基于Docker Compose的Traefik配置优化求助（含Cloudflare代理）

问题分析 #

原配置中traefik-additional路由属于冗余配置：它和traefik-http路由共享相同的HTTP入口点与Host规则，功能重复。调整后的配置外部访问失效，核心原因是未信任Cloudflare代理IP，导致Traefik无法正确识别来自Cloudflare的请求；同时api.insecure=true直接暴露8080端口，与域名路由存在冲突。

优化后完整配置 #

1. traefik.yml（核心配置调整）

entryPoints:
  http:
    address: ":80"
    forwardedHeaders:
      trustedIPs:
        # Cloudflare代理IP段，确保Traefik识别代理请求
        - 173.245.48.0/20
        - 103.21.244.0/22
        - 103.22.200.0/22
        - 103.31.4.0/22
        - 141.101.64.0/18
        - 108.162.192.0/18
        - 190.93.240.0/20
        - 188.114.96.0/20
        - 197.234.240.0/22
        - 198.41.128.0/17
        - 162.158.0.0/15
        - 104.16.0.0/13
        - 104.24.0.0/14
        - 172.64.0.0/13
        - 131.0.72.0/22
  https:
    address: ":443"
    forwardedHeaders:
      trustedIPs:
        # 同上，同步信任Cloudflare IP
        - 173.245.48.0/20
        - 103.21.244.0/22
        - 103.22.200.0/22
        - 103.31.4.0/22
        - 141.101.64.0/18
        - 108.162.192.0/18
        - 190.93.240.0/20
        - 188.114.96.0/20
        - 197.234.240.0/22
        - 198.41.128.0/17
        - 162.158.0.0/15
        - 104.16.0.0/13
        - 104.24.0.0/14
        - 172.64.0.0/13
        - 131.0.72.0/22

api:
  dashboard: true
  debug: false  # 生产环境关闭debug模式

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false

certificatesResolvers:
  cloudflare:
    acme:
      email: "${CF_API_EMAIL}"  # 用环境变量替代硬编码
      storage: "/acme.json"
      dnsChallenge:
        provider: "cloudflare"
        resolvers: ["1.1.1.1:53", "8.8.8.8:53"]  # 指定公共DNS，避免解析失败

2. docker-compose.yml（移除冗余+精简配置）

services:
  traefik:
    user: root
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    cap_add:
      - NET_BIND_SERVICE
    networks:
      - proxy
    ports:
      - "80:80"
      - "443:443"
      # 移除8080端口暴露，统一通过域名访问dashboard
    environment:
      - CF_API_EMAIL=${CF_API_EMAIL}
      - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./acme.json:/acme.json
    labels:
      - 'traefik.enable=true'

      # HTTP路由：统一重定向到HTTPS
      - 'traefik.http.routers.traefik-http.entrypoints=http'
      - 'traefik.http.routers.traefik-http.rule=Host(`traefik.mydomain`)'
      - 'traefik.http.routers.traefik-http.middlewares=http-to-https-redirect'

      # HTTPS路由：处理dashboard访问
      - 'traefik.http.routers.traefik-https.entrypoints=https'
      - 'traefik.http.routers.traefik-https.rule=Host(`traefik.mydomain`)'
      - 'traefik.http.routers.traefik-https.tls=true'
      - 'traefik.http.routers.traefik-https.tls.certresolver=cloudflare'
      - 'traefik.http.routers.traefik-https.service=api@internal'
      - 'traefik.http.routers.traefik-https.middlewares=dashboard-auth'

      # 中间件定义
      - 'traefik.http.middlewares.http-to-https-redirect.redirectscheme.scheme=https'
      - 'traefik.http.middlewares.http-to-https-redirect.redirectscheme.permanent=true'

      - 'traefik.http.middlewares.dashboard-auth.basicauth.users=user:password'

networks:
  proxy:
    external: true

关键修改说明 #

1. 移除冗余路由：删除原配置中重复的traefik-additional路由，HTTP请求统一通过traefik-http重定向到HTTPS，消除配置冗余。
2. 信任Cloudflare代理IP：在entryPoints中添加Cloudflare的IP段，确保Traefik正确识别代理请求，解决外部访问失效问题。
3. 关闭API insecure模式：原配置中api.insecure=true直接暴露8080端口，存在安全风险且与域名路由冲突，关闭后统一通过HTTPS域名访问dashboard。
4. 优化证书解析：为Cloudflare DNS挑战添加公共DNS解析器，避免本地DNS解析失败导致证书颁发问题；同时将ACME邮箱改为环境变量，提升配置灵活性。
5. 缩减攻击面：移除8080端口暴露，仅保留必要的80/443端口。

可选：保留本地HTTP访问 #

如果需要本地HTTP直接访问dashboard（无需重定向），可添加以下路由到docker-compose.yml的labels中：

# 本地HTTP访问dashboard（替换为你的本地网段）
- 'traefik.http.routers.traefik-local-http.entrypoints=http'
- 'traefik.http.routers.traefik-local-http.rule=Host(`traefik.mydomain`) && IP(`192.168.1.0/24`)'
- 'traefik.http.routers.traefik-local-http.service=api@internal'
- 'traefik.http.routers.traefik-local-http.middlewares=dashboard-auth'

内容的提问来源于stack exchange，提问作者Kleiton Moraes