Traefik v3.6 + Vaultwarden 1.35.0 (Perfect Config)

[KowzeyIndustries]

Hello everyone,

I'd like to share my configuration for Traefik v3.6 working with Vaultwarden 1.35.0.

Note

I am currently using Vaultwarden 1.35.0 as I encountered some issues with organization creation in 1.35.1. This setup is specifically tailored for those using Cloudflare as a DNS provider.

Key Features

• Security: Uses linuxserver/socket-proxy to avoid exposing /var/run/docker.sock directly to Traefik.
• SSL: Automated Let's Encrypt certificates via DNS-01 challenge (Cloudflare).
• Hardened Headers: Custom security headers and Content Security Policy (CSP) for both Traefik and Vaultwarden.
• Rate Limiting: Integrated middlewares to prevent brute force.

---

File Structure

/opt/docker/
├── .env
├── traefik-vaultwarden.yml
└── traefik/
├── config.yml
├── traefik.yml
└── acme.json

---

Configuration Files

1. Environment Variables (.env)

Replace the placeholders with your actual data.

# Cloudflare Credentials
CLOUDFLARE_DNS_API_TOKEN=XXXXXXXXX # Permission: Zone - DNS - Edit
CLOUDFLARE_DOMAIN_ZONE_EMAIL=admin@example.com

# Domain Configuration
DOMAIN=domain.xyz
TRAEFIK_SUBDOMAIN=traefik
VAULTWARDEN_SUBDOMAIN=subdomain
VAULTWARDEN_URL=https://subdomain.domain.xyz

# Vaultwarden Security
VAULTWARDEN_ADMIN_TOKEN=XXXXXXXXX # https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#using-argon2

2. Docker Compose (traefik-vaultwarden.yml)

services:
  socket-proxy:
    container_name: socket-proxy
    image: linuxserver/socket-proxy:latest
    restart: always
    environment:
      - ALLOW_START=0
      - ALLOW_STOP=0
      - ALLOW_RESTARTS=0
      - AUTH=0
      - BUILD=0
      - COMMIT=0
      - CONFIGS=0
      - CONTAINERS=1
      - DISABLE_IPV6=0
      - DISTRIBUTION=0
      - EVENTS=1
      - EXEC=0
      - IMAGES=0
      - INFO=0
      - LOG_LEVEL=0
      - NETWORKS=1
      - NODES=0
      - PING=1
      - PLUGINS=0
      - POST=0
      - SECRETS=0
      - SERVICES=0
      - SESSION=0
      - SWARM=0
      - SYSTEM=0
      - TASKS=0
      - VERSION=0
      - VOLUMES=0
    networks:
      - socket_proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    read_only: true
    tmpfs:
      - /run

  traefik:
    container_name: traefik
    image: traefik:v3.6
    restart: always
    ports:
      - 80:80
      - 443:443
    env_file: .env
    environment:
      - CF_API_EMAIL=${CLOUDFLARE_DOMAIN_ZONE_EMAIL}
      - CF_DNS_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN}
    networks:
      - frontend
      - socket_proxy
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /opt/docker/traefik/traefik.yml:/traefik.yml:ro
      - /opt/docker/traefik/acme.json:/acme.json
      - /opt/docker/traefik/config.yml:/config.yml:ro
      - /opt/docker/traefik/logs:/var/log/traefik
    security_opt:
      - no-new-privileges:true
    depends_on:
      socket-proxy:
        condition: service_started
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 30s
      timeout: 3s
      retries: 3
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.middlewares=traefik-chain@file"
      - "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.tls.certresolver=cloudflare"
      - "traefik.http.routers.traefik.tls=true"

