Traefik & Domain Setup¶
This guide is for when you're ready to go from http://server-ip:PORT to https://plex.yourdomain.com with automatic SSL certificates.
This is optional
Traefik is completely optional. If you just want to deploy apps and access them by IP and port, skip this entirely and come back when you want custom domains.
Exposing services to the internet
If you make apps accessible outside your home network, use TLS (HTTPS) and enable authentication. Traefik + Authelia mode is the recommended setup for any internet-facing app. Don't expose an unauthenticated dashboard to the public internet.
What You Need¶
- A domain name — a few dollars a year from any registrar
- A Cloudflare account — free tier, manages your DNS for the certificate challenge
- Your server's public IP — or use Cloudflare Tunnel or Tailscale if your ISP blocks ports (see below)
How It Works¶
Someone types plex.yourdomain.com
→ Cloudflare DNS points to your server
→ Traefik (on your server) catches the request
→ Traefik routes it to the right container
→ SSL certificate handled automatically by Let's Encrypt
Set it up once from the dashboard — every new app you deploy in Traefik mode gets its own URL automatically.
Step 1: Turn On Traefik¶
Eight.ly deploys and manages Traefik for you — there's no compose file to write or docker network create command to run by hand.
- Go to Settings > Network
- Set Proxy Type to Traefik
- Enter your Domain Name
- Set SSL Provider to Cloudflare DNS Challenge
- Under Cloudflare Configuration, enable Cloudflare integration and enter your API token (needs Zone:DNS:Edit permission — create one at My Profile > API Tokens > "Edit zone DNS" in the Cloudflare dashboard)
- Save
Eight.ly writes Traefik's configuration, requests certificates through the Cloudflare DNS-01 challenge, and starts the container.
Step 2: Point DNS at Your Server¶
In Cloudflare, for your domain:
| Type | Name | Content | Proxy status |
|---|---|---|---|
| A | * | Your server's public IP | Proxied |
| A | @ | Your server's public IP | Proxied |
A wildcard record covers every subdomain, so you don't need to add one per app.
Step 3: Deploy Apps with Traefik Mode¶
In the Eight.ly dashboard:
- Click Deploy on any app
- Choose Traefik as the deployment mode
- Click Deploy
Traefik automatically detects the new container, requests an SSL certificate from Let's Encrypt, and starts routing https://appname.yourdomain.com to it. No manual config needed.
Adding Authelia (Recommended for Internet-Facing Apps)¶
Authelia puts a login page in front of your apps. Instead of anyone being able to hit https://radarr.yourdomain.com, they have to authenticate first — with optional two-factor authentication.
This is also deployed for you, not hand-assembled from a compose file:
- Go to Settings > Security
- Set Authentication Provider to Authelia
- Follow the prompts to set an initial admin password
- Save
Eight.ly deploys the Authelia container, writes its configuration, and generates the Traefik middleware that chains a request through Authelia's login check before it reaches your app. Once this is done, deploying any app with Traefik + Authelia mode as the deployment option automatically attaches that middleware — nothing to configure per app.
Authelia's session timeout is configurable from the same Settings > Security page.
No Public IP? No Problem¶
- Cloudflare Tunnel — in the app catalog as Cloudflared. Creates a secure outbound tunnel through Cloudflare so you don't need to open any ports. Works even with CGNAT.
- Tailscale / WireGuard — access your server over a VPN from anywhere without exposing it publicly.