Traefik v2 (with Docker)

Notes & Warnings

• This is an unsupported configuration created by the community
• This describes how to use Traefik v2 in a Docker container (via docker-compose.yml) to serve the Pi-hole web admin interface via https and includes a permenent http -> https redirect.
• This does not describe how to proxy DNS or DHCP requests to Pi-hole, which is not recommended.
• For ACME challenges, the Traefik container may need to be able to resolve the desired Pi-hole hostname without relying on Pi-hole to do so. Provide this via the extra_hosts parameter in your Traefik container's config in docker-compose.yml if needed.
• For LetsEncrypt to work Traefik must be reachable on port 80 and 443 from the Internet and have domain.tld pointed at its external address.

Basic requirements

1. Have a Traefik v2 Docker container running where it can access port 80 of the Pi-hole server.

2. The following Traefik static config (passed as command arguments to the Traefik container in docker-compose.yml):

   - "--providers.docker=true"
   - "--providers.docker.network=traefik-net"  # replace with your configured Docker network name
   - "--entrypoints.web.address=:80"
   - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
   - "--entrypoints.websecure.address=:443"
   - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
   - "--certificatesresolvers.letsencrypt.acme.email=your-email@example.com"
   - "--certificatesresolvers.letsencrypt.acme.storage=acme.json"
   - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
   

3. The next step has 2 scenarios:

4. If Pi-hole is running in a container on the same Docker host as Traefik, put the following labels in your Pi-hole container's config in docker-compose.yml:

   - "traefik.http.routers.pihole.rule=Host(`pihole.domain.tld`)"
   - "traefik.http.routers.pihole.entrypoints=websecure"
   - "traefik.http.routers.pihole.tls=true"
   - "traefik.http.routers.pihole.tls.certresolver=letsencrypt"
   - "traefik.http.routers.pihole.tls.domains[0].main=pihole.domain.tld"
   - "traefik.http.routers.pihole.tls.domains[0].sans=pihole.domain.tld"
   - "traefik.http.services.pihole.loadbalancer.server.port=80"
   

5. If Pi-hole is running on a different host, you need to provide the Pi-hole (dynamic) config via a traefik.yml file to Traefik. This is best done by bind mounting the local directory containing this file to the /etc/traefik directory within the container:

   # Traefik container config:
   volumes:
     - './traefik/fileproviders:/etc/traefik'
   

   # traefik.yml dynamic config for Pi-hole: http: routers: pihole: rule: Host(`pihole.domain.tld`) entrypoints: websecure tls: certresolver: letsencrypt domains: - main: pihole.domain.tld sans: - pihole.domain.tld services: pihole: loadbalancer: servers: - url: "http://pihole.domain.tld/"

6. Restart the Traefik and Pi-hole containers, then you should be able to access your pihole via https://pihole.domain.tld/

---

Last update: May 7, 2023