  vaultwarden:
    container_name: vaultwarden
    image: vaultwarden/server:1.35.0
    restart: unless-stopped
    env_file: .env
    environment:
      - ADMIN_TOKEN=${VAULTWARDEN_ADMIN_TOKEN}
      - DOMAIN=${VAULTWARDEN_URL}
      - SIGNUPS_ALLOWED=false
      - IP_HEADER=CF-Connecting-IP
      - ROCKET_ADDRESS=0.0.0.0
      - ROCKET_PORT=80
    networks:
      - frontend
    volumes:
      - /opt/docker/vaultwarden/data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:80/alive"]
      interval: 30s
      timeout: 3s
      retries: 3
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vaultwarden-2fa.entrypoints=websecure"
      - "traefik.http.routers.vaultwarden-2fa.rule=Host(`${VAULTWARDEN_SUBDOMAIN}.${DOMAIN}`) && PathRegexp(`.*-connector\\.html`)"
      - "traefik.http.routers.vaultwarden-2fa.middlewares=vaultwarden-2fa-chain@file"
      - "traefik.http.routers.vaultwarden-2fa.priority=200"
      - "traefik.http.routers.vaultwarden-2fa.tls.certresolver=cloudflare"
      - "traefik.http.routers.vaultwarden-2fa.tls=true"
      - "traefik.http.routers.vaultwarden.entrypoints=websecure"
      - "traefik.http.routers.vaultwarden.rule=Host(`${VAULTWARDEN_SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.vaultwarden.middlewares=vaultwarden-chain@file"
      - "traefik.http.routers.vaultwarden.priority=100"
      - "traefik.http.routers.vaultwarden.tls.certresolver=cloudflare"
      - "traefik.http.routers.vaultwarden.tls=true"
      - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"

networks:
  frontend:
    name: frontend
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24
  socket_proxy:
    name: socket_proxy
    driver: bridge

3. Traefik Dynamic Config (config.yml)

http:
  middlewares:
    basic-auth:
      basicAuth:
        users:
          - "admin:XXXXXXXXXXXXXXX" # https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/basicauth/

    rate-limit:
      rateLimit:
        average: 120
        burst: 30

    vaultwarden-rate-limit:
      rateLimit:
        average: 300
        burst: 100

    traefik-headers:
      headers:
        contentTypeNosniff: true
        referrerPolicy: "strict-origin-when-cross-origin"
        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), bluetooth=(), autoplay=(), notifications=(), accelerometer=(), gyroscope=(), magnetometer=()"
        contentSecurityPolicy: "default-src 'self'; script-src 'self' 'sha256-MWo9qldOwFtivMvfCrZODNWK5+91Xo9tWkDCf8ygRdU=' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' [https://traefik.github.io](https://traefik.github.io) [https://assets.traefik.io](https://assets.traefik.io); worker-src 'self' blob:;"
        customResponseHeaders:
          server: ""
          x-powered-by: ""
          X-Permitted-Cross-Domain-Policies: "none"

    traefik-chain:
      chain: 
        middlewares:
          - basic-auth
          - traefik-headers
          - rate-limit

    vaultwarden-headers:
      headers:
        contentSecurityPolicy: "default-src 'none'; manifest-src 'self'; base-uri 'self'; form-action 'self'; object-src 'self' blob:; script-src 'self' 'wasm-unsafe-eval'; child-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: [https://haveibeenpwned.com](https://haveibeenpwned.com); font-src 'self' data:; connect-src 'self' [https://api.pwnedpasswords.com](https://api.pwnedpasswords.com) [https://api.2fa.directory](https://api.2fa.directory) [https://app.simplelogin.io/api/](https://app.simplelogin.io/api/) [https://app.addy.io/api/](https://app.addy.io/api/) [https://api.fastmail.com/](https://api.fastmail.com/) [https://api.forwardemail.net](https://api.forwardemail.net); frame-ancestors 'self' chrome-extension://nngceckbapebfimnlniiiahkandclblb chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh moz-extension://*;"
        contentTypeNosniff: true
        customResponseHeaders:
          X-Robots-Tag: "noindex,nofollow,noarchive,nosnippet,notranslate,noimageindex"
          server: ""
          X-Powered-By: ""
        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=(self), usb=(), bluetooth=(), autoplay=(), clipboard-write=(self), clipboard-read=(self), accelerometer=(), gyroscope=(), magnetometer=()"
        referrerPolicy: same-origin

