VECTR behind Traefik

[l4rm4nd]

In case some one wants to run VECTR behind an already existing Traefik reverse proxy:

Append the following labels to the vectr-caddy-gateway service:

  vectr-caddy-gateway:
    image: securityriskadvisors/vectr_caddy_gateway:9.9.0
    .
    .
    labels:
      - traefik.enable=true
      - traefik.docker.network=${COMPOSE_PROJECT_NAME}_vectr_bridge
      - traefik.http.routers.vectr.rule=Host(`${VECTR_HOSTNAME}`)
      - traefik.http.services.vectr.loadbalancer.server.port=8443
      - traefik.http.services.vectr.loadbalancer.server.scheme=https
      # we must use a file provider and define the SNI hostname
      - traefik.http.services.vectr.loadbalancer.serversTransport=vectr-sni@file 

Then, add the following to your traefik dynamic config file:

http:

  serversTransports:
    vectr-sni:
      serverName: vectr.example.com     # SNI Caddy expects, your VECTR_HOSTNAME
      insecureSkipVerify: true          # or better: provide rootCAs

Finally, restart the stack and join your traefik container to the network:

# restart the stack
docker compose up -d --force-recreate

# join traefik to vectr network
docker network connect sandbox1_vectr_bridge traefik

Afterwards, Traefik will propery proxy requests to the Caddy gateway.