Repository navigation
Traefik as edge proxy (web group) #27
Description
Traefik joins the web group as an optional edge proxy in front of the web server and the apps.
- Module traefik: upstream release binary (pinned, checksum verified, amd64 and arm64), own user, systemd sandbox, CAP_NET_BIND_SERVICE only
- Traefik owns 80/443 and 443/udp (HTTP/3): ACME or certificates of the tls module, security headers, HSTS, redirect to HTTPS, JSON access log, dashboard only on localhost
- With Traefik, nginx/apache/caddy listen on 127.0.0.1 only and keep serving vhost sites, PHP and the admin tools behind Traefik
- Apps (stage 6) routed through Traefik: file provider by default; Docker provider opt-in via a read-only socket proxy, never the raw socket
- WAF: LSS_TRAEFIK_WAF=coraza|modsecurity|both|off; Coraza plugin with the OWASP Core Rule Set at the edge, ModSecurity in the backend web server, or both
- Unit tests, integration on every supported system (Debian 12/13, Ubuntu 22.04/24.04/26.04, Rocky 9, AlmaLinux 10, amd64 and arm64), idempotent second run
- README (module table, resource figures from CI), docs/hardening.md
- SonarQube Cloud: no open issues and no new security hotspots on the pull request
- No module refuses a system; no log line starts with "Not" or "No"
Activity
refactor(apps): publish apps through one web_proxy_route helper
test: match only listen directives in the nginx site check
traefik: show Traefik's journal when verify fails
traefik: leave the HTTPS backend check to the sites of vhost
traefik: batch configuration changes and restart quickly after a crash
traefik: hold Coraza back on amd64 until Traefik ships wazero 1.9
traefik: name positional parameters and share the socket proxy probe
traefik: delete the admin host's certificate lineage on removal
VectoDE commentedon Oct 16, 2026
Status on 42486e1 (CI 38848732012, Integration 38848732009, all green on every system, amd64 and arm64):
runtime.memmove, and Go 1.24 and later clobber DX there (wazevo(amd64): reserve dx when calling memmove to support go 1.24 wazero/wazero#2378, fixed in 1.9.0). With the plugin loaded, Traefik crashed at random ("unsafe.Slice: len out of range", "split stack overflow"). On amd64, lss now uses ModSecurity in the web server instead, if it is installed, and warns either way. To switch Coraza back on, setTRAEFIK_CORAZA_AMD64=trueand move to a Traefik release built with the fix. On arm64, Coraza is active and verify gets a 403 for both the SQL injection and the path traversal.modsecurityandbothare verified on all systems.web_proxy_route NAME DOMAIN UPSTREAMhook is in lib/web.sh and tested (unit tests and theLSS_TRAEFIK_ROUTESroute in CI). The Docker provider through the read-only socket proxy is verified on all VM systems. Routing for the real stage 6 app modules can only be checked once those modules are merged.traefik: put ModSecurity in front of everything where Coraza cannot run
apache: let Traefik reach every site behind it
VectoDE commentedon Oct 16, 2026
Status on 02a4a4a (CI 38920862034, Integration 38920861912 green on every system, amd64 and arm64; the three arm64 monitoring jobs first failed on the Grafana mirror, unrelated to this branch, and passed on rerun. SonarCloud: 0 issues, 0 hotspots, gate OK):
LSS_TRAEFIK_WAF=coraza(the default) orbothworks like this on amd64:modsecurityfor nginx or Apache itself. It does this once, and removes it again with Traefik.traefik:warning in the log explains why.echo. This passed on all 7 systems: nginx with auto-installed ModSecurity, and Apache withboth.TRAEFIK_CORAZA_AMD64=truebrings Coraza and direct routes back on amd64.SSLVHostSNIPolicy authonly.