[newbie] Anytype in Docker & Traefik

[julianrottenberg]

Hello,
I've been trying over and over again to make Anytype accessible outside my local network via a subdomain (let's call it anytype.example.com). I've read that one has to use TCP proxies to do this; however, I completely fail at implementing this into Traefik. Within my local network, everything is working as intended but the syncing is never able to connect to anything once I'm not connected to my LAN network.

I've tried different things with dynamic .yml files within the traefik/dynamic folder - but didn't manage to get anything that's working. The subdomain is in my client.yml so that's at least something, I suppose.

Has anyone managed to get it working using Traefik or can anyone help me to set it up? I've tried using the Traefik documentation (https://doc.traefik.io/traefik/middlewares/tcp/overview/ & https://doc.traefik.io/traefik/routing/overview/) but that didn't help me whatsoever.

I'd appreciate any help, as I'm stuck.

[fb929]

Hi!
Unfortunately, I'm not familiar with the Traefik project, so I can't provide guidance on its configuration.
However, here are some basic checkpoints:

1. The ports listed there must be accessible to the client. You can check this with:
   telnet <SERVER_HOST> 1001
   QUIC ports cannot be checked this way because they work over UDP.

2. SERVER_HOST (external address or the address of the TCP/UDP proxy) must be set in EXTERNAL_LISTEN_HOSTS.
   Also, make sure that this address appears in the final configuration inside the etc/client.yml file.

[phxyz12]

Hi,

I had this working with Traefik but reverted from the approach: I wanted to expose Anytype via Traefik to the Internet but then learned, that the sync backend does not include any authenticaton. This means, that anyone who the knows the ports could create workspaces on your backend. For this reason, I skipped this attempt and now access Anytype from external via a Wireguard VPN tunnel.

Unfortunately, I didn't save my config. From my memory, I can say:

1. Create entry points (TCP and UDP for the QUIC part) for all required ports
2. Create TCP and UDP routers
3. Use TLS passthrough for the routers
4. Use HostSNI for matching
5. You may use an IP or a FQDN but make sure, that it matches to what you use in your client.yml

If you plan to use Wireguard and access via VPN, using an IP is the simplest approach. This way, you can just set AllowedIPs to your Anytype IP (e.g. 10.10.10.100/32) and you don't need any DNS on the client device.

You may refer to here: https://community.anytype.io/t/anytype-behind-traefik-as-reverse-proxy/27517/6

Note: I didn't use tls: true but tls: passthrough

[grishy]

I have an example for Traefik here - you can copy the config only if you want to use it with the original Docker Compose version.

https://github.com/grishy/any-sync-bundle/blob/v1.1.1-2025-10-16/compose.traefik.yml