Chicken/Egg dilemma - DNS/DHCP first, or Traefix first?

Traefik Traefik v3 (latest)
,
1

Hey, all - I'm basically rebuilding my home lab from the ground up and running into priority decisions as I’m switching to a bunch of new core tools/technologies. I'm new to the world of reverse proxies.

Old lab:

  • Single ESXi host, lots of VM’s using system services and installed apps
  • An old Synology NAS (413j) just for the NFS functionality
  • No reverse proxy, Bind9 for DNS and DHCP as Fedora system services
  • Docker (with Portainer) running a few containers
  • Let’s Encrypt Certificate management as a cron-driven app on the VM currently running DNS/DHCP

New lab goals:

  • 3 Proxmox servers (2 new machines running in a cluster now, 3rd will be added once I pull everything off the old ESXi system) running ZFS (local RAID 1 SSD’s).
  • Docker up and running in swarm mode (trying to achieve higher overall availability) on 3 VMs
  • Retaining old NAS for now just for shared storage, but eventually upgrade it (budget issues)
  • Containerize as many apps/services as possible rather than current VM services or installed apps.
  • Decided on Traefix for reverse proxy and moving to Technitium for DNS/DHCP services.

I’m ready to start migrating off the ESXi server, but here’s the questions I’m now stuck at:

  • What service should I migrate/implement first – Traefix or Technitium for new DNS/DHCP? Both tools are new to me, and I’m stuck in a logic loop.
  • Both of those tools can run certbot – is there a best practice choice which one to run it from?
  • Is a Docker swarm (with replicas set to 1 and using a common NFS share) a bad idea for providing HA in this small of an environment?
2

Traefik uses LetsEncrypt via go-acme library. It automatically creates, renews and uses TLS certs for the services (domains) you configure or it discovers.

In our setup the TLS certs are only used with Traefik, so we let Traefik handle it.

If you let another service create the TLS certs, then you need to create an according dynamic config for Traefik to load them (fun project). If you always provide the same filenames, you would still need to touch the config file for Traefik to reload the config (or restart Traefik).

Traefik will only generate TLS certs for domains it knows about. You can export from the custom format with tools like traefik-certs-dumper to use the certs in other applications (like dns-over-tls).