How to get HTTPS using LetsEncrypt via Traefik and Cloudflare tunnel
on NixOS?
reddit / selfhosted

----------------------------------------------------------------------
9mHoq7ar4Z · 2023-10-08 20:26

Hi All,

I was able to set up a reverse proxy with Traefik and a Cloudflare
tunnel on HTTP with relative ease.  However, for some reason I am just
unable to change over to HTTPS with LetsEncrypt.

Whenever I setup my configuration to use LetsEncrypt then I get 'Error
1033 Argo Tunnel error' when I try to access the site.

The certificates do seem to be created (the acme.json looks to be
populated with the correct information) and there is nothing in the
journalctl that suggests an error with traefik.service

Also; the services are definitely running (jellyfin and traefik
dashboard can be accessed via my local network).

I have tried changing the cloudflared ingress rules to http and https
without getting it to work.

Im kind of stumpted and was wondering if anyone has implemented
something similar before or has a guide that I could follow (i could
not find one)

Thanks


    # --- Selfhosted setup --- #
      networking.firewall.allowedTCPPorts = [ 80 8080 443];
      systemd.services.traefik.environment = {
        CLOUDFLARE_EMAIL = "XXXXX";
        CLOUDFLARE_API_KEY = "XXXXXX";
      };
      age = {
        identityPaths = [ "/home/XXXX/.ssh/id_rsa"  ];
        secrets.cloudflare = {
          file = ../secrets/cloudflare.age;
          owner = "cloudflared";
        };
        secrets.letsencrypt_acme = {
          file = ../secrets/letsencrypt_acme.age;
          owner = "traefik";
        };
      };
      services.cloudflared = {
        enable = true;
        tunnels."andrewklajman.com" = {
          credentialsFile = config.age.secrets.cloudflare.path;
          default = "http_status:404";
          ingress = {
            "jellyfin.XXXXXX.com" = "https://localhost";
            "traefik.XXXXX.com" = "https://localhost";
          };
        };
      };
      services.traefik = {
        enable = true;
        staticConfigOptions = {
          log.level = "trace";
          entryPoints = {
            web = {
              http.redirections.entryPoint = {
                to = "websecure";
                scheme = "https";
              };
            };
            websecure = {
              address = ":443";
              http.tls = {
                certResolver = "cloudflare";
                domains = [{ main = "XXXXXXX.com"; sans = [
                  "traefik.XXXXX.com"
                  "jellyfin.XXXXX.com" ]; }];
              };
            };
          };
          certificatesResolvers = {
            cloudflare = {
              acme = {
                email = "XXXXXXX";
                #storage = config.age.secrets.letsencrypt_acme.path;
                storage = "/var/acme.json";
                dnsChallenge = {
                  provider = "cloudflare";
                  resolvers = [ "1.1.1.1:53" "1.0.0.1:53" ];
                };
              };
            };
          };
          api = {
            dashboard = true;
            insecure = true;
          };
          global = {
            checknewversion = false;
            sendanonymoususage = false;
          };
        };

        dynamicConfigOptions = {
          http = {
            routers = {
              traefik = {
                rule = "Host(`traefik.XXXXXX.com`)";
                service = "traefik";
                entrypoints = [ "websecure" ];
                tls.certResolver = "cloudflare";
              };
              jellyfin = {
                rule = "Host(`jellyfin.XXXXXXXX.com`)";
                service = "jellyfin";
                entrypoints = [ "websecure" ];
                tls.certResolver = "cloudflare";
              };
            };
            services = {
              traefik = { loadBalancer.servers = [ { url =
"http://localhost:8080/dashboard"; } ]; };
              jellyfin = { loadBalancer.servers = [ { url =
"http://localhost:8096"; } ]; };
            };
          };
        };
      };
    # ------------------------ #

​

----------------------------------------------------------------------
joecool42069 · 2023-10-08 20:52

imho.. don't bother with cloudflare.  they're banning accounts using
it for plex/emby/jellyfin.  media streaming is against tos.

----------------------------------------------------------------------
Anejey · 2023-10-08 21:23

Yeah. For media streaming it's better to get a VPS, and point a
Wireguard tunnel to it.

----------------------------------------------------------------------
Phynness · 2023-10-08 21:54

If you have Traefik, why are you using CFT?

----------------------------------------------------------------------
VitoSaver · 2023-10-08 22:05

It is just bad timing probably config is good:


https://www.cloudflarestatus.com/incidents/64wsqjxnljn3

----------------------------------------------------------------------
HrBingR · 2023-10-09 02:02

So Cloudflare changed their terms of service earlier this year. That
restriction on video streaming now only applies to their CDN terms of
service, and no longer forms part of their broad catch-all terms of
service. Here’s a blog post they wrote about the change back in May:
https://blog.cloudflare.com/updated-tos/

Their Zero Trust terms of service also makes no mention of any such
restrictions: https://www.cloudflare.com/en-gb/service-specific-terms-
zero-trust-services/#cf-zero-trust-terms

So while this may have been true in the past, it’s not true today.

----------------------------------------------------------------------
yusing1009 · 2023-10-09 08:34

Use either reverse proxy or Cloudflare Tunnel. Why both? And how do
you think it will work?

----------------------------------------------------------------------
9mHoq7ar4Z · 2023-10-09 19:44

Sorry, maybe I have missed somethign obvious (Im really more of a
hobbyist)

CFT - Using as a tunnel because I dont have a static IP

Traefik - Using as the proxy manager because HTTPS setup (via
LetsEncrypt) is easy  and I want to take advantage of Authelia (and
the guide that I saw uses Traefik to set this up).

​

You seem to suggest that I dont need to use CFT if I already have
Traefik.  But I dont understand how I am supposed to point my DNS
records to a changing IP.

Do you know how to do this (can you elaborate)?

Thanks