Traefik Reverse Proxy

Traefik v3 running in Docker with file-based routing and automatic Let's Encrypt certificates.

Structure

├── docker-compose.yml     # Traefik container
├── traefik.yml            # Static config (entrypoints, ACME, file provider)
├── routes/
│   ├── example.yml        # Route template — copy and rename to add services
│   └── *.yml              # Your route files (gitignored)
└── acme/
    └── acme.json          # Certificate storage (gitignored, chmod 600)

Setup

# Create certificate storage
mkdir -p acme
touch acme/acme.json
chmod 600 acme/acme.json

# Add your routes
cp routes/example.yml routes/myapp.yml
# Edit routes/myapp.yml with your domain and upstream

# Start
docker compose up -d

Adding a route

Create a YAML file in routes/. Traefik watches the directory and picks up changes automatically — no restart needed.

http:
  routers:
    myapp:
      rule: "Host(`myapp.example.com`)"
      entryPoints:
        - websecure
      service: myapp
      tls:
        certResolver: letsencrypt

  services:
    myapp:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:3000"

Path-based routing uses priority to ensure specific paths match before the catch-all:

http:
  routers:
    api:
      rule: "Host(`example.com`) && PathPrefix(`/api`)"
      priority: 100
      # ...
    app:
      rule: "Host(`example.com`)"
      priority: 50
      # ...

See routes/example.yml for a full template.

How it works

• Entrypoints: Port 80 (HTTP, redirects to HTTPS) and port 443 (HTTPS)
• TLS: Automatic via Let's Encrypt HTTP-01 challenge
• Routing: File-based provider watching routes/ with hot-reload
• Network: network_mode: host so Traefik can reach localhost services directly
• Certs: Stored in acme/acme.json, auto-renewed

Commands

docker compose up -d      # Start
docker compose down        # Stop
docker compose logs -f     # Follow logs
docker compose restart     # Restart