One entry, one login — nothing else
No sprawl of open ports. Requests pass exactly one HTTPS entry point, a layer of filtering in front of it, a reverse proxy with a wildcard certificate, and a central SSO gate. Internal services are simply unreachable from outside.
Reverse proxy & TLS
Traefik terminates TLS and routes every request. A single wildcard certificate covers all subdomains and renews automatically — no per-service cert management.
Single sign-on
Authentik sits as identity provider in front of every service. One login via OIDC or ForwardAuth is enough — without a valid session, no one reaches an app.
Filter first, compute second
Ahead of the proxy sit a rate limit and a reputation filter: known scanners and hostile addresses are turned away before an application ever sees them. More on the security page.
Docker networks
Containers attach only to the networks they actually need — proxy net, database net, stack-internal. Least attachment instead of "everything talks to everything."
Internal only
Databases, caches and the diagram renderer are reachable internally only and never appear in the public routing.