Run behind an existing proxy

​

One step setup (Traefik, including Coolify)

levelrail-cli proxy setup             # dry run: what was detected and what would change
levelrail-cli proxy setup --confirm   # apply
levelrail-cli proxy status            # per-domain state, certificate, checklist

1. Detect. It reads the container publishing host port 80 or 443 through the Docker API (no docker CLI): its arguments, mounts, published ports and extra hosts. A mounted traefik.yml is read instead of the arguments when Traefik loads one. Nothing is defaulted: anything it cannot determine is listed and setup stops with 409 and the exact gap.
2. TLS upstream. It turns on tls_terminated_upstream and sets public_https_port to the host port the proxy publishes for HTTPS. This instance stops requesting certificates and stops redirecting HTTP itself.
3. Routes. It saves the detected values and writes the route files.
4. Verify. For every route it runs a TLS handshake to this server’s public address with the domain as SNI (issuer and expiry of the certificate the proxy serves), then a request with the domain as Host. When Traefik’s API is published without authentication, it also asks Traefik whether the router is loaded.

​

What is detected on Coolify

--entrypoints.http.address=:80
--entrypoints.https.address=:443
--providers.file.directory=/traefik/dynamic/
--certificatesresolvers.letsencrypt.acme.httpchallenge=true
extra_hosts: host.docker.internal:host-gateway
volume: /data/coolify/proxy -> /traefik

​

When the listener is on loopback

# /etc/systemd/system/levelrail.service.d/proxy-upstream-ingress.conf
[Service]
Environment=APP_INGRESS_HTTP_ADDR=172.17.0.1:8088

​

Safety model

• Only files named levelrail-managed-*.yaml whose first line is # managed by levelrail. A file with the prefix but without the header is reported and never overwritten or deleted.
• Symlinks are never followed; the directory is resolved once and re-checked before every change, and a directory that resolves outside its parent is refused.
• Writes go to a temporary file in the same directory, then rename, mode 0644, so Traefik never reads a half-written file.
• Domains are validated strictly: no wildcards, ports, paths or separators, and a domain that would need rewriting to become a file name is rejected.
• If a route cannot be rendered (for example the upstream became unreachable), the existing file is kept rather than deleted.
• Every write and removal is audited as proxy_route.written and proxy_route.removed.
• If the control plane cannot write the directory (another user, a read-only mount or a systemd sandbox), setup reports not_writable with the uid, the owner and mode of the directory, or the ReadWritePaths= line to add.

​

Settings

{ "integration": "traefik_file", "dynamic_dir": "/srv/traefik/dynamic",
  "entrypoint_http": "web", "entrypoint_https": "websecure",
  "cert_resolver": "le", "upstream_host": "172.18.0.1" }

​

From the dashboard

​

From the CLI

levelrail-cli proxy                                  # who holds 80 and 443
levelrail-cli proxy --domain console.example.com     # configuration for that domain
levelrail-cli proxy --domain console.example.com --verify
levelrail-cli proxy --app web                        # snippet for an app's domain (upstream: the ingress HTTP port)

​

What it generates

​

Certificates once a proxy owns TLS

• A stale certificate request failure from an earlier attempt, the “another service answers port 80” guidance and the DNS-01 provider prompt are hidden, and the recorded failure is cleared when you enable proxy mode.
• The internal certificate this server stored before the proxy took over is not listed under Settings > Certificates, in the security checks or in the domain doctor, and cert_expiring, cert_expiry and cert_renewal_stalled alert rules ignore it.
• GET /api/v1/domains and GET /api/v1/certificates carry a tls_owner field (acme, internal, proxy, custom); levelrail-cli domains certificates prints it as the OWNER column.

​

Links and the public HTTPS port

​

Several instances behind one proxy

levelrail-cli settings ingress set --tls-terminated-upstream --public-https-port 443

http:
  routers:
    team-a:
      rule: Host(`a.example.com`) || HostRegexp(`^.+\.a\.example\.com$`)
      entryPoints: [websecure]
      tls: { certResolver: letsencrypt }
      service: team-a
    team-b:
      rule: Host(`b.example.com`)
      entryPoints: [websecure]
      tls: { certResolver: letsencrypt }
      service: team-b
  services:
    team-a:
      loadBalancer:
        servers: [{ url: "http://127.0.0.1:8088" }]
    team-b:
      loadBalancer:
        servers: [{ url: "http://127.0.0.1:8089" }]

​

API