DNS & Reverse Proxy Infrastructure (Cloudflare + Namecheap)

A complete self-hosted DNS + reverse proxy stack using BIND9, Traefik, and Docker Compose, supporting both Cloudflare (default) and Namecheap for automated DNS-based SSL certificates via Let’s Encrypt (ACME).
Designed as a DevOps lab project for managing custom DNS, HTTPS, and containerized infrastructure.

🚀 Overview

This project simulates a production-grade DNS and reverse proxy setup:

BIND9 acts as an authoritative DNS for your custom domain.
Traefik handles HTTPS termination and automatic certificate generation.
You can switch between Cloudflare or Namecheap as the DNS API provider without editing configuration files.
Managed entirely with a single deploy.sh script.

Built and tested on Ubuntu Server 24.04 LTS using Docker Compose, all services communicate on a shared frontend network.

🧩 Components

Component	Description
BIND9	Authoritative DNS server for your internal or public domain (e.g. `anganba.me`)
Traefik v3.5	Reverse proxy providing HTTPS with automatic certificate renewal
Let's Encrypt (ACME)	SSL/TLS certificate authority used via DNS challenge
Cloudflare / Namecheap	Supported DNS APIs for ACME DNS-01 challenge
Nginx	Example backend web service
Portainer	Web-based UI for Docker management

🧠 Architecture Diagram

                ┌─────────────────────┐
                │     Client (Web)    │
                └─────────┬───────────┘
                          │ HTTPS (443)
                          ▼
                ┌──────────────────────┐
                │      Traefik         │
                │  Reverse Proxy + SSL │
                └─────────┬────────────┘
                          │ Internal network (frontend)
          ┌───────────────┴───────────────┐
          │                               │
  ┌──────────────┐              ┌─────────────────┐
  │   Nginx App  │              │   Portainer UI  │
  └──────────────┘              └─────────────────┘
          │                               │
          ▼                               ▼
 nginx.alo.anganba.me        portainer.alo.anganba.me
          │                               │                          
          ▼                               ▼   
┌────────────────────────────────────────────────────┐
│                    BIND9 DNS                       │
│              ns.anganba.me (local)                 │
└────────────────────────────────────────────────────┘

⚙️ Features

🔄 Switch between Cloudflare and Namecheap DNS easily
🔐 Automated SSL via Let's Encrypt DNS-01 challenge
🧩 Modular services (Traefik, BIND9, Nginx, Portainer)
📜 Single deployment script (deploy.sh)
🧠 Local authoritative DNS management
🧱 Real-world DevOps lab setup

🛠 Setup & Deployment

1️⃣ Prerequisites

A valid domain name (e.g., anganba.me)
API credentials for Cloudflare and/or Namecheap

Installed dependencies:

sudo apt install docker.io docker-compose -y

A Linux server or VM (tested on Ubuntu Server 24.04)

2️⃣ Clone Repository

git clone https://github.com/Anganba/TraeDNS.git
cd TraeDNS

3️⃣ Configure Provider Environments

You can use either Cloudflare (default) or Namecheap.

For Cloudflare (`Traefik/.env.cloudflare`)

sudo nano Traefik/.env.cloudflare

PROVIDER=cloudflare
ACME_EMAIL=info@yourdomain
CF_DNS_API_TOKEN=your_cloudflare_api_token

For Namecheap (`Traefik/.env.namecheap`)

sudo nano Traefik/.env.namecheap

PROVIDER=namecheap
ACME_EMAIL=info@yourdomain
NAMECHEAP_API_USER=your_username
NAMECHEAP_API_KEY=your_api_key
NAMECHEAP_API_URL=https://api.namecheap.com/xml.response

4️⃣ Adjust DNS Zone File

Update the zone file for your domain in:

bind9/config/anganba-me.zone

Example:

ns     IN  A   192.168.68.129
alo    IN  A   192.168.68.129
*.alo  IN  A   192.168.68.129

Replace 192.168.68.129 with your server’s IP address.

If you skip this step, DNS queries and SSL validation will fail.

Also Your Namecheap account must have: API access enabled under “Profile → Tools → Namecheap API Access”. Your host’s public IP added to the “API Whitelist IPs” section. If you don't have your local VMs' public IP or VPS IP get whitelisted in the Namecheap API section, TLS Handshake will fail.

5️⃣ Deploy the Stack

Create a network called "frontend" since it is hardcoded in the script. Run:

sudo docker network create frontend

Make the deploy script executable:

sudo chmod +x deploy.sh

Then start the full infrastructure:

sudo ./deploy.sh up

To switch providers:

sudo ./deploy.sh up namecheap

Check running status:

sudo ./deploy.sh status

The usage of the deploy script:

Usage: sudo ./deploy.sh {up|down|restart|status} [cloudflare|namecheap]

Examples:
  ./deploy.sh up                 # Start stack using Cloudflare (default)
  ./deploy.sh up namecheap       # Start stack using Namecheap
  ./deploy.sh restart cloudflare # Restart stack using Cloudflare
  ./deploy.sh status             # Show running containers

🌐 Access Services

Service	URL	Description
Traefik Dashboard	https://traefik.alo.anganba.me	Reverse proxy UI (insecure mode ON for lab)
Portainer	https://portainer.alo.anganba.me	Docker management UI
Nginx Demo	https://nginx.alo.anganba.me	Example app

🧪 DNS Testing

Check your DNS server resolution:

dig @192.168.68.129 portainer.alo.anganba.me

Test from client machine:

nslookup nginx.alo.anganba.me 192.168.68.129

🔒 SSL Certificate Automation

Certificates are automatically generated and renewed using Let’s Encrypt DNS challenge.

