How to Deploy Traefik as Your Reverse Proxy with Auto-SSL

Traefik is a modern reverse proxy designed for Docker. It reads Docker container labels to automatically discover services and configure routing. New containers get SSL certificates automatically. No manual proxy configuration per application. Here is how to set it up.

Why Traefik Instead of Nginx Proxy Manager

Nginx Proxy Manager is ideal for users who want a graphical interface. Traefik is ideal for users who want automatic configuration driven by Docker labels. With Traefik, deploying a new application means adding labels to its docker-compose.yml. No separate proxy configuration step. The proxy configures itself.

Step 1: Create the Traefik Docker Compose File

services:
  traefik:
    image: traefik:v3.1
    container_name: traefik
    restart: unless-stopped
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@yourdomain.com"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`traefik.yourdomain.com`)"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
      - "traefik.http.services.traefik.loadbalancer.server.port=8080"

Step 2: Create a Shared Docker Network

Traefik needs to communicate with other containers:

docker network create proxy

Add this network to Traefik's compose file:

networks:
  default:
    external: true
    name: proxy

Step 3: Deploy an Application with Traefik Labels

Here is an example application docker-compose.yml that Traefik auto-discovers:

services:
  whoami:
    image: traefik/whoami:latest
    container_name: whoami
    restart: unless-stopped
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.yourdomain.com`)"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls.certresolver=letsencrypt"
      - "traefik.http.services.whoami.loadbalancer.server.port=80"

networks:
  proxy:
    external: true

Run docker compose up -d. Traefik detects the new container, reads its labels, creates a router, requests an SSL certificate, and starts routing traffic. The entire process is automatic. No proxy panel to open. No configuration forms to fill out.

Step 4: Add Middleware for Common Needs

Traefik middleware handles common proxy tasks:

# Rate limiting: 100 requests per second per IP
labels:
  - "traefik.http.middlewares.ratelimit.ratelimit.average=100"
  - "traefik.http.routers.app.middlewares=ratelimit"

# Authentication: basic auth
labels:
  - "traefik.http.middlewares.auth.basicauth.users=admin:$$2y$$..."
  - "traefik.http.routers.app.middlewares=auth"

# Redirect www to non-www
labels:
  - "traefik.http.middlewares.redirect-to-non-www.redirectregex.regex=^https://www\.(.+)"
  - "traefik.http.middlewares.redirect-to-non-www.redirectregex.replacement=https://$${1}"

Step 5: Access the Dashboard

Open https://traefik.yourdomain.com. The dashboard shows every router, service, and middleware. It shows active connections, TLS certificates, and provider status. Use it to verify that your configuration is correct and to debug routing issues.

If Traefik labels and Docker networks sound like a configuration puzzle you would rather not solve, VPS1 deploys your reverse proxy with auto-SSL. We configure Traefik or Nginx Proxy Manager based on your preference. Every application gets SSL automatically. You focus on your business.