Hello, I'm wondering if there is a way to limit access to a Docker container only to private IP ranges when using HTTPS.
Let me explain better. I have my Raspberry on which I setup Traefik v2 as a reverse proxy for my only Docker container, which is running bitwarden_rs. This container requires HTTPS to work correctly, so I'm using Let's Encrypt to provide certificates. Now I want to be able to access that container only from private IP ranges, or in other words, I don't want the Internet to be able to access my selfhosted password manager (even though it should be safe) and only access it from my LAN (or VPN when I'm not home).
I configured a middleware using "ipWhiteList" to specify the whitelisted private IP source ranges but the result is that I'm now not able to access the container anymore (via bitwarden.example.com), it says "forbidden".
I'm guessing that the issue is that since I'm using HTTPS, I'm actually going through the Internet and back to my server to reach the bitwarden container, hence using my public IP, so Traefik sees this request coming from a public IP (please tell me if I got it right or if that's not what happens when using HTTPS).
Does anyone know if there's a solution to this problem? I couldn't find anything elsewhere. I'm posting my configurations below if they're of any help. Thanks!
docker-compose.yml
version: '3.3'
services:
traefik:
container_name: traefik
image: traefik:latest
restart: unless-stopped
security_opt:
- no-new-privileges:true
ports:
- 80:80
- 443:443
- 8080:8080
networks:
- traefik
volumes:
- /etc/localtime:/etc/localtime:ro
- /etc/timezone:/etc/timezone:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./traefik/acme.json:/acme.json
- ./traefik/traefik.yml:/traefik.yml:ro
- ./traefik/dynamic.yml:/dynamic.yml:ro
bitwarden:
image: bitwardenrs/server:raspberry
container_name: bitwarden
restart: unless-stopped
volumes:
- ./bitwarden/bw-data:/data
environment:
- SIGNUPS_ALLOWED=true
- WEBSOCKET_ENABLED=true
networks:
- traefik
labels:
- traefik.enable=true
- traefik.docker.network=traefik
- traefik.http.middlewares.redirect-https.redirectScheme.scheme=https
- traefik.http.middlewares.redirect-https.redirectScheme.permanent=true
- traefik.http.routers.bitwarden-https.rule=Host(`bitwarden.example.com`)
- traefik.http.routers.bitwarden-https.entrypoints=https
- traefik.http.routers.bitwarden-https.tls=true
- traefik.http.routers.bitwarden-http.rule=Host(`bitwarden.example.com`)
- traefik.http.routers.bitwarden-http.entrypoints=http
- traefik.http.routers.bitwarden-http.middlewares=redirect-https
- traefik.http.routers.bitwarden-ws-https.rule=Host(`bitwarden.example.com`) && Path(`/notifications/hub`)
- traefik.http.routers.bitwarden-ws-https.entrypoints=https
- traefik.http.routers.bitwarden-ws-https.tls=true
- traefik.http.routers.bitwarden-ws-http.rule=Host(`bitwarden.example.com`) && Path(`/notifications/hub`)
- traefik.http.routers.bitwarden-ws-http.entrypoints=http
- traefik.http.routers.bitwarden-ws-http.middlewares=redirect-https
- traefik.http.routers.bitwarden-http.middlewares=whitelist@file
- traefik.http.routers.bitwarden-https.middlewares=whitelist@file
- traefik.http.routers.bitwarden-ws-http.middlewares=whitelist@file
- traefik.http.routers.bitwarden-ws-https.middlewares=whitelist@file
networks:
traefik:
external: true
traefik.yml
api:
dashboard: true
insecure: true
debug: true
entryPoints:
http:
address: ":80"
https:
address: ":443"
providers:
docker:
endpoint: "unix:///var/run/docker.sock"
exposedByDefault: false
file:
filename: "/dynamic.yml"
watch: true
certificatesResolvers:
letsencrypt:
acme:
email: mail@example.com
storage: acme.json
httpChallenge:
entryPoint: http
dynamic.yml
http:
middlewares:
https-redirect:
redirectScheme:
scheme: https
permanent: true
whitelist:
ipWhiteList:
sourceRange:
- "10.0.0.0/8"
- "172.16.0.0/12"
- "192.168.0.0/16"
