How to Set Up Traefik Reverse Proxy with Docker and Auto Let’s Encrypt SSL

Why Traefik Has Revolutionized Container Routing

In traditional multi-container web architectures, deploying a new microservice behind Nginx or Apache requires manually writing a new virtual host configuration file, obtaining SSL certificates via Certbot, and reloading the web server daemon. When containers are scaled up or down frequently in Docker Compose, this manual configuration process is error-prone and tedious.

Traefik is a modern HTTP reverse proxy and ingress controller designed specifically for containerized microservices. By listening directly to the Docker socket API, Traefik dynamically discovers newly created containers, parses their metadata labels, creates routing rules on the fly, and automatically provisions Let’s Encrypt SSL certificates without requiring a single server reload.

In this production-ready deployment guide, we will configure Traefik v3 on Ubuntu 24.04/22.04 LTS using Docker Compose, secure the Traefik management dashboard, and route traffic to backend containers using dynamic Docker labels.

Step 1: Preparing Directory Structure & ACME Storage

Create a dedicated directory for Traefik and initialize the acme.json certificate store with strict 600 permissions:

# Create Traefik directory structure
sudo mkdir -p /var/www/traefik
cd /var/www/traefik

# Create acme.json file with restricted permissions
touch acme.json
chmod 600 acme.json

# Create dedicated Docker network
docker network create web-gateway

Step 2: Creating Traefik Docker Compose Stack

Create /var/www/traefik/docker-compose.yml:

services:
  traefik:
    image: traefik:v3.1
    container_name: traefik_router
    restart: always
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entryPoints.web.address=:80"
      - "--entryPoints.websecure.address=:443"
      # Global HTTP to HTTPS Redirection
      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
      # ACME Let's Encrypt Automated SSL
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "[email protected]"
      - "--certificatesresolvers.myresolver.acme.storage=/acme.json"
    ports:
      - "80:80"
      - "443:443"
    networks:
      - web-gateway
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./acme.json:/acme.json
    labels:
      - "traefik.enable=true"
      # Dashboard Routing & Basic Auth Protection
      - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.traefik-dashboard.service=api@internal"
      - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
      - "traefik.http.routers.traefik-dashboard.tls.certresolver=myresolver"
      - "traefik.http.routers.traefik-dashboard.middlewares=auth"
      # Generate hashed password with: htpasswd -nb admin yourpassword
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$xyz$$randomhash"

networks:
  web-gateway:
    external: true

Step 3: Launching Traefik Gateway

# Start Traefik in detached daemon mode
docker compose up -d

# Verify Traefik logs and ACME challenges
docker compose logs -f

Step 4: Deploying Microservice Containers with Traefik Labels

To expose any application container (e.g. Next.js, WordPress, or Go API) through Traefik with automated HTTPS, simply attach the web-gateway network and declare Traefik labels in its compose file:

services:
  whoami_app:
    image: traefik/whoami
    container_name: demo_whoami
    restart: always
    networks:
      - web-gateway
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`demo.example.com`)"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls.certresolver=myresolver"
      - "traefik.http.services.whoami.loadbalancer.server.port=80"

networks:
  web-gateway:
    external: true

When you run docker compose up -d on the application, Traefik immediately discovers the new container, issues a Let’s Encrypt certificate, and begins routing HTTPS traffic to https://demo.example.com in seconds!

Traefik vs Traditional Nginx Routing Comparison

Implementing Rate Limiting & Security Middlewares in Traefik

Protect your containerized microservices from denial-of-service floods and brute-force scans using Traefik’s built-in rate-limiting and security header middlewares:

# Add Security & Rate-Limit Middlewares in docker-compose.yml
labels:
  # Rate limit: Maximum 30 requests per second with burst capacity of 50
  - "traefik.http.middlewares.rate-limit.ratelimit.average=30"
  - "traefik.http.middlewares.rate-limit.ratelimit.burst=50"
  
  # Security Headers (HSTS, XSS Protection, Frame Options)
  - "traefik.http.middlewares.sec-headers.headers.stsSeconds=31536000"
  - "traefik.http.middlewares.sec-headers.headers.browserXssFilter=true"
  - "traefik.http.middlewares.sec-headers.headers.contentTypeNosniff=true"
  - "traefik.http.middlewares.sec-headers.headers.customFrameOptionsValue=SAMEORIGIN"
  
  # Apply Middlewares to Router
  - "traefik.http.routers.whoami.middlewares=rate-limit,sec-headers"

Enabling HTTP/3 (QUIC) Support in Traefik v3

Accelerate mobile connection speeds over UDP by enabling HTTP/3 support on entrypoint websecure:

command:
  - "--entryPoints.websecure.address=:443/tcp"
  - "--entryPoints.websecure.http3=true"
  - "--entryPoints.websecure.http3.advertisedPort=443"
ports:
  - "443:443/tcp"
  - "443:443/udp" # Required for UDP QUIC packets

Traefik Diagnostic Commands

• docker compose logs -f traefik: Stream live routing events and ACME certificate challenge handshakes.
• curl -Iv https://demo.example.com: Inspect HTTP/2 or HTTP/3 negotiation headers.

Centralized Traefik Access Logging & Metrics Export to Prometheus

Observability in dynamic container environments is critical. Traefik includes native metric exporters for Prometheus and OpenTelemetry. Enable Prometheus metrics in Traefik’s command directives:

command:
  - "--metrics.prometheus=true"
  - "--metrics.prometheus.entryPoint=metrics"
  - "--entryPoints.metrics.address=:8082"
  - "--accesslog=true"
  - "--accesslog.filepath=/var/log/traefik/access.log"
  - "--accesslog.format=json"

Traefik Healthcheck & Circuit Breaker Middlewares

Prevent cascading server failures when backend containers become unresponsive by configuring Traefik’s circuit breaker and fallback retry middlewares:

labels:
  # Automatically trip circuit breaker if 500 error rate exceeds 20%
  - "traefik.http.middlewares.my-circuit-breaker.circuitbreaker.expression=NetworkErrorRatio() > 0.20"
  - "traefik.http.middlewares.retry-mw.retry.attempts=3"
  - "traefik.http.routers.whoami.middlewares=my-circuit-breaker,retry-mw"

Traefik Production Performance Tuning & Concurrency Checklist

• Enable TCP Fast Open: Accelerate initial handshakes on high-traffic microservices.
• Configure Idle Connection Pools: Maintain warm persistent backend connections to avoid socket churn.
• Automate ACME Key Backup: Regularly archive acme.json to secure offsite storage to prevent Let’s Encrypt rate-limit lockout during disaster recovery.