Stored in:

Traefik/data/certs/cloudflare-acme.json
Traefik/data/certs/namecheap-acme.json

Set permissions:

sudo chmod 600 Traefik/data/certs/*.json

🧱 Troubleshooting

⚠️ TLS Handshake Errors

Check file permissions for ACME files
Verify DNS A-records resolve correctly
Wait 5–10 minutes for DNS propagation
Ensure correct API tokens or keys are in .env files

⚠️ DNS Not Resolving

Confirm named.conf includes your zone
Run:
```
docker logs dns-bind9
```
to verify successful zone loading.

⚠️ ACME Errors (“NXDOMAIN” or “invalid TLD”)

Ensure domain/subdomain exists in your DNS zone.
Let’s Encrypt does not issue certificates for internal-only domains (e.g., .local).

⚠️ Update Your DNS Settings

If you want to access those https://traefik.yea.zenorahost.com in your windows or local machine, make sure to point your DNS settings preferred DNS to VM's IP where DNS server is running and as alternative DNS use 1.1.1.1 or 8.8.8.8.

📂 Project Structure

dns-traefik-lab/
├── bind9/
│   ├── config/
│   │   ├── named.conf
│   │   └── anganba-me.zone
│   ├── cache/
│   ├── records/
│   └── docker-compose.yaml
├── Traefik/
│   ├── config/
│   │   └── traefik.yaml
│   ├── data/certs/
│   │   ├── cloudflare-acme.json
│   │   └── namecheap-acme.json
│   ├── .env.cloudflare
│   ├── .env.namecheap
│   └── docker-compose.yaml
├── nginx/
│   └── docker-compose.yaml
├── Portainer-Server/
│   └── docker-compose.yaml
├── deploy.sh
└── README.md

📸 Demo Screenshots

dig DNS resolution showing correct IP mapping
Traefik dashboard with routers + TLS certs
NGINX Browser view with HTTPS padlock
Portainer dashboard running behind Traefik

🧩 Future Enhancements

Add HAProxy for load balancing
Enable IPv6 for Traefik and BIND9
Integrate Grafana + Prometheus monitoring
Add Automatic DNS Sync with Cloudflare API

🪪 License

MIT License — Free for educational and demonstration use.

🌐 Author

Anganba Singha
DevOps | Linux Server Administrator | Cybersecurity Enthusiast

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

DNS & Reverse Proxy Infrastructure (Cloudflare + Namecheap)

🚀 Overview

🧩 Components

🧠 Architecture Diagram

⚙️ Features

🛠 Setup & Deployment

1️⃣ Prerequisites

2️⃣ Clone Repository

3️⃣ Configure Provider Environments

For Cloudflare (`Traefik/.env.cloudflare`)

For Namecheap (`Traefik/.env.namecheap`)

4️⃣ Adjust DNS Zone File

5️⃣ Deploy the Stack

The usage of the deploy script:

🌐 Access Services

🧪 DNS Testing

🔒 SSL Certificate Automation

🧱 Troubleshooting

⚠️ TLS Handshake Errors

⚠️ DNS Not Resolving

⚠️ ACME Errors (“NXDOMAIN” or “invalid TLD”)

⚠️ Update Your DNS Settings

📂 Project Structure

📸 Demo Screenshots

🧩 Future Enhancements

🪪 License

🌐 Author

About

Uh oh!

Releases

Packages

Uh oh!

Contributors

Uh oh!

Languages

Name		Name	Last commit message	Last commit date
Latest commit History 6 Commits
Portainer-Server		Portainer-Server
Traefik		Traefik
bind9		bind9
nginx		nginx
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
deploy.sh		deploy.sh

Folders and files

Latest commit

History

Repository files navigation

DNS & Reverse Proxy Infrastructure (Cloudflare + Namecheap)

🚀 Overview

🧩 Components

🧠 Architecture Diagram

⚙️ Features

🛠 Setup & Deployment

1️⃣ Prerequisites

2️⃣ Clone Repository

3️⃣ Configure Provider Environments

For Cloudflare (Traefik/.env.cloudflare)

For Namecheap (Traefik/.env.namecheap)

4️⃣ Adjust DNS Zone File

5️⃣ Deploy the Stack

The usage of the deploy script:

🌐 Access Services

🧪 DNS Testing

🔒 SSL Certificate Automation

🧱 Troubleshooting

⚠️ TLS Handshake Errors

⚠️ DNS Not Resolving

⚠️ ACME Errors (“NXDOMAIN” or “invalid TLD”)

⚠️ Update Your DNS Settings

📂 Project Structure

📸 Demo Screenshots

🧩 Future Enhancements

🪪 License

🌐 Author

About

Topics

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

For Cloudflare (`Traefik/.env.cloudflare`)

For Namecheap (`Traefik/.env.namecheap`)

Packages