DEV Community

Cover image for How to Configure Traefik with Docker Compose
Raizan
Raizan

Posted on Originally published at chasebot.online

How to Configure Traefik with Docker Compose

#devops #tutorial #docker #sysadmin

What You'll Need

Table of Contents

Understanding Traefik Architecture and Edge Routing

When I first started deploying microservices in Docker containers, managing reverse proxies like NGINX or HAProxy felt like an endless loop of manual configuration updates. Every time I added a service, I had to edit configuration files, restart the proxy daemon, and manually configure SSL certificates using Certbot. Traefik completely shifts this paradigm by acting as a cloud-native edge router that dynamically discovers services by reading Docker container events in real time.

Traefik relies on a clear conceptual model built around four core primitives: EntryPoints, Routers, Middlewares, and Services. EntryPoints define the network ports listening for incoming network packets, such as port 80 for HTTP and port 443 for HTTPS. Routers analyze incoming request attributes, such as host headers, path prefixes, or request methods, and decide which dynamic rules apply. Middlewares intercept the request before it reaches the backend, allowing you to modify headers, handle TLS termination, enforce basic authentication, or apply rate limits. Finally, Services direct the incoming connection to the appropriate destination container and load balance across multiple replicas.

       [ Client Request ]
               │
               ▼
      ┌─────────────────┐
      │   EntryPoint    │ (Port 80 / 443)
      └────────┬────────┘
               │
               ▼
      ┌─────────────────┐
      │     Router      │ (Evaluates host rules & path routing)
      └────────┬────────┘
               │
               ▼
      ┌─────────────────┐
      │   Middleware    │ (Auth, Security Headers, Rate Limiting)
      └────────┬────────┘
               │
               ▼
      ┌─────────────────┐
      │     Service     │ (Forward payload to backend container)
      └─────────────────┘
Enter fullscreen mode Exit fullscreen mode

Traefik separates its operational logic into static configuration and dynamic configuration. Static configuration sets up fundamental parameters that do not change frequently, such as entrypoint ports, certificate resolver definitions, logging output formats, and active provider configurations. Dynamic configuration defines the actual routing behavior, certificate details, and middleware pipeline rules.

While dynamic configuration can be loaded from static YAML files, its real power emerges when reading labels attached directly to running Docker containers. When launch commands run on a server hosted with Hetzner VPS or DigitalOcean, Traefik listens directly to the Docker daemon socket, detects container state changes, and instantly updates its internal routing table without dropping active TCP connections or requiring system reloads.

Setting Up Traefik with Docker Compose and Let's Encrypt

To build a production proxy setup, I start by creating a dedicated directory structure on the server. This keeps static configurations, dynamic rules, and Let's Encrypt TLS certificate storage clearly organized. Run the following commands in your server terminal to establish the project workspace:

mkdir -p /opt/traefik/dynamic
touch /opt/traefik/traefik.yml
touch /opt/traefik/dynamic/middlewares.yml
touch /opt/traefik/acme.json
chmod 600 /opt/traefik/acme.json
touch /opt/traefik/docker-compose.yml
Enter fullscreen mode Exit fullscreen mode

The acme.json file holds resolved TLS private keys and public certificate chains issued by Let's Encrypt. Setting its permissions strictly to 600 is mandatory; Traefik will refuse to boot up if the permissions allow broad read or write access from other system users.

Next, open /opt/traefik/traefik.yml and add the static configuration. This file defines entrypoints for port 80 and port 443, configures automatic HTTP-to-HTTPS redirects, enables the Docker engine provider, sets up file-based dynamic configurations, and establishes automatic TLS provision rules:

global:
  checkNewVersion: false
  sendAnonymousUsage: false

log:
  level: INFO
  format: json

accessLog:
  format: json

api:
  dashboard: true
  insecure: false

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true

  websecure:
    address: ":443"
    http:
      tls:
        certResolver: letsencrypt

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    watch: true
  file:
    directory: "/etc/traefik/dynamic"
    watch: true

certificatesResolvers:
  letsencrypt:
    acme:
      email: "admin@example.com"
      storage: "/etc/traefik/acme.json"
      httpChallenge:
        entryPoint: web
Enter fullscreen mode Exit fullscreen mode

Now create the main deployment orchestrator in /opt/traefik/docker-compose.yml. Notice how I use Docker labels on the Traefik container itself to expose the administrative web dashboard securely behind HTTPS using Basic Authentication, without opening exposed management ports to the public internet:

version: "3.8"

networks:
  traefik-proxy:
    external: true

services:
  traefik:
    image: traefik:v3.1
    container_name: traefik
    restart: always
    security_opt:
      - no-new-privileges:true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /opt/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - /opt/traefik/dynamic:/etc/traefik/dynamic:ro
      - /opt/traefik/acme.json:/etc/traefik/acme.json
    networks:
      - traefik-proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.middlewares=admin-auth@file"
Enter fullscreen mode Exit fullscreen mode

Before bringing this stack online, create the external Docker network that will act as the shared network bridge between Traefik and any downstream services:

docker network create traefik-proxy
Enter fullscreen mode Exit fullscreen mode

💡 Fast-Track Your Project: Don't want to configure this yourself? I build custom n8n pipelines and bots. Message me with code SYS3-DEVTO.

