reverse Proxies Matter

The Problem with Direct Port Access

In our previous modules, we accessed services using ports:

• http://localhost:8080 - Traefik Dashboard
• http://localhost:8081 - MeTube
• http://localhost:9999 - Stash

Problems with this approach:

• Hard to remember port numbers
• No SSL/TLS encryption
• Difficult to share with others
• No centralized access control
• Port conflicts as you add services

The Reverse Proxy Solution

A reverse proxy sits between clients and your services, providing:

1. Clean URLs

Instead of: http://localhost:8081
You get:    https://metube.mct.lan

2. SSL/TLS Termination

• Single point for certificate management
• Automatic HTTPS redirection
• Modern TLS protocols and ciphers

3. Load Balancing

• Distribute traffic across multiple instances
• Health checks and failover
• Session persistence

4. Security Features

• Rate limiting
• IP filtering
• Authentication middleware
• Security headers

Why Traefik?

Traefik is perfect for Docker environments because it:

Docker-Native

• Automatically discovers services via Docker labels
• No manual configuration files for each service
• Supports Docker Compose out of the box

Dynamic Configuration

• Updates routes without restarts
• Watches for container changes
• Hot-reloads configuration

Modern Features

• HTTP/2 and HTTP/3 support
• WebSocket proxying
• Metrics and monitoring
• Circuit breakers

Real-World Example: MCT Services

In our MCT stack, Traefik manages routes for:

• https://hub.mct.lan → Dashy Dashboard
• https://auth.mct.lan → Keycloak
• https://metube.mct.lan → MeTube
• https://stash.mct.lan → Stash
• https://dns.mct.lan → Pi-hole
• https://edge.mct.lan → Traefik Dashboard

Architecture Overview

Internet/LAN
     ↓
[Traefik Proxy] :80, :443
     ↓
┌─────────────────────────────┐
│  Docker Network: mct_public │
├─────────────────────────────┤
│ ┌─────────┐ ┌─────────────┐ │
│ │ MeTube  │ │ Stash       │ │
│ │ :8081   │ │ :9999       │ │
│ └─────────┘ └─────────────┘ │
│ ┌─────────┐ ┌─────────────┐ │
│ │ Keycloak│ │ Pi-hole     │ │
│ │ :8080   │ │ :80         │ │
│ └─────────┘ └─────────────┘ │
└─────────────────────────────┘

Key Concepts

Entrypoints

Network entry points where Traefik listens:

• web - Port 80 (HTTP)
• websecure - Port 443 (HTTPS)

Routers

Define how requests are matched and routed:

• Host-based routing: Host(`metube.mct.lan`)
• Path-based routing: PathPrefix(`/api`)
• Header-based routing: Headers(`X-API-Version`, `v2`)

Services

Define backend servers and load balancing:

• Server URLs and ports
• Health check configuration
• Load balancing algorithms

Middlewares

Process requests before reaching services:

• Authentication
• Rate limiting
• Header manipulation
• Compression

Next Steps

In the next lesson, we will dive into Traefik configuration and see how our MCT stack implements these concepts.