Architecture · Traefik + Cloudflare
Requests take one path, certificates another
Traefik behind Cloudflare with ACME DNS-01
Visitor requests go through the Cloudflare proxy to Traefik on the edge network and on to the containers; certificates come from DNS-01, where Traefik writes a TXT record through the Cloudflare DNS API for Let's Encrypt to check, so no validation request reaches the origin; the web app in another zone gets no certificate.
VPS · NETWORK EDGE
HTTPS
HTTPS :443
ORDER CERT
CREATE TXT
CHECK TXT
Cloudflare DNS API
TXT _acme-challenge
Let's Encrypt
ACME · DNS-01
Visitor
browser
Cloudflare proxy
proxied · Full (strict)
Traefik v3
entrypoint :443 · ACME
10 WordPress sites
6 labels per site
.NET API · Angular app
traefik.enable=true
Event web app
other zone → no cert
LEGEND
DNS-01: Traefik writes a TXT record via the API, nothing touches the origin
Visitor request
Domain outside the token's zone
© tiennhm