    vaultwarden-chain:
      chain: 
        middlewares:
          - vaultwarden-headers
          - vaultwarden-rate-limit

    vaultwarden-2fa-headers:
      headers:
        contentTypeNosniff: true
        customResponseHeaders:
          X-Robots-Tag: "noindex,nofollow,noarchive,nosnippet,notranslate,noimageindex"
          server: ""
          X-Powered-By: ""
        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=(self), usb=(), bluetooth=(), autoplay=(), clipboard-write=(self), clipboard-read=(self), accelerometer=(), gyroscope=(), magnetometer=()"
        referrerPolicy: same-origin

    vaultwarden-2fa-chain:
      chain: 
        middlewares:
          - vaultwarden-2fa-headers
          - vaultwarden-rate-limit

4. Traefik Static Config (traefik.yml)

global:
  checkNewVersion: false
  sendAnonymousUsage: false

accessLog:
  filePath: "/var/log/traefik/access.log"
log:
  level: "ERROR"
  filePath: "/var/log/traefik/traefik.log"

api:
  dashboard: true
  debug: false

certificatesResolvers:
  cloudflare:
    acme:
      email: admin@example.com
      storage: acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

entryPoints:
  web:
    address: ":80"
    forwardedHeaders:
      trustedIPs:
        - "103.21.244.0/22"
        - "103.22.200.0/22"
        - "103.31.4.0/22"
        - "104.16.0.0/13"
        - "104.24.0.0/14"
        - "108.162.192.0/18"
        - "131.0.72.0/22"
        - "141.101.64.0/18"
        - "162.158.0.0/15"
        - "172.64.0.0/13"
        - "173.245.48.0/20"
        - "188.114.96.0/20"
        - "190.93.240.0/20"
        - "197.234.240.0/22"
        - "198.41.128.0/17"
        - "2400:cb00::/32"
        - "2606:4700::/32"
        - "2803:f800::/32"
        - "2405:b500::/32"
        - "2405:8100::/32"
        - "2a06:98c0::/29"
        - "2c0f:f248::/32"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true

  websecure:
    address: ":443"
    forwardedHeaders:
      trustedIPs:
        - "103.21.244.0/22"
        - "103.22.200.0/22"
        - "103.31.4.0/22"
        - "104.16.0.0/13"
        - "104.24.0.0/14"
        - "108.162.192.0/18"
        - "131.0.72.0/22"
        - "141.101.64.0/18"
        - "162.158.0.0/15"
        - "172.64.0.0/13"
        - "173.245.48.0/20"
        - "188.114.96.0/20"
        - "190.93.240.0/20"
        - "197.234.240.0/22"
        - "198.41.128.0/17"
        - "2400:cb00::/32"
        - "2606:4700::/32"
        - "2803:f800::/32"
        - "2405:b500::/32"
        - "2405:8100::/32"
        - "2a06:98c0::/29"
        - "2c0f:f248::/32"

ping:
  entryPoint: web

providers:
  docker:
    endpoint: "tcp://socket-proxy:2375"
    exposedByDefault: false
    network: frontend
  file:
    filename: /config.yml

---

Deployment Steps

1. Prepare the acme.json file:

   touch /opt/docker/traefik/acme.json
   chmod 600 /opt/docker/traefik/acme.json

2. DNS Configuration (Cloudflare):
   • A Record: Point @ to your server's IP. (Proxied: Yes)
   • CNAME Record: Point * to @. (Proxied: Yes)
3. Start the stack:

   cd /opt/docker/
   docker compose -f traefik-vaultwarden.yml up -d

If you have any possible improvements that I haven't already considered, please feel free to share them; I will update accordingly.