DEV Community

Alex Spinov
Alex Spinov

Posted on

Traefik Has a Free API — Auto-Discovery Reverse Proxy With Free HTTPS

#traefik #docker #devops #webdev

Traefik is the cloud-native reverse proxy and load balancer that automatically discovers your services — Docker, Kubernetes, and more. Free HTTPS with Let's Encrypt, zero config routing.

Why Traefik?

  • Auto-discovery — detects Docker containers and routes traffic automatically
  • Free HTTPS — Let's Encrypt certificates with zero config
  • Dashboard — beautiful real-time monitoring UI
  • Middleware — rate limiting, auth, headers, compression built in
  • Multi-provider — Docker, Kubernetes, file, Consul, etcd
  • Canary deployments — weighted routing between versions

Quick Start (Docker) 

# docker-compose.yaml
services:
  traefik:
    image: traefik:v3.2
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=you@example.com"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"  # Dashboard
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt:/letsencrypt

  # Your app — Traefik routes traffic automatically!
  api:
    image: my-api:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`api.example.com`)"
      - "traefik.http.routers.api.tls.certresolver=letsencrypt"

  frontend:
    image: my-frontend:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.frontend.rule=Host(`app.example.com`)"
      - "traefik.http.routers.frontend.tls.certresolver=letsencrypt"

volumes:
  letsencrypt:
Enter fullscreen mode Exit fullscreen mode 
docker compose up -d
# Dashboard: http://localhost:8080
# api.example.com → routes to api container
# app.example.com → routes to frontend container
# HTTPS certificates generated automatically!
Enter fullscreen mode Exit fullscreen mode

Path-Based Routing 

services:
  api:
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`example.com`) && PathPrefix(`/api`)"
      - "traefik.http.services.api.loadbalancer.server.port=4000"

  frontend:
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.frontend.rule=Host(`example.com`)"
      - "traefik.http.services.frontend.loadbalancer.server.port=3000"
Enter fullscreen mode Exit fullscreen mode

example.com/api/* goes to API, everything else goes to frontend.

Middleware 

services:
  api:
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`api.example.com`)"

      # Rate limiting
      - "traefik.http.middlewares.api-ratelimit.ratelimit.average=100"
      - "traefik.http.middlewares.api-ratelimit.ratelimit.burst=50"

      # Compression
      - "traefik.http.middlewares.api-compress.compress=true"

      # Headers
      - "traefik.http.middlewares.api-headers.headers.customresponseheaders.X-Frame-Options=DENY"
      - "traefik.http.middlewares.api-headers.headers.customresponseheaders.X-Content-Type-Options=nosniff"

      # Chain middleware
      - "traefik.http.routers.api.middlewares=api-ratelimit,api-compress,api-headers"
Enter fullscreen mode Exit fullscreen mode

Basic Auth 

services:
  admin:
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.admin.rule=Host(`admin.example.com`)"
      # Generate: htpasswd -nb admin password123
      - "traefik.http.middlewares.admin-auth.basicauth.users=admin:$$apr1$$xyz$$hash"
      - "traefik.http.routers.admin.middlewares=admin-auth"
Enter fullscreen mode Exit fullscreen mode

Load Balancing (Scale Services) 

# Scale your API to 5 instances
docker compose up -d --scale api=5
Enter fullscreen mode Exit fullscreen mode

Traefik automatically detects all 5 instances and load balances between them. No config changes needed.

HTTP to HTTPS Redirect 

services:
  traefik:
    command:
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
Enter fullscreen mode Exit fullscreen mode

All HTTP traffic redirected to HTTPS automatically.

Canary Deployments 

services:
  api-v1:
    image: my-api:v1
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`api.example.com`)"
      - "traefik.http.services.api-v1.loadbalancer.server.port=3000"

  api-v2:
    image: my-api:v2
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.api-v2.loadbalancer.server.port=3000"

  # Weighted routing: 90% to v1, 10% to v2
  traefik:
    labels:
      - "traefik.http.services.api.weighted.services[0].name=api-v1"
      - "traefik.http.services.api.weighted.services[0].weight=90"
      - "traefik.http.services.api.weighted.services[1].name=api-v2"
      - "traefik.http.services.api.weighted.services[1].weight=10"
Enter fullscreen mode Exit fullscreen mode

Traefik vs Nginx vs Caddy vs HAProxy

Feature Traefik Nginx Caddy HAProxy
Auto-discovery Docker/K8s native Manual config Manual Manual
Auto HTTPS Let's Encrypt Certbot (manual) Built-in Manual
Dashboard Built-in Nginx Plus (paid) No Stats page
Docker labels Yes (zero config) No No No
Config reload Hot (automatic) Reload signal Hot Reload signal
Canary deploy Weighted routing upstream No Backend weights
K8s Ingress Native Ingress controller No Ingress controller

Need to scrape data from any website and get it in structured JSON? Check out my web scraping tools on Apify — no coding required, results in minutes.

Have a custom data extraction project? Email me at spinov001@gmail.com — I build tailored scraping solutions for businesses.

Top comments (0)