---
title: "Homarr Proxies & Certificates — Reverse Proxy Setup"
aliases: [homarr-traefik, homarr-caddy, homarr-self-signed]
tags: [homarr, homelab, traefik, caddy, reverse-proxy, ssl, docker]
sources: [raw/Proxies and Certificates  Homarr documentation.md]
created: 2026-04-19
updated: 2026-04-19
---

## Overview

Two problems addressed here:
1. **Self-signed certificates** — Homarr blocks requests to apps with unknown certificate authorities
2. **Reverse proxy setup** — running Homarr behind Traefik or Caddy requires network-aware configuration

---

## Self-Signed Certificates

Homarr communicates with apps via integrations. If an app uses a self-signed cert, Homarr rejects it as an unknown CA — this causes Ping widget failures with no 200 response.

**Fix:** upload the certificate via the Certificates management page.
→ See [[wiki/homelab/homarr-certificates|Homarr Certificates — Trusted Certificate Management]]

---

## Securing Homarr with Traefik

Standard docker-compose copy-paste **does not work** behind Traefik (Portainer, docker-swarm, etc.).

### Homarr service labels

```yaml
services:
  homarr:
    container_name: homarr
    image: ghcr.io/homarr-labs/homarr:latest
    restart: unless-stopped
    volumes:
      - ./homarr/appdata:/appdata
    environment:
      - BASE_URL=your.internal.dns.address.here.com
      - SECRET_ENCRYPTION_KEY=your_64_character_hex_string  # openssl rand -hex 32
    networks:
      - proxy
    labels:
      traefik.enable: true
      traefik.http.routers.homarr.rule: Host(`your.internal.dns.address.here.com`)
      traefik.http.routers.homarr.entrypoints: websecure
      traefik.http.routers.homarr-secure.app: homarr
      traefik.http.apps.homarr.loadbalancer.server.port: 7575

networks:
  proxy:
    external: true
```

### Traefik with Cloudflare DNS challenge

```yaml
services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    ports:
      - 80:80
      - 443:443
    environment:
      - CF_API_EMAIL=yourcfemail@here.com
      - CF_DNS_API_TOKEN=long-token-from-cf
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.websecure.http.tls.certResolver=cloudflare"
      - "--certificatesresolvers.cloudflare.acme.storage=acme.json"
      - "--certificatesResolvers.cloudflare.acme.dnschallenge.provider=cloudflare"
      - "--certificatesResolvers.cloudflare.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53"
      - "--serversTransport.insecureSkipVerify=true"  # required if Proxmox is behind Traefik
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/acme.json:/acme.json

networks:
  proxy:
    external: true
```

- `--serversTransport.insecureSkipVerify=true` — prevents Proxmox's self-signed cert from causing HTTP 500
- Both services must share the **same named network** (`proxy`)
- Create the network manually: `docker network create proxy`

---

## Securing Homarr with Caddy

### docker-compose.yml

```yaml
services:
  homarr:
    # ... homarr config
    networks:
      - proxy          # must share network with Caddy

  caddy:
    container_name: caddy
    image: caddy:2
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
      - 443:443/udp
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    networks:
      - proxy

volumes:
  caddy_data:
  caddy_config:

networks:
  proxy:
    external: true
```

### Caddyfile (same directory as docker-compose.yml)

```
homarr.mydomain.com {
    reverse_proxy homarr:7575
}
```

Caddy handles automatic TLS — no manual cert config needed for public domains.

---

## Key Takeaways

- Self-signed cert issues → upload cert via [[wiki/homelab/homarr-certificates|Certificates page]], not env vars
- Traefik setup requires explicit `networks:` on both Homarr and Traefik services sharing the same external network
- `SECRET_ENCRYPTION_KEY` must be a 64-char hex string — generate with `openssl rand -hex 32`
- `--serversTransport.insecureSkipVerify=true` in Traefik config is the fix for Proxmox HTTP 500 errors
- Caddy is simpler: Caddyfile + shared network is all that's needed; auto-TLS included
- For Portainer + Traefik, follow [Portainer's official docs](https://docs.portainer.io/advanced/reverse-proxy/traefik) and only add Homarr labels

---

## Related

- [[wiki/homelab/homarr-certificates|Homarr Certificates — Trusted Certificate Management]]
- [[wiki/homelab/homarr-docker-integration|Homarr Docker Integration — Container Management & Socket Setup]]
- [[wiki/homelab/homarr-proxmox-integration|Homarr Integration — Proxmox]]

---

## Sources

- `raw/Proxies and Certificates  Homarr documentation.md` — Homarr docs v1.59.2
