homelab-config/traefik-config/adguard-service.md

Service AdGuard Home via Traefik

Overview

AdGuard Home est exposé via Traefik avec HTTPS (Let's Encrypt) sur https://adguard.peis.fr.

Architecture

Internet → 82.67.139.7:443
    ↓ (DNS: adguard.peis.fr → 82.67.139.7)
Routeur (Port Forwarding)
    ↓
CT 200 (192.168.0.100) - Traefik
    ↓ (réseau traefik_network)
adguard-proxy (Nginx)
    ↓
CT 103 (192.168.0.92:80) - AdGuard Home

Configuration Files

docker-compose-adguard.yml

Proxy Nginx container that forwards requests to AdGuard Home.

config/adguard-nginx.conf

Nginx configuration that proxies to AdGuard Home at 192.168.0.92:80.

Setup

Prerequisites

• AdGuard Home running on CT 103 (192.168.0.92:80)
• AdGuard configured to listen on 0.0.0.0:80
• CT 200 IP (192.168.0.100) allowed in AdGuard's Access Settings

Deployment

# On CT 200
cd /opt/traefik
docker-compose -f docker-compose-adguard.yml up -d

Verification

# Check container is running
docker ps | grep adguard-proxy

# Test HTTPS access (from CT 200)
echo "127.0.0.1 adguard.peis.fr" >> /etc/hosts
curl -skL https://adguard.peis.fr
rm /etc/hosts

# Check certificate
docker exec traefik-proxy cat /etc/traefik/certs/acme.json | grep adguard.peis.fr

Certificate

• Domain: adguard.peis.fr
• Issuer: Let's Encrypt (YR2)
• Type: HTTP Challenge
• Expiration: Auto-renewed 30 days before expiry
• Generated: Automatically by Traefik on first request

Troubleshooting

302 Redirect Loop

AdGuard Home redirects HTTP to HTTPS by default. The Nginx proxy handles this by forwarding the relative redirect (/login.html) to the client.

404 Not Found

• Verify AdGuard is listening on 0.0.0.0:80
• Check CT 103 firewall allows connections from CT 200 (192.168.0.100)

SSL Certificate Not Generated

• Verify port 80 is forwarded to CT 200 on your router
• Check Traefik logs: docker logs traefik-proxy | grep adguard
• Test from external network: curl -vk https://adguard.peis.fr

Security Notes

• Access to AdGuard dashboard is not restricted by default
• Consider adding HTTP Basic Auth in docker-compose-adguard.yml
• AdGuard's internal HTTPS (port 443) is not used; only HTTP (port 80) is proxied

Updates

To update the configuration:

1. Modify files in /opt/traefik/ on CT 200
2. Copy to this repo: cp /opt/traefik/docker-compose-adguard.yml /opt/homelab-config-git/traefik-config/
3. Commit and push changes
4. Restart container: docker-compose -f docker-compose-adguard.yml up -d --force-recreate

Related Services

• Traefik Configuration
• Home Assistant
• Whoami Test Service