One entry, one login — nothing else
No sprawl of open ports. Requests pass exactly one HTTPS entry point, a reverse proxy with a wildcard certificate, and a central SSO gate. Internal services are simply unreachable from outside.
🔀Reverse proxy & TLS
Traefik terminates TLS and routes every request. A single wildcard certificate covers all subdomains and renews automatically — no per-service cert management.
🔑Single sign-on
Authentik sits as identity provider in front of every service. One login via OIDC or ForwardAuth is enough — without a valid session, no one reaches an app.
🧩Docker networks
Containers attach only to the networks they actually need — proxy net, database net, stack-internal. Least attachment instead of "everything talks to everything."
🚪Internal only
Databases, caches and the diagram renderer are reachable internally only and never appear in the public routing.