docker-gc-cron VS docker-traefik-cloudflare-companion

To help prevent any access into my host from the containers if you manage to get past all of that, any container that needs to access the docker socket (Watchtower, Traefik, Portainer, Dozzle, Docker-gc-cron, traefik-cloudflare-companion) get their access through a socket proxy and are all on their own docker network to help prevent access to the socket directly. Socket Proxy

II don’t think this exists for NPM but I use Traefik with https://github.com/tiredofit/docker-traefik-cloudflare-companion which creates DNS entries automatically and Flame dashboard with Docker integration (https://github.com/pawelmalak/flame) which adds new services automatically in my dashboard.

For my reverse proxy I am using Traefik 2 with Authelia as my 2 factor authentication. It works with TOTP and my YubiKey. to compliment this when I add the correct labels to my compose snippet for the respective service, tiredofit's cloudflare traefik companion container will use my cloudflare API key to update my cname records to reflect the subdomain based off my traefik labels. All of my docker containers use docker secrets for important environment variables.

try this https://github.com/tiredofit/docker-traefik-cloudflare-companion

While not sorting the wildcard issue, you can take some of the pain out of it with this: https://github.com/tiredofit/docker-traefik-cloudflare-companion