Chapter Introduction
Overview
This chapter documents the foundational infrastructure layer that all other services depend on. These nine services form the backbone of the Centerpoint stack — handling reverse proxying, TLS, identity, DNS, threat detection, logging, and observability.
Services in This Chapter
| Service | Container(s) | Purpose |
|---|---|---|
| Traefik v3 | traefik |
Reverse proxy and TLS termination |
| Step-CA | step-ca |
Internal ACME certificate authority |
| Portainer EE | portainer |
Docker container management UI |
| Authentik | authentik-server, authentik-worker, authentik-postgresql, authentik-geoip |
SSO / identity provider |
| AdGuard Home | adguardhome |
LAN DNS resolver and ad blocking |
| CrowdSec | crowdsec, crowdsec-bouncer-traefik |
Collaborative threat detection and blocking |
| Dozzle | dozzle |
Real-time container log viewer |
| Uptime-Kuma | uptime-kuma |
Service uptime and endpoint monitoring |
| Homepage | homepage |
Homelab dashboard |
Dependency Order
When starting from scratch, services must come up in this order:
- AdGuard Home —
*.home.localDNS must resolve before anything can find its neighbours - Step-CA — required for Traefik to issue internal certificates on first boot
- Traefik — all named HTTPS routes depend on it
- Authentik (PostgreSQL → Server → Worker) — required before any externally-accessible service that enforces SSO
- CrowdSec → CrowdSec Bouncer — bouncer cannot connect to LAPI until CrowdSec is healthy
- All other infrastructure services (Portainer, Dozzle, Uptime-Kuma, Homepage) can start in any order
Last Updated: 2026-06-16