Routing Traffic to Microservices and Securing Routes

With the edge router operating, you can deploy applications to private Docker networks without exposing internal application ports directly to the host networking stack. When hosting applications registered on domain records purchased through Namecheap, Traefik parses container labels dynamically to configure traffic routing.

Below is an example of a multi-service docker-compose.yml file deploying a standard debugging container alongside a production API service. Notice how neither container publishes host ports using the ports block; all ingress traffic passes exclusively through the shared traefik-proxy bridge network:

version: "3.8"

networks:
  traefik-proxy:
    external: true

services:
  whoami-service:
    image: traefik/whoami:v1.10
    container_name: whoami-app
    restart: unless-stopped
    networks:
      - traefik-proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.example.com`)"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls.certresolver=letsencrypt"
      - "traefik.http.services.whoami.loadbalancer.server.port=80"

  webhook-api:
    image: node:20-alpine
    container_name: webhook-api
    restart: always
    working_dir: /app
    command: node index.js
    environment:
      - PORT=3000
      - NODE_ENV=production
    networks:
      - traefik-proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.webhook.rule=Host(`api.example.com`) && PathPrefix(`/webhooks`)"
      - "traefik.http.routers.webhook.entrypoints=websecure"
      - "traefik.http.routers.webhook.tls.certresolver=letsencrypt"
      - "traefik.http.routers.webhook.middlewares=rate-limit@file,secure-headers@file"
      - "traefik.http.services.webhook.loadbalancer.server.port=3000"
Enter fullscreen mode Exit fullscreen mode

When building public-facing API endpoints designed to process inbound payloads from third parties, routing setup is only step one. For instance, when accepting inbound transactional hooks, implementing proper validation measures like Implementing HMAC Signature Verification for Inbound Webhooks ensures that unauthenticated traffic hitting your application through Traefik gets dropped before causing downstream state changes.

Additionally, high-volume webhook ingestion tiers operating behind Traefik can quickly overwhelm standard synchronous web framework processes. To prevent upstream request dropouts, coupling Traefik's reverse proxy logic with patterns like Building Distributed Webhook Consumers with Redis Queues allows incoming HTTP requests to be safely acknowledged and offloaded to worker pools instantly.

Advanced Traefik Middlewares and Production Hardening

Middlewares allow you to transform request pipelines dynamically before payloads reach upstream applications. I manage reusable global middlewares inside file-based dynamic configurations. This separates security policy definitions from individual application docker-compose.yml deployment files.

Open /opt/traefik/dynamic/middlewares.yml and insert these production-grade authentication, header management, and rate-limiting rules:

http:
  middlewares:
    admin-auth:
      basicAuth:
        users:
          - "admin:$apr1$q8A33p3z$631e50s8p.23831A/A.01/"

    secure-headers:
      headers:
        sslRedirect: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        forceSTSHeader: true
        contentTypeNosniff: true
        browserXssFilter: true
        referrerPolicy: "no-referrer-when-downgrade"
        customFrameOptionsValue: "SAMEORIGIN"
        customResponseHeaders:
          X-Powered-By: ""
          Server: ""

    rate-limit:
      rateLimit:
        average: 100
        burst: 50

    api-stripprefix:
      stripPrefix:
        prefixes:
          - "/api/v1"
Enter fullscreen mode Exit fullscreen mode

The admin-auth middleware above uses htpasswd encrypted credentials. To generate your own strong credentials string without risking raw password leaks, run the following terminal command using htpasswd:

htpasswd -nb admin YourSecurePasswordHere
Enter fullscreen mode Exit fullscreen mode

When deploying distributed processing engines behind your network gateway, combining Traefik middleware logic with background worker setups such as Building Distributed Python Task Schedulers with Dramatiq keeps long-running background executions separated from web edge infrastructure. Traefik handles web traffic ingress cleanly while active worker pools process execution queues asynchronously in isolated containers.

To initialize your deployment with these configurations active, verify your file directory setup and start the core reverse proxy stack:

cd /opt/traefik
docker compose up -d
Enter fullscreen mode Exit fullscreen mode

You can verify that Traefik successfully initialized and bound its interfaces by reading the operational container execution logs:

docker compose logs -f traefik
Enter fullscreen mode Exit fullscreen mode

When new containers launch on your server hosting platform, Traefik automatically detects the added dynamic routing rules, generates Let's Encrypt TLS certs over port 80/443 challenges, applies defined middleware security blocks, and routes traffic cleanly without requiring system reloads.

Getting Started

Building an automated, secure infrastructure tier starts with choosing reliable server hardware and domain configuration tools. Launching high-availability instances using Hetzner VPS or Contabo VPS provides the compute performance required for resource-intensive edge proxy routing. If you require alternative cloud infrastructure choices, running docker environments on DigitalOcean offers predictable network throughput across regional datacenters. Manage your core host domains using Namecheap to easily create A and CNAME records pointing straight to your reverse proxy IP address. Finally, integrate workflow automation engines using n8n Cloud to build real-time monitoring and uptime notification alerts straight to your management channels.

Outsource Your Automation

Don't have time? I build production n8n workflows, WhatsApp bots, and fully automated YouTube Shorts pipelines. Hire me on Fiverr, mention SYS3-DEVTO for priority. Or DM at chasebot.online.

Originally published on Automation Insider.

Top comments (0)