feat(traefik): add AdGuard Home proxy config (adguard.peis.fr)

2026-07-19 19:06:00 +00:00
parent a56203077e
commit e45c4b8a2a
3 changed files with 146 additions and 0 deletions
@@ -0,0 +1,91 @@
+# Service AdGuard Home via Traefik
+
+## Overview
+AdGuard Home est exposé via Traefik avec HTTPS (Let's Encrypt) sur `https://adguard.peis.fr`.
+
+## Architecture
+```
+Internet → 82.67.139.7:443
+    ↓ (DNS: adguard.peis.fr → 82.67.139.7)
+Routeur (Port Forwarding)
+    ↓
+CT 200 (192.168.0.100) - Traefik
+    ↓ (réseau traefik_network)
+adguard-proxy (Nginx)
+    ↓
+CT 103 (192.168.0.92:80) - AdGuard Home
+```
+
+## Configuration Files
+
+### docker-compose-adguard.yml
+Proxy Nginx container that forwards requests to AdGuard Home.
+
+### config/adguard-nginx.conf
+Nginx configuration that proxies to AdGuard Home at `192.168.0.92:80`.
+
+## Setup
+
+### Prerequisites
+- AdGuard Home running on CT 103 (192.168.0.92:80)
+- AdGuard configured to listen on `0.0.0.0:80`
+- CT 200 IP (192.168.0.100) allowed in AdGuard's Access Settings
+
+### Deployment
+```bash
+# On CT 200
+cd /opt/traefik
+docker-compose -f docker-compose-adguard.yml up -d
+```
+
+### Verification
+```bash
+# Check container is running
+docker ps | grep adguard-proxy
+
+# Test HTTPS access (from CT 200)
+echo "127.0.0.1 adguard.peis.fr" >> /etc/hosts
+curl -skL https://adguard.peis.fr
+rm /etc/hosts
+
+# Check certificate
+docker exec traefik-proxy cat /etc/traefik/certs/acme.json | grep adguard.peis.fr
+```
+
+## Certificate
+- **Domain**: adguard.peis.fr
+- **Issuer**: Let's Encrypt (YR2)
+- **Type**: HTTP Challenge
+- **Expiration**: Auto-renewed 30 days before expiry
+- **Generated**: Automatically by Traefik on first request
+
+## Troubleshooting
+
+### 302 Redirect Loop
+AdGuard Home redirects HTTP to HTTPS by default. The Nginx proxy handles this by forwarding the relative redirect (/login.html) to the client.
+
+### 404 Not Found
+- Verify AdGuard is listening on `0.0.0.0:80`
+- Check CT 103 firewall allows connections from CT 200 (192.168.0.100)
+
+### SSL Certificate Not Generated
+- Verify port 80 is forwarded to CT 200 on your router
+- Check Traefik logs: `docker logs traefik-proxy | grep adguard`
+- Test from external network: `curl -vk https://adguard.peis.fr`
+
+## Security Notes
+- Access to AdGuard dashboard is not restricted by default
+- Consider adding HTTP Basic Auth in docker-compose-adguard.yml
+- AdGuard's internal HTTPS (port 443) is not used; only HTTP (port 80) is proxied
+
+## Updates
+To update the configuration:
+1. Modify files in `/opt/traefik/` on CT 200
+2. Copy to this repo: `cp /opt/traefik/docker-compose-adguard.yml /opt/homelab-config-git/traefik-config/`
+3. Commit and push changes
+4. Restart container: `docker-compose -f docker-compose-adguard.yml up -d --force-recreate`
+
+## Related Services
+- [Traefik Configuration](../traefik-config/README.md)
+- [Home Assistant](ha-service.md)
+- [Whoami Test Service](whoami-service.md)
@@ -0,0 +1,28 @@
+user  nginx;
+worker_processes  auto;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    upstream adguard {
+        server 192.168.0.92:80;
+    }
+
+    server {
+        listen 80;
+        server_name adguard.peis.fr;
+
+        location / {
+            proxy_pass http://adguard;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+}
@@ -0,0 +1,27 @@
+version: '3.8'
+
+services:
+  adguard-proxy:
+    image: nginx:alpine
+    container_name: adguard-proxy
+    restart: unless-stopped
+    volumes:
+      - ./config/adguard-nginx.conf:/etc/nginx/nginx.conf:ro
+    labels:
+      - "traefik.enable=true"
+      # HTTP to HTTPS redirect
+      - "traefik.http.routers.adguard-http.rule=Host(`adguard.peis.fr`)"
+      - "traefik.http.routers.adguard-http.entrypoints=web"
+      - "traefik.http.routers.adguard-http.middlewares=redirect-to-https@file"
+      # HTTPS
+      - "traefik.http.routers.adguard.rule=Host(`adguard.peis.fr`)"
+      - "traefik.http.routers.adguard.entrypoints=websecure"
+      - "traefik.http.routers.adguard.tls=true"
+      - "traefik.http.routers.adguard.tls.certresolver=letsencrypt"
+      - "traefik.http.services.adguard.loadbalancer.server.port=80"
+    networks:
+      - traefik_network
+
+networks:
+  traefik_network:
+    external: true