Skip to content

Add Traefik HTTPS and VLAN tag support to Proxmox installer#406

Merged
tvancott42 merged 4 commits intomainfrom
feature/traefik-proxmox
Mar 5, 2026
Merged

Add Traefik HTTPS and VLAN tag support to Proxmox installer#406
tvancott42 merged 4 commits intomainfrom
feature/traefik-proxmox

Conversation

@tvancott42
Copy link
Collaborator

Summary

  • Traefik HTTPS proxy - The Proxmox LXC installer now offers an optional Traefik reverse proxy with automatic Let's Encrypt certificates via Cloudflare DNS-01 challenge. When enabled, the app binds to localhost only and Traefik handles public HTTPS traffic, with HTTP/1.1 for speed tests and HTTP/2 for the main app. Geo location tagging is auto-enabled.
  • VLAN tag support - Prompts for an optional VLAN tag (1-4094) during network configuration. Fixes installation failures on VLAN-aware bridges where the default untagged VLAN doesn't have internet access. Closes LXC install fails without proper VLAN #400.
  • Hostname validation - Traefik hostname inputs are validated against RFC 952/1123 to prevent sed injection and config corruption.

When users skip the Traefik option, the installer flow is unchanged (reverse proxy and geo location prompts remain as before).

Test plan

  • Run installer on Proxmox, decline Traefik - verify prompts match previous behavior
  • Run installer on Proxmox, enable Traefik - verify certificates issue and both services are accessible via HTTPS
  • Run installer with VLAN tag on a VLAN-aware bridge - verify container gets correct network access
  • Run installer without VLAN tag - verify no regression (untagged works as before)
  • Enter invalid hostname (e.g., spaces or special chars) - verify validation rejects it
  • Enter invalid VLAN tag (0, 4095, "abc") - verify validation rejects it

Integrates the NetworkOptimizer-Proxy setup as an optional step during
Proxmox installation. When enabled, automatically provisions Let's Encrypt
certificates via Cloudflare DNS-01, enabling geo location tagging and
solving the HTTP/1.1 speed test requirement without manual proxy setup.
Add HTTPS with Traefik section to Proxmox README with requirements,
management commands, and file locations. Update DEPLOYMENT.md and
project README to reference the new Proxmox Traefik integration.
LXC install fails when the bridge is VLAN-aware and the default untagged
VLAN doesn't have internet access. The installer now prompts for an
optional VLAN tag (1-4094) and appends it to the container's network
interface configuration.
Prevents sed injection and config corruption from invalid hostnames
containing special characters. Valid hostnames are restricted to
alphanumeric characters, dots, and hyphens per RFC 952/1123.
@tvancott42 tvancott42 merged commit 4917365 into main Mar 5, 2026
1 check passed
@tvancott42 tvancott42 deleted the feature/traefik-proxmox branch March 5, 2026 19:16
tvancott42 added a commit that referenced this pull request Mar 5, 2026
* Add Traefik HTTPS proxy option to Proxmox LXC install script

Integrates the NetworkOptimizer-Proxy setup as an optional step during
Proxmox installation. When enabled, automatically provisions Let's Encrypt
certificates via Cloudflare DNS-01, enabling geo location tagging and
solving the HTTP/1.1 speed test requirement without manual proxy setup.

* Update docs to mention Traefik HTTPS option in Proxmox installer

Add HTTPS with Traefik section to Proxmox README with requirements,
management commands, and file locations. Update DEPLOYMENT.md and
project README to reference the new Proxmox Traefik integration.

* Add VLAN tag prompt to Proxmox LXC installer (#400)

LXC install fails when the bridge is VLAN-aware and the default untagged
VLAN doesn't have internet access. The installer now prompts for an
optional VLAN tag (1-4094) and appends it to the container's network
interface configuration.

* Add hostname validation for Traefik inputs

Prevents sed injection and config corruption from invalid hostnames
containing special characters. Valid hostnames are restricted to
alphanumeric characters, dots, and hyphens per RFC 952/1123.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

LXC install fails without proper VLAN

1 participant