Traefik Advanced

Use Traefik when this Docker host already routes several services. For a new Bearicorn-only host, use Caddy.

Dashboard security

The provided stack enables Traefik's insecure dashboard API. Bind the published dashboard port to loopback as shown below. Traefik documents api.insecure as development-only and advises against exposing it publicly.

Requirements

• Docker Engine and Docker Compose v2;
• a public DNS name resolving to this server; and
• inbound TCP 80 and 443.

Install

sudo mkdir -p /opt/bearicorn
sudo chown "$USER":"$USER" /opt/bearicorn
cd /opt/bearicorn
git clone https://github.com/bybearicorn/monorepo.git
cd monorepo/deploy/compose
cp .env.traefik .env

Generate two independent secrets:

openssl rand -hex 32
openssl rand -hex 16

Edit .env:

Variable	Required value
JWT_SECRET	The 64-character value from the first command
DB_PASSWORD	The 32-character value from the second command
TRAEFIK_HOST	The hub hostname, such as chat.example.com
TRAEFIK_ACME_EMAIL	An operator email for certificate registration
TRAEFIK_DASHBOARD_PORT	127.0.0.1:8081

Binding to 127.0.0.1 keeps the unauthenticated dashboard off public interfaces. Do not commit .env.

Start the stack

docker compose --env-file .env -f docker-compose.traefik.yml up --build -d
docker compose --env-file .env -f docker-compose.traefik.yml ps

Open the configured HTTPS hostname. Requests to the raw IP do not match the Traefik host rule.

Inspect the dashboard

Create a temporary SSH tunnel from your computer:

ssh -L 8081:127.0.0.1:8081 YOUR_SERVER

While the tunnel is open, visit http://127.0.0.1:8081/dashboard/. Do not publish this port through a cloud or host firewall.

Verify

curl -I https://chat.example.com
docker compose --env-file .env -f docker-compose.traefik.yml logs --tail=100 traefik hub-app

See Traefik's official Docker provider guide and ACME reference for the current behavior.

Next steps

• Back up and restore
• Update Bearicorn
• Troubleshoot containers