Support for per VM/LXC network label definition

[ilarrain]

Please provide support for a label specifying the network to use in a VM or container, equivalent to traefik.docker.network, to define the network to use for IP retrieval on a per LXC/VM basis. If an LXC/VM is linked to multiple networks, the plugin just selects the first one that matches the private IP ranges defined in DEFAULT_CIDRS variable.

My specific use case is that my cluster connects to the internet via an OpenWRT VM. My ISP's router can't be configured in bridge mode, so that assigned IP is also in the defined private IP ranges.

OpenWRT VM IP assignments (192.168.55.0/24 is WAN, 192.168.1.0/24 is LAN):

root@OpenWrt-vm:~# ip a s
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether REDACTED
    inet 192.168.55.84/24 brd 192.168.55.255 scope global eth1
       valid_lft forever preferred_lft forever
4: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether REDACTED
    inet 192.168.1.7/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever

Traefik LXC IP assignments (192.168.1.0/24 is LAN, 172.30.40.0/24 is for communicating with docker containers):

traefik:~# ip a s
2: eth0@if65: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether REDACTED
    inet 192.168.1.8/24 brd 192.168.1.255 scope global dynamic noprefixroute eth0
       valid_lft 40560sec preferred_lft 33453sec
4: docker@if67: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1450 qdisc noqueue state UP qlen 1000
    link/ether REDACTED
    inet 172.30.40.8/24 scope global docker
       valid_lft forever preferred_lft forever

Traefik LXC logs (notice ServiceAddr is 192.168.55.84, while it should be 192.168.1.7):

traefik:~# tail -f /var/log/traefik/access.log
{"ClientAddr":"[2400:REDACTED]:12119","ClientHost":"REDACTED","ClientPort":"12119","ClientUsername":"-","DownstreamContentSize":11,"DownstreamStatus":502,"Duration":3056915493,"OriginContentSize":11,"OriginDuration":3051435952,"OriginStatus":502,"Overhead":5479541,"RequestAddr":"openwrt.MYDOMAIN","RequestContentSize":0,"RequestCount":75924,"RequestHost":"openwrt.MYDOMAIN","RequestMethod":"GET","RequestPath":"/","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"openwrt@plugin-traefik-proxmox-provider","ServiceAddr":"192.168.55.84:443","ServiceName":"openwrt@plugin-traefik-proxmox-provider","ServiceURL":"https://192.168.55.84:443","StartLocal":"2026-06-05T16:19:07.355490099Z","StartUTC":"2026-06-05T16:19:07.355490099Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","request_User-Agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36","time":"2026-06-05T16:19:10Z"}

In the internal Proxmox Docker provider, the way to circumvent this is specifying the label traefik.docker.network=traefik_vnet. My request is for this plugin to implement a similar strategy, maybe traefik.proxmox.network=br-lan, traefik.plugin-traefik-proxmox.network=br-lan, or traefik.plugin-traefik-proxmox-provider.network=br-lan.