Expose Local Apps with Traefik and Ngrok in Docker

When you build a homelab on a local VM, you may eventually want to share a project with teammates or friends. This guide combines Traefik and Ngrok to expose selected local services through a controlled public URL.

Traefik is a reverse proxy, load balancer, and API gateway. Think of it as a "gatekeeper": when a request arrives, Traefik reads the routing rules and forwards the request to the correct application.

For example, requests to /prome can be routed to Prometheus on port 9090. The client only needs to access the Traefik port, such as http://localhost:8000/prome.

The sections below explain both tools, including their strengths and trade-offs.

Traefik is a modern reverse proxy and load balancer designed for deploying microservices. It discovers configuration dynamically from providers such as Docker and Kubernetes by inspecting metadata such as Docker Compose labels in real time.

Ngrok provides reverse proxy and tunneling capabilities that make a local service reachable from the internet. On the free tier, one public URL can be used to expose a single service at a time.

Anyone other than the laptop owner reaches the local website through the configured public Ngrok URL. The owner can still access the service locally or through the public endpoint.

• Minimum RAM: 9 GB (16 GB recommended)
• CPU: 4 cores
• Storage: 35 GB

This example runs Prometheus in Docker. Start by creating docker-compose.yml.

nano docker-compose.yml

• Add the following Prometheus service configuration.
  yaml

  services:
    prometheus:
      image: prom/prometheus:latest
      container_name: prometheus
      ports:
        - "9090:9090"
      command:
        - '--config.file=/etc/prometheus/prometheus.yml'
        - '--web.route-prefix=/'
      volumes:
        - ./prome/prometheus.yaml:/etc/prometheus/prometheus.yml:ro
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.prom.rule=PathPrefix(`/prome`)"
        - "traefik.http.routers.prom.entrypoints=web"
        - "traefik.http.middlewares.prom-strip.stripprefix.prefixes=/prome"
        - "traefik.http.routers.prom.middlewares=prom-strip"
        - "traefik.http.services.prom.loadbalancer.server.port=9090"
      networks:
        - monitoring
  

Configuration Notes

• Create the Prometheus configuration at ./prome/prometheus.yaml.

  bash

  mkdir prome
  cd prome
  nano prometheus.yaml
  

• Use the following scrape configuration. This example uses Prometheus as the only target and does not yet integrate additional exporters.

  yaml

  global:
    scrape_interval: 15s
  
  scrape_configs:
    - job_name: "prometheus"
      static_configs:
        - targets: ["localhost:9090"]
  

• Open docker-compose.yml again.

  bash

  nano docker-compose.yml
  

• Add the following Grafana service configuration.

  yaml

  services:
    grafana:
      image: grafana/grafana:latest
      container_name: grafana
      ports:
        - "3000:3000"
      environment:
        - GF_SERVER_ROOT_URL=http://172.1.1.12:3000/grafana/
        - GF_SERVER_SERVE_FROM_SUB_PATH=true
      volumes:
        - grafana-storage:/var/lib/grafana
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.grafana.rule=PathPrefix(`/grafana`)"
        - "traefik.http.services.grafana.loadbalancer.server.port=3000"
        - "traefik.http.routers.grafana.entrypoints=web"
      networks:
        - monitoring
  

Configuration Notes

• Open docker-compose.yml again.

  bash

  nano docker-compose.yml
  

• Add the Traefik service together with the network and Grafana storage configuration.

  yaml

  services:
  traefik:
    image: traefik:v3.1
    container_name: traefik
    command:
      - "--entrypoints.web.address=:9000"
      - "--providers.docker=true"
      - "--api.dashboard=true"
      - "--log.level=info"
      - "--api.insecure=true"
    ports:
      - "9000:9000"        # main Prometheus and Grafana endpoint
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - monitoring
  
  volumes:
    grafana-storage:
  
  networks:
    monitoring:
      driver: bridge
  

• Start the three services.

  bash

  docker-compose up -d
  

• Wait for the services to start. If a container exits, inspect its logs with:

  bash

  docker logs {SERVICE_NAME}
  
  # exp:
  docker logs prome
  docker logs traefik
  docker logs grafana
  

Docker Compose Configuration Notes

• Create an Ngrok account if you do not already have one, then sign in.

• Open the VM or homelab you want to expose publicly.

• Add the Ngrok repository and install the client. The commands below target Ubuntu; adjust them for your distribution.

  bash

  curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \
      | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \
      && echo "deb https://ngrok-agent.s3.amazonaws.com bookworm main" \
      | sudo tee /etc/apt/sources.list.d/ngrok.list \
      && sudo apt update \
      && sudo apt install ngrok jq -y
  

• Add the authentication token shown in the Ngrok dashboard.

  bash

  ngrok config add-authtoken {AUTH_TOKEN_NGROK}
  

• Run Ngrok as a background service instead of starting ngrok http {PORT} manually.

  bash

  nano /etc/systemd/system/ngrok.service
  

• Add the following service definition and replace {PORT_TRAEFIK} with the Traefik port. This example uses port 9000.

  bash

  [Unit]
  Description=Ngrok Tunnel
  After=network.target
  
  [Service]
  ExecStart=/usr/local/bin/ngrok http 9000 --log=stdout
  Restart=on-failure
  User=root
  StandardOutput=file:/var/log/ngrok.log
  StandardError=file:/var/log/ngrok_error.log
  
  [Install]
  WantedBy=multi-user.target
  

• Reload systemd, then start and enable Ngrok.

  bash

  sudo systemctl daemon-reload
  sudo systemctl start ngrok
  sudo systemctl enable ngrok
  

From a laptop browser, validate Prometheus and Grafana at https://{NGROK_URL}/prome and https://{NGROK_URL}/grafana.

Prometheus

Grafana